01
Import
Select a PCAP or PCAPNG through the system file picker. The current Lite/Sight builds create a protected working copy inside the Kestrel sandbox.
FILE → PROTECTED WORKSPACE
0x01 · KESTREL SECURITY STACK
2 SHIPPING
1 BUILDING
Open the capture.
Follow the flow.
Kestrel turns PCAP and PCAPNG captures into packets, flows, hosts, DNS, TCP streams, timelines, bookmarks, and reports on iPhone and iPad. Lite and Sight ship today. Pro is the advanced analysis branch in development. Analysis is processed locally rather than sent to a Tracivex cloud service.
INPUTPCAP · PCAPNG
PLATFORMiPhone · iPad
ACCOUNTNone required
PROCESSINGOn-device
SHIPPING
NO CLOUD ANALYSIS
01NO TRACIVEX ACCOUNT
02NO ANALYTICS ADDED
03NO THIRD-PARTY RUNTIME
04USER-DIRECTED EXPORT
────── FROM CAPTURE TO CONTEXT ──────
0x10 · PIPELINE
Start with bytes. End with context.
Kestrel organizes the capture into progressively more useful layers without turning the workflow into a desktop packet-analyzer clone.
02
Parse
Turn capture records into searchable packets with protocol, endpoint, timing, and payload context.
PACKETS · FILTERS · PROTOCOLS03
Map
Collapse individual packets into flows, hosts, DNS activity, and timeline context so the capture starts telling a story.
FLOWS · HOSTS · DNS04
Reconstruct
In the shipping standard path, reconstruct TCP streams for captures under 1 GB. Pro is developing a newer disk-backed reconstruction path.
TCP STREAMS05
Investigate
Sight adds bookmarks, raw payload text search, enhanced IPv6 display, and refined reports. Pro adds advanced detection and evidence-oriented tooling in development.
BOOKMARKS · REPORTS · PRO────── EDITIONS ──────
0x20 · SHIPPING
Two editions you can install today.
Lite and Sight share the current shipping core. Sight removes the Lite packet cap and adds the professional investigation workflow.
I.● SHIPPING
II.● SHIPPING
PROFESSIONAL · NO PACKET CAP
Kestrel Sight
Everything in Lite, without the 50,000-packet display cap, plus the tools for a more deliberate investigation.
- Analyst bookmarks with notes
- Raw payload text search with raw=
- Enhanced IPv6 display
- Refined PDF reporting
SHIPPING CORE
At 1 GB and above, Lite and Sight switch to a streaming/header-first path, disable TCP reassembly, and reduce raw payload text-search coverage to the indexed packet region. Detailed limits are published below.
────── ON THE BENCH ──────
0x30 · DEVELOPMENT
The stack is still moving.
Pro is shown as development work, not as a shipping feature set. It also carries newer revisions of parts of the shared core while that hardening work continues.
III.PRO · BUILDING
Turn analysis into findings.
Kestrel Pro is the advanced investigation tier in development. It adds detection and artifact workflows on top of the Kestrel core while the underlying flow identity, reconstruction, link-layer handling, and evidence-processing paths are also being hardened.
SENSITIVE DATASalted SHA-256 finding fingerprintsRaw detected values are not persisted as findings or written into reports.
ANOMALIESBeaconing · DNS · scans · asymmetryHeuristic findings require analyst verification.
CARVINGFormat-aware artifact validationSHA-256 artifact hash + legacy MD5 compatibility identifier.
AUDITTamper-evident session chainHash-linked events, not a digital signature or trusted timestamp.
IN DEVELOPMENT
────── INTERFACE TOUR ──────
0x40 · SIGHT
Ten screens. One investigation.
Swipe through the shipping Sight interface on iPhone and iPad. Click either device to open the full-size viewer.
01 / 10
Swipe or use the arrows · Click an image to enlarge
────── CAPABILITY MAP ──────
0x50 · COMPARE
Same family. Different depth.
The matrix keeps shipping capability separate from Pro development claims.
CAPABILITY
LITE
SIGHT
PRO*
Packets & filtering
50k cap
No cap
No cap (dev)
Flows · hosts · DNS
Included
Included
In dev build
TCP stream reconstruction
<1 GB
<1 GB
Disk-backed (dev)
Analyst bookmarks
—
Included
In dev build
Raw payload text search
—
Included
In dev build
Enhanced IPv6 display
—
Included
In dev build
Refined PDF reports
—
Included
In dev build
Sensitive-data scanner
—
—
Building
Anomaly detection
—
—
Building
File carving / media
—
—
Building
Tamper-evident audit chain
—
—
Building
Findings Mode
—
—
Building
* Pro is in development. Development behavior can change before release.
────── SCALE & LIMITS ──────
0x60 · CAPACITY
Size is only part of the story.
Packet density, available storage, and the device memory budget can matter more than a capture’s raw file size.
SHIPPING · LITE / SIGHT
Standard below 1 GB.
Under 1 GB, the current shipping builds use the standard analysis path with automatic TCP reassembly.
- < 1 GB
- Standard analysis + TCP reconstruction
- ≥ 1 GB
- Streaming/header-first; reassembly off
- RAW SEARCH
- Indexed packet region in large mode
- STORAGE
- Protected sandbox working copy
DEVELOPMENT · PRO
Stream data can spill to protected disk.
Pro’s development branch can move large reconstructed streams out of RAM, but packet-index memory still scales with packet count.
- < 2 GB
- Current standard parser path
- LARGE
- Findings Mode / bounded first-portion choice
- PRIMARY RAM FACTOR
- Packet count
- PUBLIC MAXIMUM
- None validated yet
Current Lite/Sight hashing limitation
Captures up to 500 MB receive SHA-256 over the capture contents. Above 500 MB, the current shipping build displays a SHA-256 value derived from file size, filename, and modification date. That larger-file value is a session identifier, not a content evidence hash.
────── TRUST BOUNDARY ──────
0x70 · PRIVACY
Local by default. Explicit when data leaves.
The useful privacy claim is not “nothing can ever leave.” It is that Kestrel does not send your capture to a Tracivex analysis service.
01YOUR CAPTURESelected through Files / system picker
02KESTREL SANDBOXProtected working copy + local analysis state
03YOUR EXPORTFiles, PDF, AirDrop, Share Sheet when you choose
TRACIVEX ACCOUNTNone required
CLOUD ANALYSISNone
ANALYTICSNone added
THIRD-PARTY RUNTIMENone in reviewed source
────── FIELD USE ──────
0x80 · USE
Built for the moments between workstations.
Kestrel is most useful when the capture is already in your hands and the laptop is not.
Field triage
Open a capture on-site, identify talkers, protocols, DNS activity, and suspicious conversations before you return to a full workstation.
Incident response
Keep a lightweight analysis surface on the device you already carry while maintaining an explicit boundary around local evidence handling.
Troubleshooting & learning
Inspect protocol behavior, connectivity problems, and packet structure without needing a desktop analyzer for every question.
TECHNICAL NOTES
Kestrel analyzes pre-captured PCAP and PCAPNG files on iOS and iPadOS; live capture is not part of the shipping mobile application. Kestrel creates a protected sandbox working copy for analysis, so available storage should be roughly at least the capture size plus normal system headroom. Large captures may take substantially longer depending on packet density.
Pro detection features are heuristic and may produce false positives or miss findings. Verify important results independently. Kestrel is not a substitute for a qualified analyst or a dedicated forensic workstation, and should not be used alone where evidentiary admissibility matters.
No software can guarantee absolute security. Users handling sensitive captures should follow their organization’s evidence-handling procedures.