Kestrel Sight
support & FAQ.

Three ways. One — tap Open on the welcome screen and pick from Files, iCloud Drive, or any file provider. Two — share a PCAP from Mail, Messages, or any app that accepts Files, and pick Kestrel from the share sheet. Three — AirDrop a file from your Mac straight to Kestrel.

PCAP (libpcap, magic 0xA1B2C3D4, native and byte-swapped) and PCAPNG (section-header-block format). These are the outputs of Wireshark, tcpdump, tshark, and every other standard capture tool.

Under 1 GB, the current Lite and Sight builds use the standard analysis path with automatic TCP stream reassembly. At or above 1 GB, Kestrel switches to a streaming/header-first path and disables TCP reassembly to protect device memory. Packets, flows, hosts, DNS, and timeline remain available; raw payload text search has reduced coverage because it uses the indexed packet region rather than every byte of the on-disk payload. Kestrel also creates a protected sandbox working copy, so free space roughly equal to the capture size is required in addition to normal system headroom.

For captures up to 500 MB, Kestrel computes SHA-256 over the capture contents. Above 500 MB, the current shipping build uses a SHA-256 value derived from file size, filename, and modification date as a session identifier; that larger-file value is not a content evidence hash. This is a current implementation limitation, not a claim about SHA-256 itself.

No. iOS does not expose the equivalent of Berkeley Packet Filter to third-party apps — this is an Apple platform restriction, not a Kestrel limitation. Kestrel analyzes capture files generated elsewhere with a tool such as Wireshark or tcpdump.

Free text (matches IP, port, protocol, info, flags). CIDR (192.168.1.0/24). Protocol name (TCP, DNS). Port number (443 or :8080). Directional IP (src=10.0.0.1, dst=8.8.8.8). Sight adds raw payload text search with raw=password. At 1 GB and above, raw search uses the indexed packet region rather than the full on-disk payload. Space-separated terms are AND-combined.

Segments are ordered by TCP sequence number and overlapping retransmitted ranges are deduplicated. In the current shipping Lite/Sight core, captures with missing TCP segments can be represented approximately during reconstruction, so reconstructed bytes that cross capture gaps should not be treated as forensic ground truth. HTTP transaction markers such as method and status lines are identified where the required bytes are present.

The Pro credential scanner (in development) will find exposed secrets across common protocols. Masking will be the responsible default — findings are intended to be reported as salted SHA-256 fingerprints. Raw detected values are not intended to be persisted as findings or written into reports, and preview display in the UI masks interior characters until explicitly revealed. Kestrel Sight and Lite do not include a credential scanner.

Lite and Sight share the same current shipping analysis core: dashboard, packets, flows, hosts, DNS, streams, timeline, and audit logging. Lite caps display at the first 50,000 packets per file. Sight removes that cap and adds analyst bookmarks, raw payload text search, enhanced IPv6 display, and refined PDF reports. Anomaly detection, sensitive-data scanning, and file carving are Pro features in development. Sight is available on the App Store.

Analysis happens on-device. Kestrel contains no application endpoints or analysis code that initiate network connections, no cloud-analysis service, no telemetry, and no third-party analytics SDK. Anything that leaves the device does so because you exported it — Files, AirDrop, Share Sheet, or a PDF report. Read the full privacy policy for specifics.

Kestrel accesses the capture you select through the system file picker and creates a protected working copy inside its own sandbox, stored with NSFileProtectionComplete. Kestrel does not write to your original file. App-local working copies and session state remain in the sandbox and are removed if you delete the app; files you explicitly export are controlled by the destination you selected. Plan on needing free space roughly equal to the capture size for the working copy.

No. No sign-in, no cloud sync, no identity. Purchases go through the App Store and are tied to your Apple Account, not to any Tracivex account.

Make sure the file is actually a PCAP or PCAPNG — some apps export capture metadata in JSON or CSV that shares nothing with the binary format. Open the file in Wireshark on another machine to confirm. If it opens there but not in Kestrel, send me the file details (size, source tool) by email.

At 1 GB and above, the current Lite/Sight build uses its streaming/header-first path and disables TCP reassembly. Packet density matters as much as file size because packet metadata still scales with packet count. Raw payload text search also has reduced coverage in this mode. If something is genuinely hung, force-quit, reopen, and tell me the capture size, approximate packet count if known, device model, and iOS version.

First make sure you’re signed in with the Apple Account that made the purchase. In-app purchases can be restored from Settings · Restore Purchases; a separately purchased app can be reinstalled from your App Store purchase history. If neither works, send me your receipt and I’ll help directly.

Email me with device model, iOS version, app version (Settings · About), and what you were doing when the bug happened. A reproduction case — even “I tapped X then Y and saw Z” — is worth ten vague descriptions. Please don’t attach PCAP files without asking first; they often contain sensitive data.