Capturing packets
Filters, what gets decoded, and where this stops being the right tool.
Before you start
- Npcap installed
- Administrator rights, sometimes
Capture on one adapter or all of them at once. The adapters are opened through Npcap, and Npcap decides who may open them: if it was installed with its driver restricted to administrators, or every adapter refuses to open, run CySecTek as administrator. The app itself never asks for elevation.
Filters
Two kinds, and the difference matters:
- Address, port and protocol are compiled to a BPF filter and applied by the driver, before packets reach the app. These are set before the capture starts and are the ones that keep a busy link manageable.
- Application and keyword filters are matched after decoding, so they can be changed while the capture is running without losing what you already have.
What is decoded
Ethernet, IPv4, IPv6, ARP, TCP, UDP and ICMP, to one line per packet. Common applications are identified, DNS queries are summarised, and HTTP request lines are shown.
Where this stops
There is no packet detail tree, no hex view, no follow-stream, and no reading or writing of pcap files. This is a visibility check — is the traffic arriving, and from whom. For real trace analysis use Wireshark, which is free and better at it. Nothing here is trying to replace it.