Netcap: Deep Network Packet Inspection Platform and Intrusion Detection System

The Problem

Network traffic analysis remains a foundational pillar of enterprise security, yet the tools used to interrogate this traffic have fundamentally failed to evolve with modern network architectures. Organizations today face a critical structural gap between raw packet capture and actionable security intelligence. Traditional packet analyzers force security analysts to manually sift through fragmented, unstructured PCAP data, a process that is entirely unscalable for incident response or machine learning pipelines. Conversely, high-level network monitoring tools often abstract away the payload and metadata necessary to definitively identify advanced persistent threats, leaving blind spots in industrial control systems (ICS) and encrypted traffic streams.

Furthermore, analyzing high-throughput network environments forces unacceptable tradeoffs. Legacy intrusion detection systems drop packets under load, miss novel attacks due to rigid signature dependency, and struggle with the memory overhead required for complex TCP stream reassembly. When attackers utilize custom command-and-control (C2) frameworks or obfuscated data exfiltration methods, standard port-based classification fails. Security teams require a mechanism to reliably convert massive volumes of raw packet streams into type-safe, structured audit records without crippling overhead or data loss.

Solution Overview

Netcap (NETwork CAPture) is a high-performance network protocol analysis framework designed to convert network packets into structured, type-safe Protocol Buffer audit records. Engineered as a robust Intrusion Detection System (IDS) and traffic analysis engine, Netcap bridges the gap between low-level packet capture and high-level security analytics.

By deeply inspecting both standard IT and specialized OT/ICS protocols, Netcap enables automated threat hunting, forensic analysis, and the creation of machine-learning-ready datasets. The product operates on a highly concurrent architecture that provides distinct decoding strategies—allowing organizations to optimize precisely for throughput, memory footprint, or comprehensive data extraction. Currently in Beta, Netcap already delivers production-grade capabilities for organizations requiring absolute visibility into their network state, executing entirely locally to ensure strict data privacy and chain of custody.

Key Capabilities

Deep Protocol Analysis and Extraction

Netcap utilizes over 83 dedicated packet-layer decoders and more than 40 stream-based decoders to dissect network communications. This extends far beyond basic TCP/UDP header analysis to include complex application-layer protocols (HTTP/2, QUIC, SMB, Kerberos, DNS) and specialized industrial control system communications (Modbus, S7Comm, DNP3, OPC-UA, BACnet). The system performs full TCP and UDP stream reassembly, allowing analysts to inspect the complete payload of a connection across fragmented packets.

Advanced Threat Detection and Fingerprinting

To identify malicious traffic even when payloads are encrypted or obfuscated, Netcap implements multi-layered detection mechanisms:

• JA4 Fingerprinting: Comprehensive cryptographic fingerprinting (JA4, JA4S, JA4H, JA4SSH, JA4X) for TLS, HTTP, SSH, and X.509 classification, enabling the identification of specific malware families based on how they establish connections.
• Hyperscan Acceleration: Hardware-accelerated, multi-pattern regular expression matching for service probes and rule engines, vastly increasing detection speeds on high-traffic networks.
• YARA and AI Classification: Extracted files are automatically scanned using compiled YARA rules for malware detection and analyzed using AI-based classification models to determine the true file type regardless of extension.

Protocol-Aware Credential Harvesting

Netcap passively monitors network streams to extract plaintext and hash-based credentials across multiple protocols. By analyzing the state machine of protocols like FTP, HTTP Basic/Digest, SMTP, and IMAP, the framework automatically extracts usernames, passwords, and authentication hashes. This allows security teams to identify vulnerable authentication mechanisms in their environment without active scanning or disruptive testing.

Extensible Output and Enrichment

Raw packets are converted into over 141 distinct audit record types. Netcap automatically enriches this data using reverse DNS resolution, MaxMind GeoIP geolocation, and MAC vendor lookups. To integrate seamlessly with existing enterprise data pipelines, Netcap outputs directly to Protocol Buffers (for compact, language-agnostic storage), CSV, JSON, or directly streams into Elasticsearch for immediate visualization in SIEM environments.

HTTP Header Service Matching

When standard service probes fail to identify non-standard web services, Netcap automatically parses HTTP response headers to extract precise technology stack intelligence. By analyzing Server, X-Powered-By, and Generator headers, it identifies specific application frameworks, CMS platforms, proxies, and CDNs, mapping this intelligence to structural software audit records without relying on rigid port definitions.

Architecture & Technical Design

Netcap is built primarily in Go, optimizing for extreme concurrency and memory safety. The architectural philosophy centers on a decoupled processing pipeline: a central collector ingests packets from live interfaces or PCAP files, distributing them to a scalable worker pool. These workers route packets through a highly optimized decoder hierarchy, generating type-safe Protocol Buffer records.

To handle diverse performance requirements, Netcap implements configurable decoding strategies:

• Pool Mode: Utilizes advanced memory pooling for packet buffers, nearly eliminating garbage collection pressure during high-throughput live captures.
• NoCopy Mode: Eagerly decodes packets using the original buffer directly, minimizing memory allocations in tightly controlled environments.
• Datagrams Mode: Extracts application-layer intelligence from stateless protocols without the overhead of connection tracking.

Furthermore, the architecture is designed for the modern Linux kernel, supporting eBPF (extended Berkeley Packet Filter) integration. Through XDP (eXpress Data Path), Netcap can process packets directly at the NIC driver level, bypassing the standard kernel network stack for zero-copy delivery and sub-microsecond latency. As a compiled native application, Netcap operates entirely on-device, meaning highly sensitive packet captures and forensic data never leave the organization's control environment.

Use Cases & Scenarios

Incident Response: Ransomware Triage

Context: A Security Operations Center (SOC) analyst is investigating a suspected ransomware outbreak across a distributed enterprise network. Challenge: The team has a massive, multi-gigabyte PCAP file capturing the initial breach timeframe, but manual analysis in traditional GUI tools is crashing due to memory limits. Solution: The analyst runs Netcap using memory-pooled decoding to rapidly parse the capture. Leveraging JA4 fingerprinting, Netcap immediately highlights anomalous TLS connections matching known C2 infrastructure. The analyst uses the HTTP header matching capability to identify a vulnerable, unpatched internal CMS server that served as the initial intrusion vector. Outcome: The incident response team isolates the threat in minutes rather than hours, using the structured JSON output to automatically generate firewall blocks.

Industrial Threat Hunting: ICS Network Defense

Context: An OT Security Engineer at a manufacturing plant. Challenge: Ensuring that industrial control systems (ICS) are not receiving unauthorized logic modifications, which could lead to physical equipment damage. Solution: The engineer deploys Netcap sensors configured to monitor the factory floor network. Utilizing Netcap's specialized OT decoders, the system inspects Siemens S7comm traffic. Netcap applies built-in threat hunting rules mapped directly to CISA advisories to detect unauthorized CPU restarts or logic download commands sent to programmable logic controllers (PLCs). Outcome: The engineer gains unprecedented, function-code-level visibility into industrial protocols, proactively identifying misconfigured workstations communicating with critical OT infrastructure.

Machine Learning: IDS Model Training

Context: A Data Scientist building a custom Intrusion Detection System. Challenge: Machine learning models require structured, labeled, and normalized data, but raw PCAP files are inherently unstructured and difficult to parse programmatically. Solution: The data scientist processes thousands of historical PCAP files through Netcap, outputting the results as compact Protocol Buffers. Netcap's type-safe schema guarantees consistent feature formatting, while its built-in attack labeling system automatically annotates the records based on known malicious IP lists and Suricata rules. Outcome: The data science team drastically reduces data engineering time, ingesting highly enriched, properly labeled network telemetry directly into their TensorFlow pipelines for model training.

Penetration Testing: Passive Reconnaissance

Context: A Red Team operator conducting an internal network assessment. Challenge: Mapping the internal network and identifying authentication vulnerabilities without triggering active defense mechanisms. Solution: The operator passively captures broadcast and local traffic, feeding it into Netcap. The platform's credential harvesting subsystem silently extracts plaintext passwords from legacy protocols and captures authentication hashes. Concurrently, the HTTP header matching engine fingerprints all internal web services. Outcome: The operator maps the internal attack surface and gathers actionable credentials with zero active scanning footprint.

Pricing & Plans

Netcap is provided as a locally installed, downloadable application. The Core engine is available as open-source, while the Pro version provides a comprehensive desktop investigation workspace.

Plan	Price	Included Features
Core	€0	Open-source CLI engine, standard decoders, basic output formats, community support.
Pro Monthly	€49 / month	Everything in Core, Cross-platform Desktop App, Graph Analysis Engine, AI-powered Threat Detection, Timeline Analysis, Tool Integrations, Investigation Notes, Session Export & Loading, Email Support.
Pro Yearly	€490 / year	All Pro Monthly features with annual billing discount.
Enterprise	Custom	Unlimited usage, dedicated instance/builds, SSO/SAML integrations, SLA guarantee, priority feature requests, on-premise integration options, dedicated account manager.

Pricing Philosophy: We believe fundamental network analysis should be accessible, which is why the Core engine remains open-source. For security professionals requiring advanced graphical investigations and AI integrations, the Pro tier offers a powerful desktop workspace. Enterprise engagements provide custom integrations and dedicated support for large-scale SOC deployments.

Frequently Asked Questions

What platforms does Netcap support? Netcap is compiled as a single native binary and supports Linux, macOS, and Windows. The Netcap Pro desktop application is similarly cross-platform, ensuring security teams can operate on their preferred operating systems.

How does Netcap handle high-throughput, multi-gigabit traffic? Netcap utilizes a highly concurrent worker architecture in Go. For extreme throughput on Linux, it supports advanced configuration options like memory pooling (reusing buffers to eliminate garbage collection overhead) and zero-copy packet delivery via eBPF and XDP, allowing it to process millions of packets per second without loss.

Does Netcap require an internet connection or send data to the cloud? No. Netcap is a standalone application that executes entirely on-device. Your network traffic, PCAP files, and generated audit records remain strictly within your local environment, ensuring total compliance with data privacy policies and chain-of-custody requirements.

How does Netcap identify threats in encrypted traffic? While Netcap cannot decrypt traffic without the session keys, it excels at analyzing the metadata of encrypted connections. By utilizing JA4 fingerprinting standards, Netcap analyzes the unencrypted handshakes of TLS, SSH, and QUIC protocols to definitively identify malicious clients, known malware families, and anomalous connection patterns.

Why Amsterdam Technologies

Amsterdam Technologies engineers solutions that respect the intelligence and operational realities of security professionals. Based in Amsterdam, Netherlands, our engineering-first culture prioritizes performance, technical transparency, and data sovereignty. Netcap exemplifies this philosophy: it abandons the opaque, black-box approach of legacy IDS vendors in favor of an extensible, highly optimized framework that gives operators absolute control over their network telemetry. As we continue to advance Netcap's capabilities—including deeper eBPF integration and expanded AI-driven protocol analysis—it remains a cornerstone of our broader portfolio of privacy-first, high-performance computing solutions.

• Website: https://netcap.io
• Contact: support@amsterdam-technologies.com
• Company: amsterdam-technologies.com