Analyze packets without ever letting them leave.
Just upload a .pcap in your browser. All data stays local: no cloud dependency, no telemetry. A web PCAP analyzer that runs entirely inside your own server.
Sound familiar?
PCAP analysis is slow
Device-bound: even opening a GB-scale capture takes time.
Sensitive traffic can't leave
Cloud analyzers assume data egress, unusable for traffic you can't send offsite.
Specialized tools are costly & complex
Powerful, but heavy to deploy and run, and they demand specialists.
Captures scatter across sites
Files sit per-site with no unified, cross-site view.
A self-hosted analyzer, just upload
Just upload a .pcap in your browser, browse metadata, inspect protocol layers, run DNS analysis, and selectively export, all in a self-hosted analyzer that runs entirely in the browser.
Privacy
All data stays local. No cloud dependency, no telemetry.
Speed
Parallel parsing and SQLite indexing keep large captures fast.
Ease
No install. Every action runs from the browser.
Everything you need to investigate
Upload & Index
Parallel-parse .pcap / .pcapng / .gz and auto-index into SQLite.
Protocol Decoding
Ethernet → IP → TCP/UDP/ICMP → DNS, with a hex viewer.
DNS FQDN Analysis
Search by name, IP, or type; correlate queries and answers.
Flow Analysis
Top flows, latency distribution, and pps charts.
Selective Export
Filter by protocol; export matches as .pcap.gz.
Live Capture
Start capturing from the browser and stream packets in real time.
All your data stays inside your own server.
Runs on-premises or in air-gapped environments: analyze sensitive networks you can't send offsite.
From upload to insight in minutes.
Glean Packets operations and user guide (Japanese / English).
Deploy across servers. Reach every capture.
Capture remotely on any node and reach every capture in the cluster from anywhere.
- Remote capture on any node
- Merge PCAPs across nodes
- Unified access, no single point of failure
◄——— peer-to-peer ———►
Chat with your captures.
Ask in plain language to search, summarize, and capture packets on any node, under your existing access controls, inside your own environment.
Capture 100 packets on node3 eth0 and summarize it
illustrative
- Search & summarize in plain language
- Capture on any node, on demand
- Under your existing access controls
Optional, self-hosted AI layer with a pluggable design: to preserve privacy it connects to an LLM endpoint you control, your own GPU node, an on-prem LLM appliance, or a private endpoint. GPU recommended.
Detect with your own rules, no external IDS/IPS.
Extend with your own rules
Add and tune detection logic freely with YAML rules plus regex.
Prioritize by score
Severity and confidence yield a 0–100 score to clarify response priority.
Detect at the app layer
Catches app-layer traits (HTTP URI, User-Agent, headers) plus SSL/SNI parsing.
Lightweight, in your environment.
From daily checks to forensics.
Product testing
Complement load generators; verify expected traffic.
Network troubleshooting
Isolate latency, retransmits, and anomalous flows.
DNS / resolution analysis
Correlate queries and answers; spot anomalies.
Network forensics
Preserve the original while extracting evidence.
Distributed-site monitoring
Review captures across sites in one place.