Skip to content
← Products

Analyze packets without ever letting them leave.

Just upload a .pcap in your browser. All data stays local: no cloud dependency, no telemetry. A web PCAP analyzer that runs entirely inside your own server.

Glean Packets dashboard
The problem

Sound familiar?

PCAP analysis is slow

Device-bound: even opening a GB-scale capture takes time.

Sensitive traffic can't leave

Cloud analyzers assume data egress, unusable for traffic you can't send offsite.

Specialized tools are costly & complex

Powerful, but heavy to deploy and run, and they demand specialists.

Captures scatter across sites

Files sit per-site with no unified, cross-site view.

What is Glean Packets?

A self-hosted analyzer, just upload

Just upload a .pcap in your browser, browse metadata, inspect protocol layers, run DNS analysis, and selectively export, all in a self-hosted analyzer that runs entirely in the browser.

Privacy

All data stays local. No cloud dependency, no telemetry.

Speed

Parallel parsing and SQLite indexing keep large captures fast.

Ease

No install. Every action runs from the browser.

Key features

Everything you need to investigate

Upload & Index

Parallel-parse .pcap / .pcapng / .gz and auto-index into SQLite.

Protocol Decoding

Ethernet → IP → TCP/UDP/ICMP → DNS, with a hex viewer.

DNS FQDN Analysis

Search by name, IP, or type; correlate queries and answers.

Flow Analysis

Top flows, latency distribution, and pps charts.

Selective Export

Filter by protocol; export matches as .pcap.gz.

Live Capture

Start capturing from the browser and stream packets in real time.

Privacy-first

All your data stays inside your own server.

100%
On-premises
0
Telemetry sent
0
Cloud dependency

Runs on-premises or in air-gapped environments: analyze sensitive networks you can't send offsite.

See it in action

From upload to insight in minutes.

Glean Packets operations and user guide (Japanese / English).

Multi-node ready

Deploy across servers. Reach every capture.

Capture remotely on any node and reach every capture in the cluster from anywhere.

  • Remote capture on any node
  • Merge PCAPs across nodes
  • Unified access, no single point of failure
N1 gp-node1 capture
N2 gp-node2 capture
N3 gp-node3 capture

◄——— peer-to-peer ———►

Glean Agent

Chat with your captures.

Ask in plain language to search, summarize, and capture packets on any node, under your existing access controls, inside your own environment.

Capture 100 packets on node3 eth0 and summarize it

Glean Agent Captured 100 packets on node3 (eth0). TCP 63 · UDP 30 · ICMP 7. Top talker 10.0.3.14 → DNS resolver.

illustrative

  • Search & summarize in plain language
  • Capture on any node, on demand
  • Under your existing access controls

Optional, self-hosted AI layer with a pluggable design: to preserve privacy it connects to an LLM endpoint you control, your own GPU node, an on-prem LLM appliance, or a private endpoint. GPU recommended.

Threat detection (signature-based)

Detect with your own rules, no external IDS/IPS.

Extend with your own rules

Add and tune detection logic freely with YAML rules plus regex.

Prioritize by score

Severity and confidence yield a 0–100 score to clarify response priority.

Detect at the app layer

Catches app-layer traits (HTTP URI, User-Agent, headers) plus SSL/SNI parsing.

Tech & requirements

Lightweight, in your environment.

Formats
.pcap / .pcapng / .gz
Stack
Rust + React + SQLite (WAL mode)
Deployment
Browser-based; TLS via reverse proxy.
Lightweight
Runs on commodity hardware, no heavy gear.
Bilingual UI
English / Japanese (desktop & mobile).
Auth
JWT (admin / user) + Argon2 hashing
Glean Agent
Pluggable LLM: connects to a self-hosted or customer-provided endpoint (GPU recommended). Optional.
Where it fits

From daily checks to forensics.

Product testing

Complement load generators; verify expected traffic.

Network troubleshooting

Isolate latency, retransmits, and anomalous flows.

DNS / resolution analysis

Correlate queries and answers; spot anomalies.

Network forensics

Preserve the original while extracting evidence.

Distributed-site monitoring

Review captures across sites in one place.

FAQ

Frequently asked questions

Is my data sent to the cloud?
No. Everything runs inside your own server with no telemetry. It works on-premises and in air-gapped environments.
What file formats are supported?
.pcap, .pcapng, and .gz.
Do I need to install anything?
Every action runs from the browser. No special gear: it runs on commodity hardware.
How is it different from Wireshark?
It's browser-based and self-hosted, with shared multi-node access across sites and fast SQLite-indexed search.
Is there a Japanese UI?
Yes, a bilingual Japanese / English UI on desktop and mobile.

In your own environment. Today.

Privacy-first PCAP analysis, running on your server.