CapLoader

CapLoader is a Windows tool from Netresec designed to handle large amounts of captured network traffic, indexing PCAP and PcapNG files and visualising their contents as a list of TCP and UDP flows, letting users select flows of interest and quickly filter those packets out of the loaded files, then send the selected flows or packets to a packet analyser such as Wireshark or NetworkMiner.

The problem it solves is specific and immediately recognisable to anyone who has done this work: conventional packet analysers cannot open very large captures.

The reason is architectural. Tools like Wireshark load and parse packets into memory, which is entirely appropriate for a capture of a few hundred megabytes and fails on a multi-gigabyte one. The application either exhausts memory or becomes unusable, and the captures that matter most are precisely the large ones, because an investigation typically involves hours of traffic from a busy segment rather than a tidy two-minute sample.

CapLoader indexes rather than parses, presenting the capture as flows, which is a far smaller and more meaningful summary. A ten gigabyte capture might contain a few thousand conversations, and a few thousand rows is something a person can actually work through.

Positioning itself as a triage stage feeding other tools rather than replacing them is the right design and honest about scope. The workflow is to identify the interesting conversations in something too large to examine directly, extract just those, and hand a manageable subset to Wireshark or NetworkMiner for detailed analysis.

Thinking in flows rather than packets also matches how investigations reason. The question is which hosts talked to which, for how long and carrying how much, and the individual packets only matter once a conversation has been identified as interesting.

CapLoader is a commercial Windows product from Netresec, with pricing available from the vendor rather than published on the captured page.