A-Packets

A-Packets analyzes PCAP and PCAPNG captures for incident response, forensics, and protocol inspection. Its analyzer rebuilds HTTP sessions, maps hosts and services, examines wireless artifacts, extracts files, detects exposed credentials, and flags suspicious events. The hosted analyzer accepts native .pcap and .pcapng files produced by capture tools such as Wireshark and tcpdump. Public analysis is available without signup for free, with a 25 MB upload limit; its results are public. Monthly workspace plans start at $11.99 a month and include private reports and a REST API key. One-time credit packs start at $14.99, paid once, and their reports are automatically deleted after 30 days. Workspace subscriptions provide permanent private storage controlled by the account holder. For customer-managed deployment, OnPrem supports Docker Compose, Kubernetes with Helm, and air-gapped setups, with capture and report storage in customer-controlled infrastructure. OnPrem handles captures case by case and does not decrypt TLS payloads, capture continuously, or alert. A-Packets lists SOC, DFIR, incident response, network security, network operations, MSSP, integration, and forensic teams among its intended OnPrem users.

A-Packets combines capture inspection with public analysis, private workspaces, and customer-controlled OnPrem deployment. Check the public-result visibility, file limits, and OnPrem scope against your workflow before choosing a plan.

A-Packets suits incident response, forensics, and network teams that need to inspect saved PCAP or PCAPNG captures. Its OnPrem option is aimed at SOC, DFIR, security, operations, MSSP, integration, and forensic teams seeking customer-controlled deployment.

A-Packets is a PCAP and PCAPNG analysis service for incident response, forensics, and protocol inspection. It best suits analysts investigating saved captures who need private reports or customer-controlled deployment. Its broad artifact review is useful for casework, while its file-by-file workflow does not serve continuous monitoring.

Overview

Upload captures made with tools such as Wireshark or tcpdump to investigate traffic after collection. A-Packets combines protocol inspection with views of hosts, services, wireless artifacts, extracted files, exposed credentials, and suspicious events. That range can help an analyst move from a packet capture to several relevant lines of inquiry in one workflow.

Privacy depends on the plan and deployment. Public analysis creates a public result page, so it belongs only with sanitized captures that are safe to share. Subscription analyses remain in permanent private storage controlled by the account holder; reports from one-time credit packs are deleted after 30 days. The hosted service says it encrypts data in transit and at rest, isolates private captures, and restricts access to personal information to authorized personnel. Uploaded files and related data are stored in AWS S3 in the United States and MongoDB Atlas, whose region depends on the selected cluster and may include the United States.

Key features

A-Packets reconstructs HTTP sessions, maps communicating hosts and services, reviews wireless artifacts, extracts files, identifies credential exposure, and flags suspicious events. This breadth is valuable when an investigation requires more than a packet-level view. Its scope remains post-capture analysis: it processes captures case by case and does not decrypt TLS payloads, capture traffic continuously, or provide alerting. It also does not replace SIEM, IDS, or NDR platforms.

Workspace plans include a REST API key, which gives teams an integration point alongside private analysis. For organizations that need local identity and provisioning options, OnPrem supports passkey two-factor authentication, LDAP/Active Directory, SAML 2.0, OAuth through Google, Microsoft, and GitHub, and SCIM. Deployment options include Docker Compose, Kubernetes with Helm, and air-gapped environments. Captures and reports stay in infrastructure controlled by the customer; the platform says it sends no capture data, telemetry, or license checks to A-Packets and uses signed container images with an SBOM for each image. This is a meaningful fit for teams with strict infrastructure controls, though the product's case-by-case analysis still leaves live detection to other systems.

Pricing

The free Public analysis plan costs nothing with no signup. It accepts sanitized captures up to 25 MB and publishes the result page, making it suitable for shareable material rather than sensitive investigations.

Paid subscriptions add private reports and permanent account-controlled storage, plus a REST API key. The 25 MB Starter Workspace costs $11.99 a month or $99 a year and allows 10 private files. It is the entry point for regular, smaller investigations; the yearly option costs less than twelve monthly payments, but bills once per year. Professional raises the cap to 50 MB and 50 private files for $24.99 a month or $199 a year. Advanced allows 100 MB files and 100 private files for $49.99 a month or $399 a year. Those higher tiers suit analysts with larger captures or a fuller private case archive, while the lower tiers trade file size and capacity for lower recurring costs.

One-time packs avoid a monthly subscription but have finite analysis counts, 25 MB or 50 MB file caps, and a six-month expiry. Starter Pack costs $14.99, paid once for 3 private analyses with a 25 MB maximum. Standard Pack costs $44.99, paid once for 10 analyses with a 50 MB maximum. Pro Pack costs $99.99, paid once for 25 analyses with a 50 MB maximum. These fit occasional work; the 30-day report deletion makes them less suitable when investigations need durable reports.

OnPrem uses custom pricing. Inquiries normally begin with a 30-minute fit call, and A-Packets says it replies to requests within two business days.

Platforms

A-Packets is available as a web service, API, and self-hosted deployment. The hosted analyzer accepts native .pcap and .pcapng files. The API is included with Workspace plans; self-hosted OnPrem deployment adds customer-controlled storage and air-gapped options for organizations that need them.

Who it's for

A-Packets is a strong match for incident responders, forensic analysts, and network security teams that need to examine saved captures and keep reports private. Its OnPrem offer is aimed at SOC, DFIR, incident response, network security, network operations, MSSP, integration, and forensic teams. Individuals and smaller teams can use the workspace subscriptions or packs, depending on whether they need recurring capacity or occasional analyses. It is a poor fit for teams whose central requirement is continuous capture, TLS decryption, or live alerting.

Pros and cons

• Pros: One analyzer covers HTTP reconstruction, host and service mapping, wireless artifacts, file extraction, credential exposure, and suspicious-event flags, giving post-capture investigations several useful views.
• Pros: Subscription plans keep private analyses permanently under account-holder control, and Workspace plans include a REST API key.
• Pros: OnPrem supports air-gapped deployment, customer-controlled capture and report storage, and several enterprise identity and provisioning methods.
• Cons: Public analysis exposes results on a public page, so it is unsuitable for sensitive captures.
• Cons: File size and private-file caps vary by subscription, while one-time packs also limit analysis count and expire after six months.
• Cons: Credit-pack reports are deleted after 30 days, limiting their use for investigations that need long-term report retention.
• Cons: Case-by-case processing, no TLS payload decryption, and no continuous capture or alerting leave operational monitoring to other tools.

Alternatives

For a broader starting point, browse Network Protocol Analyzers or Network Packet Analyzer Software.

• termshark is a free, MIT-licensed option for users who need its Linux, macOS, Windows, or Android platforms and can meet its tshark 1.10.2-or-higher requirement.
• NetworkMiner is a free, open-source option for readers who prefer software released under GPLv2 and available for Linux, macOS, and Windows.
• PacketSnitch is a paid option with a free plan and free trial for readers considering Linux, macOS, or Windows software.
• RedSplice Network Analyzer may suit readers who want a free 15-day trial with limited capture time, or a Professional plan that supports unlimited capture time, decoding non-local captures, and sending packets back.
• Scapy is a free, GPLv2-licensed option for readers who want Python 3.7-or-higher software across API, web, self-hosted, and desktop platforms.
• Arkime is a free, open-source option with no paid-only features or license fees for readers considering API, web, or self-hosted platforms.
• Colasoft Capsa offers a Windows free edition capped at 10 monitored IP addresses, a four-hour session timeout, and no WiFi connection monitoring; readers seeking those constraints may prefer it.
• EtherApe is a free option for readers seeking Linux software.

Verdict

A-Packets is a good choice for analysts who need a broad, private workspace for investigating saved captures, and for organizations that require customer-controlled OnPrem deployment. The central reason to choose it is the combination of artifact inspection, private reports, and flexible deployment. Look elsewhere if your work depends on continuous monitoring, alerting, TLS payload decryption, or reports from credit packs that must remain available beyond 30 days.