From 68702f1b2e86c404c21954c5d5937fbf726c5572 Mon Sep 17 00:00:00 2001 From: Andy Dixon Date: Fri, 9 Oct 2026 18:43:42 +0100 Subject: [PATCH] Docs: mark Phase 3 implemented (conversations, follow stream, DNS/TLS explorers, statistics) --- README.md | 4 ++-- docs/architecture.md | 7 ++++--- docs/limitations.md | 10 +++++++--- web/dist/.gitkeep | 0 4 files changed, 13 insertions(+), 8 deletions(-) create mode 100644 web/dist/.gitkeep diff --git a/README.md b/README.md index ae9cdf0..5a07936 100644 --- a/README.md +++ b/README.md @@ -20,11 +20,11 @@ capture or analysis. |---|---|---| | 1 | Installer, services, auth, AP / DHCP / DNS / firewall, health | implemented | | 2 | dumpcap capture, pcapng storage, live analyser, filters, export / import | implemented | -| 3 | Conversations, follow TCP stream, DNS/TLS explorers, statistics | not started | +| 3 | Conversations, follow TCP stream, DNS/TLS explorers, statistics | implemented (HTTP explorer deferred) | | 4 | Optional HTTPS inspection (mitmproxy, client-trusted CA) | not started | | 5 | Hardening, advanced UI, benchmarks | partial | -Pages for later phases are not in the UI. PiLens never shows controls that do +HTTP Explorer (Phase 3 in the spec) is deferred with Phase 4, since useful HTTP content requires interception. Pages for later phases are not in the UI. PiLens never shows controls that do nothing. For what was tested and how, see [docs/testing.md](docs/testing.md). ## Quick start diff --git a/docs/architecture.md b/docs/architecture.md index fe3d93b..1124478 100644 --- a/docs/architecture.md +++ b/docs/architecture.md @@ -167,6 +167,7 @@ dumpcap -i IF [-f BPF] -w - ──pcapng──▶ splitter ──▶ seg-000001 ## Not yet implemented (phase 3+) -These pages are not in the navigation until they work: conversations / follow -TCP stream, DNS/TLS/HTTP explorers, statistics, findings, TLS interception -(modes B and C), and scheduling. +Implemented since Phase 2: conversations, follow TCP stream, DNS explorer, TLS +explorer (metadata only), statistics. Not in the navigation until they work: +HTTP explorer and TLS interception (modes B and C, deferred together), findings, +and capture scheduling. diff --git a/docs/limitations.md b/docs/limitations.md index c5f37c2..e8891f6 100644 --- a/docs/limitations.md +++ b/docs/limitations.md @@ -7,9 +7,13 @@ versions, ALPN; for TLS 1.2: certificates). The optional HTTPS inspection mode ( CA via mitmproxy) is **not implemented** in this version, and even when it is, it will not work against certificate pinning, private trust stores, mutual TLS, QUIC, or apps that bypass proxies. -**Not yet implemented:** conversations view, follow TCP stream, DNS/TLS/HTTP explorers, -statistics charts, findings/diagnostics rules, capture scheduling, the strict inspection mode, -WireGuard, packet comparison. They are not shown in the UI. +**Not yet implemented:** HTTP explorer, findings/diagnostics rules, capture scheduling, +the strict inspection mode, WireGuard, packet comparison. They are not shown in the UI. + +**TLS explorer shows metadata only.** SNI, ALPN, negotiated version and cipher, plus any +certificate sent in the clear (TLS ≤1.2). TLS 1.3 encrypts the certificate, so the certificate +tab is usually empty — this is expected, not a fault. "Follow TCP stream" reconstructs the +transport payload, which for TLS is ciphertext. **IPv6** is blocked for AP clients rather than routed (see network.md). diff --git a/web/dist/.gitkeep b/web/dist/.gitkeep new file mode 100644 index 0000000..e69de29