Conversations and statistics are computed from the SQLite summary index (across segments); stream payload via tshark follow; DNS/TLS fields via tshark. TLS is metadata-only and labelled 'encrypted pass-through' throughout.
React/TS analyser (virtualised packet list, protocol tree, verified hex mapping), setup wizard, network/devices/health/library/settings pages. Installer with backup and rollback, uninstall/repair/diagnose. Docker+netns integration suite covering DHCP, DNS, NAT, isolation, IPv6 blocking, capture and export.
TLS-only HTTP API with Argon2id auth, setup token, CSRF, TOTP, login throttling, management source allow-list; network apply via helper; capture endpoints; SSE events; crash recovery of interrupted segments; systemd notify/watchdog.
Andy Dixon