Pruftnet

Pruftnet captures traffic from one or more network interfaces, decodes each packet into a tree of fields and keeps the whole capture on disk as pcapng. It runs as a desktop app, or as a local server you open in the browser with pruftnet serve.

The first version came out of my bachelor thesis at TH Nürnberg and had a topology graph and a drag-and-drop workflow builder. Version 0.2 is a rewrite, and the topology graph and the workflow builder are not back yet. They will return later: for now the goal is to fix compatibility problems and improve performance. Capture moved into a native C++ worker that writes every packet to disk before any analysis runs, so the app can tell you exactly how many packets it received, stored or dropped.

• Captures Ethernet, Wi-Fi and loopback interfaces at the same time, with BPF filters applied by libpcap.
• Decodes TLS, DNS, QUIC, TCP and other protocols into a field tree. Selecting a field highlights its bytes in the hex view.
• Shows throughput, queue pressure and storage while the capture is running.
• Every action is available from a command palette and keyboard shortcuts.

• Keeping the interface responsive while the native worker pushes hundreds of thousands of packets per second. The worker owns capture and parsing, the Node backend only moves bounded batches, and memory stays capped when traffic outpaces the queue.
• Shipping one React interface to two runtimes. The desktop build talks to the backend over IPC, the browser over HTTP and WebSocket, and a shared RPC contract hides the difference.
• Linux permissions. Only the capture worker receives raw socket capabilities, never the desktop or server process.
• Accessible design in a dense interface. Packet inspection needs compact rows and small type, so keyboard use and legibility matter more, not less. Every action is reachable from the keyboard, every control shows a visible focus, changing values are announced through a status message, and the charts stop animating when the system asks for reduced motion.