Operational notes for capture scope, licensing, export, rewrite, and release notes.
PCAP Surgery is a visual capture-transformation workbench, not a replacement for either tool. It connects evidence scoping, per-rule impact preview, supported checksum-aware rewrites, and classic PCAP export without requiring a fragile command pipeline. It does not yet strip arbitrary payloads or provide Wireshark-level protocol analysis.
Community is free for local viewing, filtering, and transformation previews. Professional is a one-time purchase that unlocks writing edited and subset PCAP artifacts; there is no subscription.
Yes. The download page publishes Linux and Windows packages with sizes and SHA-256 checksums.
Yes. The desktop license flow uses the checkout email plus license key. The app guides activation.
Tier-3 support engineers, network product QA teams, and lab engineers who need to turn a noisy capture into a focused support case or deterministic regression fixture.
Wireshark remains the broad analysis reference. PCAP Surgery starts after that analysis: choose the evidence scope, preview supported transformations, review limitations, and export a focused classic PCAP artifact.
editcap is enough when the transformation is known, scripted, and low risk. Use PCAP Surgery when an operator needs visual evidence context, a packet-impact preview, supported checksum-aware rewrites, and an artifact preflight before export.
No. Header masking does not remove identifiers from payloads, DNS names, HTTP fields, TLS SNI, credentials, IPv6, or unknown protocols. The current release surfaces this limitation and should not be used as a complete sanitization guarantee.
It inventories visible IPv4, IPv6, MAC, DNS, HTTP Host, TLS SNI, and printable payload or unknown exposure in the selected full or subset artifact. It is deliberately partial: there is no decryption or stream reassembly, and the result is not a safe-to-share verdict.
Checksum warnings can be offload artifacts or real evidence problems. PCAP Surgery reports repairs on supported IPv4/TCP/UDP header rewrite paths. Fixed-length raw byte edits still require separate checksum validation.
