Incident evidence reduction

Large capture trimmed to the failure window

A sample handoff for reducing a large PCAP to the packets that explain the failure while preserving timing and packet context.

HTML preview

Evidence handoff preview

Failure boundary The full capture is too large and noisy for review; the failure is isolated to a specific packet window and endpoint pair.

Raw evidence excerpt Time range selected; endpoint filters applied; unrelated packets excluded; subset export preserves the failure sequence.

Layer	Finding	Implication
Filter scope	The failure window is isolated by time and endpoint filters.	Reviewers do not need the full capture to understand the case.
Subset export	The export keeps packet order and timing inside the selected window.	The reduced PCAP remains useful for debugging and replay-oriented analysis.
Handoff	The smaller file is easier to attach, review, and archive.	Support can move a case forward without exposing unrelated traffic.

Preserve a private copy of the original capture before trimming.
Document the time window and filters used for the exported handoff.
Record the export scope and transformations alongside the subset PCAP; the current release does not generate a transformation manifest automatically.