TRACE: Building an Offline-First PCAP Investigation Workbench for DFIR

An open-source project focused on practical network forensics, evidence-driven investigation, and local analysis.

Introduction

Network traffic often contains valuable evidence during a security incident. A packet capture can help investigators understand communication patterns, examine protocol activity, identify suspicious connections, and reconstruct parts of an event.

However, effective PCAP investigation involves more than opening a capture in a packet viewer. Analysts need a practical way to explore traffic, investigate anomalies, identify potential attack patterns, and correlate findings with other evidence.

That is the motivation behind TRACE — PCAP Investigation Workbench, a community project designed to support network-focused digital forensics and incident response (DFIR).

Project repository: https://github.com/unnamed-helper/TRACE-PCAP-Forensics

Why TRACE?

During incident response, analysts may need to examine network captures in restricted environments where transferring sensitive evidence to an external service is undesirable or prohibited.

TRACE takes a local-first approach, aiming to make PCAP investigation accessible while keeping sensitive evidence under the analyst’s control.

The project focuses on three principles:

• Local analysis: Support investigations in environments where evidence should remain on the analyst’s system.
• Practical visibility: Make network activity and suspicious patterns easier to investigate.
• Evidence-driven findings: Present potential indicators as investigation leads that analysts can validate, rather than treating every alert as proof of an attack.

Key capabilities

1. PCAP and PCAPNG investigation

TRACE is designed to help analysts explore supported packet captures and inspect network activity during an investigation.

This can support workflows involving suspicious connections, protocol activity, and the identification of traffic that warrants closer examination.

2. Network traffic analysis

Understanding who communicated with whom, which protocols were involved, and how traffic behaved can help establish context around a suspected incident.

TRACE provides network-focused investigation views intended to make these patterns easier to explore.

3. DDoS investigation support

Distributed denial-of-service investigations require careful examination of traffic volume, protocol distribution, source concentration, destination services, and packet patterns.

TRACE includes heuristic detection approaches intended to highlight potential flooding and other suspicious traffic patterns.

These findings are leads, not definitive attribution. Legitimate traffic spikes, incomplete captures, asymmetric routing, and capture-point limitations can all affect the interpretation of network evidence.

4. Suricata integration

Suricata can provide an additional layer of network threat detection through its rules and alerting capabilities.

TRACE supports an optional Suricata-assisted workflow, allowing analysts to use signature-based findings alongside their investigation of the packet capture.

Suricata is a separate component and must be installed and configured independently where required. Its results depend on the applicable rules, configuration, and supported integration workflow.

Get Arslan Sabir’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Official documentation: https://docs.suricata.io/

5. Investigation-focused workflow

The goal is to help analysts move from a suspicious observation toward a structured investigation:

1. Load a supported packet capture.
2. Explore traffic and protocol information.
3. Identify suspicious patterns or relevant alerts.
4. Examine the supporting packet and flow evidence.
5. Correlate findings with other telemetry.
6. Document conclusions and distinguish confirmed facts from hypotheses.

Designed with local-first investigation in mind

Sensitive network evidence can contain internal IP addresses, hostnames, application details, authentication metadata, and other confidential information.

TRACE is designed around local analysis rather than requiring investigators to upload packet captures to a hosted analysis service.

As with any forensic tool, users should validate the actual execution environment, external network behavior, and any optional backend or integrations before processing sensitive evidence. Local-first design should be verified through testing rather than assumed from the interface alone.

Getting started

The repository contains the application and supporting documentation for setup and investigation workflows.

GitHub repository: https://github.com/unnamed-helper/TRACE-PCAP-Forensics

A suggested starting path is:

1. Review the repository README and system requirements.
2. Follow the documented steps to launch TRACE in the supported mode.
3. Begin with an authorized, non-sensitive sample capture.
4. Review the supported features and known limitations.
5. If you need Suricata-assisted analysis, follow the separate installation and configuration guide.
6. Validate findings against packet-level evidence and other available telemetry.

For operational details, use the repository’s current documentation as the authoritative source for the version you download.

Current limitations and responsible use

TRACE is an evolving community project. Its analysis capabilities depend on the supported protocols, available packet data, configuration, and any external detection components.

Heuristic findings may produce false positives or miss activity. A PCAP alone may not contain enough evidence to establish intent, attribution, or the full scope of an incident. Some traffic analysis capabilities also have limitations when dealing with fragmented packets, incomplete captures, encrypted traffic, or TCP stream reconstruction.

For these reasons, TRACE should be used as an investigation aid, not as a replacement for validated forensic procedures, established detection platforms, or analyst judgement.

Test the application in your intended environment before relying on it in operational investigations.

Closing thoughts

The aim of TRACE is not to replace every established network analysis platform. It is to provide another practical, local-first option for analysts who want to investigate packet captures and develop evidence-backed findings.

The project will improve through testing, careful review, and feedback from the community.

Explore TRACE on GitHub:
https://github.com/unnamed-helper/TRACE-PCAP-Forensics

TRACE is an evolving open-source project. Validate its capabilities and limitations before using it in production investigations.