Packets and Developer mode

Live packets, per program

Open Packets in the app. Every packet appears as it happens with the time, direction, kind (secure web, name lookup, HTTP, QUIC, TCP, UDP), the program that sent or received it, the other side's name, the size and what happened in plain words: "Looks up github.com", "Opens a secure connection to api.game.com", "GET /login". Server names are read straight from name lookups, the TLS server name and plain HTTP, so you see api.game.com instead of a bare address even behind a content network.

• Filter with one click: secure web, name lookups, TCP, UDP, a program, a port. Or type in the filter box: steam, host:game.com, port:443, out, -dns.
• Record what happens: press Record, do something in a game or app, press Stop, and read a summary of every server it contacted.
• Save for Wireshark: one click exports what you see as a capture file.

How it stays light: capture only runs while the page is open and stops 20 seconds after you leave it. The page keeps the newest 20 000 packets, and only the first 128 bytes of each, in memory. On Windows, Defendingo uses the capture built into Windows itself, plus the kernel's network events to name every packet's program; no Npcap or other driver is installed. On Linux it uses the kernel's packet socket. Both use the installed guard's rights, so there is nothing extra to approve.

Developer mode

Off by default, so the page stays simple for everyone else. The Developer mode button at the top of the Packets page turns it on, and the window remembers the choice. The rules stay the same: capture only while the page is open, the same in-memory buffer, and whole packets kept only while you record, on disk. Dissection happens on demand, when you click, filter or export a packet, never for every packet as it arrives.

The detail pane

Click a packet for its layers, one tree per protocol, next to a hex and ASCII dump. Clicking a line in the tree highlights its bytes in the dump; clicking a field name adds that field to the display filter. The tree shows the frame, Ethernet or VLAN, then IPv4 with options and fragments or IPv6 with extension headers, TCP with flags, options, sequence and acknowledgement numbers and window, or UDP, and then the application protocol inside.

Supported protocols

Link and network

Ethernet, VLAN, Linux cooked capture, ARP, IPv4 (options, fragments), IPv6 (hop-by-hop, routing, fragment and destination option headers), ICMP, ICMPv6 (neighbour discovery, router advertisements).

Transport

TCP (flags, options such as MSS, window scale, SACK, timestamps, TCP Fast Open) and UDP.

Names and addresses

DNS, mDNS and LLMNR with every record type (A, AAAA, CNAME, MX, NS, PTR, SOA, SRV, TXT, CAA, SVCB and HTTPS, OPT), DHCP and DHCPv6, NTP.

Web

HTTP/1.x requests and responses with headers, HTTP/2 frame headers, WebSocket frames, TLS record layer with the full ClientHello and ServerHello including ALPN, server name and JA3 and JA4 fingerprints, QUIC including the decrypted client Initial.

Services

SSH, SMB2 over NBSS, RDP (TPKT and COTP), MQTT, Redis, PostgreSQL, MySQL.

Every dissector reads defensively: a cut-short or malformed packet is shown as far as it goes and can never upset the guard.

Display filter language

In Developer mode the filter box takes Wireshark-style expressions, and the guard evaluates them so the list stays fast on the whole buffer. The capture filter uses the same language and decides what is kept at all.

ip.addr == 10.0.0.5 and tcp.port == 443
dns.qry.name contains github
tls.handshake.extensions_server_name matches "*.google.com"
http.request.method == POST
app == chrome.exe
frame.len > 1000
!(udp or arp)
tcp.port in {80 443 8443}
tcp.flags.syn and not tcp.flags.ack
ip.src == 192.168.1.0/24 and dir == out

Comparisons

== != < > <= >=, also written eq ne lt gt le ge. != means "no value of this field equals", so ip.addr != 10.0.0.5 keeps only packets with neither side at that address.

Text

contains for a substring; matches (or ~) for a pattern with the wildcards * and ?.

Sets

field in {a b c} matches any of the values.

Logic

and or &&, or or ||, not or !, and parentheses. Two terms side by side mean "and", like a search box.

Presence

A protocol or field alone tests that it exists: dns, tcp.options.mss_val. A flag alone means it is set: tcp.flags.syn.

Values

Numbers (decimal or 0x1f), quoted or bare strings, IP addresses and ranges such as 10.0.0.0/8, true and false.

Defendingo's own fields

app (program name), pid, dir (out or in), host (the name Defendingo learned for the other side), kind (HTTPS, DNS, QUIC ...), info (the plain-words description) and sni.

Shorthands

ip.addr covers source and destination, tcp.port and udp.port both ports, eth.addr both MAC addresses, dns.name stands for dns.qry.name, tls.sni for the TLS server name, tcp.flags.rst and tcp.flags.psh for reset and push.

Plain words

The simple filters of normal mode keep working: steam, host:game.com, port:443, app:chrome, ip:10.0.0.5, pid:6548, out, in, https, and -dns to exclude. A bare word that isn't a field searches the program, name, address and description.

Field names follow Wireshark's where the two overlap: frame.len, eth.src, ip.ttl, ipv6.dst, tcp.dstport, tcp.flags.syn, tcp.window_size_value, udp.length, dns.qry.name, dns.resp.ttl, dhcp.option.hostname, http.host, http.request.uri, http.response.code, http.user_agent, http2.streamid, tls.handshake.type, tls.handshake.extensions_alpn_str, tls.handshake.ja4, quic.version, ssh.kex_algorithms, smb2.cmd, mqtt.topic, redis.command, pgsql.query, mysql.query. Click any line in the detail pane to see its field name, and click the name to filter on it.

Recording to .pcapng, with program names

Record to file streams whole packets to a .pcapng file in Defendingo's data folder (%LOCALAPPDATA%\Defendingo\packets\recordings\ on Windows; the guard's data folder on Linux). Recording stops by itself at the size limit, 1 GB by default, so it can never fill your disk. Every packet carries a comment with the program name and process id, so Wireshark shows which app sent it too. When TLS keys are known, they are embedded as Decryption Secrets Blocks, so Wireshark decrypts the recording without any extra setup.

• Open in Wireshark opens the recording from the Defendingo window.
• Save .pcapng exports what is in memory right now, with the current filter applied.

Analysis

Conversations

Every TCP and UDP conversation with its programs, packets and bytes, as the starting point for Follow stream.

Endpoints

Every remote address with its name, packets, bytes and the programs that talked to it.

Programs

Packets, bytes and connections per program: the view no interface-level capture tool can give you.

Protocol hierarchy

Packets and bytes per protocol, nested: Ethernet, IP, TCP, TLS, HTTP/2 and so on.

IO graph

Packets and bytes over time, to spot bursts and quiet spells.

Expert info

Retransmissions, duplicate ACKs, zero windows, lost segments, resets, TLS alerts, HTTP errors, DNS errors and ICMP errors, each linked to its packet and stream.

Follow stream

Follow stream reassembles one TCP or UDP conversation in order, both directions in different colours, as text or hex. Pick a conversation from the list or from a packet. For a secure connection, Decrypt TLS shows the plain contents when the keys are known (see below), including the HTTP/2 frames inside an h2 connection.

Opening a capture file

Open a capture file loads a .pcap or .pcapng file (Ethernet, raw IP, Linux cooked or loopback frames) for read-only analysis with the same detail pane, filters, analysis and follow stream. The newest 50 000 packets of the file are kept. Files recorded by Defendingo bring their program names and TLS keys back with them.

Decrypting a program's TLS traffic

Encrypted connections stay encrypted unless the program itself hands over its session keys. Browsers, curl and most development SDKs do exactly that when the standard SSLKEYLOGFILE environment variable points to a file. Defendingo gives you two ways in:

1. Run with TLS keys. Pick a program (Chrome, Firefox, curl, your own app) and Defendingo starts it with SSLKEYLOGFILE set for that program only. Nothing changes system-wide, no other program's traffic is affected, and the setting disappears when the program closes. This is the one-click way to see what your own app or a browser tab really sends.
2. Point Defendingo to a key log file you already have, for example one a test suite writes.

With keys loaded, Decrypt TLS in Follow stream shows the plain text of TLS 1.3 connections (including key updates) and TLS 1.2 connections with AES-GCM or ChaCha20-Poly1305 suites, which is what modern servers negotiate. Recordings carry the keys as Decryption Secrets Blocks, so Wireshark decrypts them too. Defendingo never reads another program's memory or changes its settings: the keys come from the program, voluntarily, through the standard mechanism.

Working with Wireshark

Defendingo and Wireshark are a pair. Record in Defendingo to get every packet named by its program, open the file in Wireshark for its thousands of protocol dissectors, and see the program name in each packet's comment there. Open a Wireshark capture in Defendingo to use follow stream, the filters and the analysis views in a lighter window. The Defendingo vs Wireshark page compares the two in detail.

The same from the command line

defendingo packets does everything above from a terminal (administrator or sudo). Every flag is in the command line reference.

defendingo packets --seconds 10                                       # every packet, in plain words, named by its program
defendingo packets --seconds 30 --filter "tcp.port == 443" --write session.pcapng
defendingo packets --read session.pcapng --stats                      # conversations, endpoints, programs, protocol hierarchy
defendingo packets --read session.pcapng --follow first               # one conversation's contents
defendingo packets --read session.pcapng --follow tcp:10.0.0.2:50000:1.2.3.4:443
defendingo packets --seconds 5 --filter "dns" --json                  # one JSON object per packet

An AI assistant can take a short capture too, through the capture_packets tool of the MCP server.

Still read-only

Developer mode copies packets; it never blocks, changes or injects anything, and never touches another program's settings. The guard with a file open and a capture running stays around 23 MB of memory, so you can leave it on all day.