Kestrel Sight

Kestrel Sight brings professional packet capture analysis to iPhone and iPad. Every byte is processed on-device — Kestrel makes no network connections, and collects no analytics.

WHAT'S NEW

CSV Export — Three profiles: Summary (Excel-ready, 9 columns), Detailed (every protocol layer, ~24 columns), Flow (one row per conversation). Export everything or just bookmarked packets, with bookmark notes preserved as columns. Filenames indicate scope at a glance.

Smart Bookmarks — Bookmarking a flow, host, DNS query, or stream now resolves to all related packets in CSV exports. Tap "View" on any bookmark to jump straight to that data with the right filter applied.

Expanded Protocol Detection — Added classification for SMB, mDNS, DHCP, NTP, SNMP, SSDP, and QUIC.

Dashboard Navigation — Every dashboard widget is now interactive. Tap Total Packets to open Packets, tap a Top Talker to filter Hosts to that IP, tap "TCP" in Protocol Distribution to filter the Packets list, and so on. Subtle chevrons indicate what's tappable.

Haptic Feedback — Bike-spoke clicker feedback when scrolling lists. Crisp tap feedback on buttons.

Adjustable row density. New filter-bar toggle cycles between Classic, Compact, and Comfortable layouts in the Packets browser. Compact fits ~22 rows per phone screen; Comfortable mirrors iOS Mail's two-line look. On iPad, Classic uses a denser style single-line row.

App Switcher privacy. Sight now hides the analysis surface behind the Kestrel logo whenever the app leaves the foreground, so the iOS App Switcher thumbnail and AirPlay mirroring.

Faster first-tap haptic response and internal robustness improvements.

CORE FEATURES

Dashboard — Protocol distribution, encryption stats, top talkers, session summary

Packets — Browse and filter with detailed per-layer inspection

Raw Data Search — Query any byte sequence in its original form

Flows — Bidirectional reconstruction with byte counts, packet counts, timing

Hosts — Per-IP profile with traffic stats, port activity, connection mapping

DNS — Extract and search all DNS queries and responses

Streams — TCP stream reassembly with full-content viewer (auto-runs under 1 GB)

Timeline — Visual event timeline with filtering

Audit Log — SHA-256 file hashing and session audit log included in PDF exports

CAPACITY

Up to 1 GB — Full feature set with automatic TCP reassembly

Over 1 GB — TCP reassembly disabled; packets, flows, hosts, DNS, and timeline remain fully functional

Over 2 GB — Application performance may degrade

SUPPORTED FORMATS

PCAP, PCAPNG

IDEAL FOR

SOC analysts reviewing captures away from the workstation
Network administrators troubleshooting connectivity
Incident responders triaging captures in the field
Penetration testers reviewing engagement data
Educators and students learning protocol behavior

PRIVACY AND SECURITY

Zero network access — no outbound connections
No analytics, tracking, or advertising

Kestrel is designed as an analytical and educational starting point. Always verify findings independently before acting on them. No software can guarantee absolute security; follow your organization's evidence-handling procedures when working with sensitive captures.

IMPORTANT NOTES

Kestrel analyzes pre-captured PCAP files only — live capture is not permitted within iOS by the platform itself. Screenshots may combine demo and real data. Large captures may extend load times. Devices with 8 GB RAM or more are recommended for multi-gigabyte files. The demo uses fabricated sample packets.