Kestrel Sight

Kestrel Sight brings professional packet capture analysis to iPhone and iPad. Every byte is processed on-device — Kestrel makes no network connections, and collects no analytics. WHAT'S NEW CSV Export — Three profiles: Summary (Excel-ready, 9 columns), Detailed (every protocol layer, ~24 columns), Flow (one row per conversation). Export everything or just bookmarked packets, with bookmark notes preserved as columns. Filenames indicate scope at a glance. Smart Bookmarks — Bookmarking a flow, host, DNS query, or stream now resolves to all related packets in CSV exports. Tap "View" on any bookmark to jump straight to that data with the right filter applied. Expanded Protocol Detection — Added classification for SMB, mDNS, DHCP, NTP, SNMP, SSDP, and QUIC. Dashboard Navigation — Every dashboard widget is now interactive. Tap Total Packets to open Packets, tap a Top Talker to filter Hosts to that IP, tap "TCP" in Protocol Distribution to filter the Packets list, and so on. Subtle chevrons indicate what's tappable. Haptic Feedback — Bike-spoke clicker feedback when scrolling lists. Crisp tap feedback on buttons. Adjustable row density. New filter-bar toggle cycles between Classic, Compact, and Comfortable layouts in the Packets browser. Compact fits ~22 rows per phone screen; Comfortable mirrors iOS Mail's two-line look. On iPad, Classic uses a denser style single-line row. App Switcher privacy. Sight now hides the analysis surface behind the Kestrel logo whenever the app leaves the foreground, so the iOS App Switcher thumbnail and AirPlay mirroring. Faster first-tap haptic response and internal robustness improvements. CORE FEATURES Dashboard — Protocol distribution, encryption stats, top talkers, session summary Packets — Browse and filter with detailed per-layer inspection Raw Data Search — Query any byte sequence in its original form Flows — Bidirectional reconstruction with byte counts, packet counts, timing Hosts — Per-IP profile with traffic stats, port activity, connection mapping DNS — Extract and search all DNS queries and responses Streams — TCP stream reassembly with full-content viewer (auto-runs under 1 GB) Timeline — Visual event timeline with filtering Audit Log — SHA-256 file hashing and session audit log included in PDF exports CAPACITY Up to 1 GB — Full feature set with automatic TCP reassembly Over 1 GB — TCP reassembly disabled; packets, flows, hosts, DNS, and timeline remain fully functional Over 2 GB — Application performance may degrade SUPPORTED FORMATS PCAP, PCAPNG IDEAL FOR SOC analysts reviewing captures away from the workstation Network administrators troubleshooting connectivity Incident responders triaging captures in the field Penetration testers reviewing engagement data Educators and students learning protocol behavior PRIVACY AND SECURITY Zero network access — no outbound connections No analytics, tracking, or advertising Kestrel is designed as an analytical and educational starting point. Always verify findings independently before acting on them. No software can guarantee absolute security; follow your organization's evidence-handling procedures when working with sensitive captures. IMPORTANT NOTES Kestrel analyzes pre-captured PCAP files only — live capture is not permitted within iOS by the platform itself. Screenshots may combine demo and real data. Large captures may extend load times. Devices with 8 GB RAM or more are recommended for multi-gigabyte files. The demo uses fabricated sample packets.