Source / Destination Subnet Capture
Use subnet conditions to capture traffic from a specific source subnet, destination subnet, or cross-subnet communication. This is suitable for segmented networks, server zones, database zones, or client subnets.
Packet Capture
Nexus Packet Sniffer
A packet capture platform for Windows 10 / 11 and Windows Server x64 environments. It provides a graphical configuration interface, flexible filtering conditions, pcap output, and real-time traffic monitoring to help organizations retain packet evidence and understand network activity.
Overview
Product Positioning and Core Value
Nexus Packet Sniffer is a packet capture tool for Windows 10 / 11 and Windows Server x64. Through a GUI, users can configure interface, source IP, destination IP, any-side port, source port, destination port, protocol, duration, maximum file size, and output folder. The native C++ capture core exports standard .pcap files.
The product focuses on ready-to-use deployment and easy operation. It is planned to support a full offline installer and a portable edition, without requiring separate installation of Npcap, WinPcap, Wireshark, or .NET Runtime for packet capture and retention in Windows x64 environments.
Windows x64
Non-intrusive packet capture
classic .pcap / LINKTYPE_ETHERNET
GUI + C++ capture core
Key Features
- Capture traffic from all network interfaces or a specified ifIndex interface.
- Combine source IP, destination IP, source subnet, destination subnet, local destination IP, any-side port, source port, destination port, and TCP/UDP filters.
- Use subnet conditions to precisely retain traffic from specific source, destination, or cross-subnet flows.
- Optionally exclude IPv4 limited broadcast packets such as 255.255.255.255 to reduce DHCP Discover background noise.
- Capture local-only traffic for communication between applications and local services on the same host.
- Recording duration and maximum file size work as OR stop conditions; capture stops when either condition is reached.
- Export classic .pcap files using LINKTYPE_ETHERNET so Wireshark can display the Ethernet header.
- Display captured traffic speed and total interface traffic speed to separate recorded traffic from overall NIC activity.
- Release capture resources and clean temporary services after capture finishes.
Packet Capture
Advanced Packet Filtering
Nexus Packet Sniffer uses clear conditions to control capture scope for IT operations, security investigation, and database traffic observation, reducing unnecessary packets and improving analysis efficiency.
IPv4 Broadcast Filtering
Optionally exclude IPv4 limited broadcast packets with destination 255.255.255.255, such as DHCP Discover, to reduce pcap background traffic. Directed broadcasts such as 192.168.1.255 are not automatically detected.
Local-only Capture Mode
Capture only traffic between local applications and local services on the same host, which is useful for troubleshooting local database clients, agents, local APIs, or service communication without external traffic noise.
Interface
Interface and Operation Screens
The following screenshots show the latest Nexus Packet Sniffer interface, including capture conditions, live status, interface traffic display, and common settings.
Live Capture Status and Traffic Monitoring
The status panel displays capture state, elapsed time, packet count, pcap size, captured traffic rate, and total interface traffic rate.
- Designed for quick operation in Windows x64 environments.
- Reduces unnecessary traffic and keeps pcap files focused on the investigation target.
- Supports follow-up analysis with standard pcap workflows.
Interface Selection and Source Interface Display
Capture can run on all interfaces or a specified ifIndex interface, with detected interface names, ifIndex values, and statuses shown in the UI.
- Designed for quick operation in Windows x64 environments.
- Reduces unnecessary traffic and keeps pcap files focused on the investigation target.
- Supports follow-up analysis with standard pcap workflows.
IP, Subnet, Port, and Protocol Conditions
Source and destination IP fields can be combined with any-side port, source port, destination port, and protocol filters to define a precise capture scope.
- Designed for quick operation in Windows x64 environments.
- Reduces unnecessary traffic and keeps pcap files focused on the investigation target.
- Supports follow-up analysis with standard pcap workflows.
Local-only Capture and IPv4 Broadcast Exclusion
Enable local-only capture to observe same-host application traffic, and optionally exclude IPv4 broadcast packets to reduce background noise.
- Designed for quick operation in Windows x64 environments.
- Reduces unnecessary traffic and keeps pcap files focused on the investigation target.
- Supports follow-up analysis with standard pcap workflows.
Maximum File Size Control
Maximum file size can be set to common values such as 10 MB, 50 MB, 100 MB, 500 MB, 1 GB, 2 GB, or a custom MB value.
- Designed for quick operation in Windows x64 environments.
- Reduces unnecessary traffic and keeps pcap files focused on the investigation target.
- Supports follow-up analysis with standard pcap workflows.
Recording Duration Setting
Recording duration provides common options such as 1, 3, 5, 10, 15, 20, and 30 minutes for short troubleshooting sessions.
- Designed for quick operation in Windows x64 environments.
- Reduces unnecessary traffic and keeps pcap files focused on the investigation target.
- Supports follow-up analysis with standard pcap workflows.
Running Status and Source Interface Speed
During capture, the UI shows packet count, pcap size, elapsed time, interface speed, and detected source interfaces.
- Designed for quick operation in Windows x64 environments.
- Reduces unnecessary traffic and keeps pcap files focused on the investigation target.
- Supports follow-up analysis with standard pcap workflows.
Support Notes
Known Limitations and Capture Scope
These notes describe the current packet capture scope. Please confirm whether the product matches your use case before purchase.
IP-layer Packets Only
The product mainly captures IPv4 / IPv6 packets. When “All IP” is selected, IP-layer traffic such as TCP, UDP, ICMP, and ICMPv6 can be included.
ARP / RARP / STP Not Supported
ARP, RARP, and STP are non-IP layer-2 Ethernet packets and are outside the current capture scope, so they are not written to pcap files.
IPv4 Limited Broadcast Can Be Captured
The product can capture IPv4 limited broadcast packets with destination 255.255.255.255, such as DHCP Discover.
Broadcast Exclusion Scope
When IPv4 broadcast exclusion is enabled, only 255.255.255.255 is excluded. Directed broadcasts such as 192.168.1.255 are not automatically detected.
Ethernet Header Uses Synthetic Information
pcap files use LINKTYPE_ETHERNET so Wireshark can display an Ethernet header. MAC addresses are synthetic values, not real NIC MAC addresses.
IPv6 Filter Limitation
IPv6 filtering currently focuses on exact address matching and does not support IPv6 subnet shorthand.
Deployment
Contact Us →
Recommended Use Cases
Nexus Packet Sniffer is suitable for security incident investigation, network and application troubleshooting, database connection observation, packet evidence retention, and compliance evidence preservation. With source / destination subnet, port, protocol, local-only traffic, and IPv4 limited broadcast filtering options, teams can control capture scope more precisely in Windows x64 environments, reduce unnecessary packet noise, and improve follow-up analysis efficiency.