Academic desktop application · Networking
WireCat
A beginner-friendly JavaFX packet-analysis toolkit for learning how live network traffic is captured, filtered, inspected, summarized, and exported.
Data flow
From network interface to analyst evidence
Implementation snapshot
Capture
Pcap4J promiscuous mode
UI pipeline
100 ms batched updates
Evidence
PCAP + CSV export
Enrichment
Optional Gemini analysis
Learning objective
WireCat makes the packet-analysis pipeline visible to a beginner: select an interface, capture frames, parse protocols, narrow the dataset, inspect bytes, and export evidence. The aim is understanding, not replacing mature tools such as Wireshark.
Capture and concurrency
Pcap4J opens the selected interface in promiscuous mode with a full 65,536-byte snapshot length and optional BPF filtering. A daemon capture thread sends parsed packets through a transfer queue; the JavaFX layer drains that queue in 100 ms batches so packet arrival does not block or flood the UI thread.
Analyst workflow
The desktop interface brings the core investigation loop into one workspace.
- Combine protocol, IP, port, and free-text filters without restarting capture
- Inspect Ethernet, IP, and transport fields alongside raw packet evidence
- Group traffic into conversations using endpoint tuples and MAC addresses
- Review protocol distribution, packets per second, vendor hints, and reconstructed TCP streams
- Preserve captured evidence as PCAP or export the visible dataset to CSV
Optional AI enrichment
A separate three-worker service can send selected packet context to Gemini and attach an asynchronous explanation to the result. It is deliberately optional: capture and inspection remain useful without an API key, and external analysis requires an explicit privacy decision because packet metadata may leave the workstation.
Engineering value and limits
The project demonstrates Java desktop development, producer-consumer concurrency, native capture constraints, composable filtering, and evidence export. It remains an educational analyzer—not a replacement for Wireshark—and its AI output is contextual assistance rather than authoritative detection.