labs.llc TAP The network tap
Light — the edition you are reading
Read a capture

The network tap · sixty seconds of the wire

Who is talking,
how much, what kind.

Run the capture for a minute and read the wire: the ten hosts moving the most traffic, ranked by volume, split into sent and received, each one named and classified by the kind of traffic it is carrying. It answers the first question anybody asks when a network feels wrong — who is doing all this, and what is it?

A browser cannot capture packets. Seeing every host on the wire needs libpcap and the privileges no page’s JavaScript can reach; a page only ever sees its own connections. So TAP is two halves along the line the operating system draws: a small native engine does the capture on a machine you control, and this dashboard reads what it wrote. It will not pretend to sniff, and it ships with no demo data — a number here is one that was measured, or it is not here at all.

Read a capture Get the engine

real pcap · sixty seconds · headers and byte counts only, never payloads · the file is read in your browser and never uploaded

The shape

Two halves, along the line the OS draws.

Native · runs with sudo

tap-capture

Sniffs the chosen interface for sixty seconds. Aggregates in a single streaming pass — no payloads are kept. Writes capture.json.

The handoff

capture.json

A few kilobytes of totals: talkers, conversations, ports, a per-second timeline. Addresses and names only, never packet contents.

labs.llc/tap/ · browser

This dashboard

Drop the file — it is read locally and nothing is uploaded. Ranks the talkers, draws the mix and the timeline. Paper and dark.

The dashboard

Drop the capture.

Everything on this console is computed from real captured packets — headers and sizes only. Drag capture.json anywhere onto this page, or use the key. It is read with the File API in your own browser and is never sent anywhere.

Capture

no capture loaded

Drop a capture.json here

— or run sudo tap-capture and bring the file back.

The engine

One script, one streaming pass.

tap-capture ships in this property’s own tools/. It needs root, because raw sockets do. It takes a window, an interface and an optional BPF filter, prints a table to the terminal and writes capture.json beside itself. It keeps counters, never packets: memory is constant whether the window is one second or ten minutes.

Run it

tap/tools/tap-capture

$ sudo python3 tap-capture --seconds 60 --iface en0
$ sudo python3 tap-capture --list                 # what interfaces are here
$ sudo python3 tap-capture --iface en0 --filter "not port 22"
$ sudo python3 tap-capture --backend tcpdump      # no scapy on this host

Two backends, one aggregator. scapy is the recommended path and the one the estate’s other Python tools already assume. Where scapy is not wanted, tcpdump is piped into the same counters — the arithmetic is identical and so is the file it writes.

capture.json — the whole contract

A few kilobytes, and the only thing passing between the two halves. The dashboard needs nothing else, and the file holds no packet contents.

Honesty & limits

What a run can and cannot see.

Vantage point

On a switched network an ordinary host sees only its own traffic plus broadcast and multicast. To see the whole LAN’s top talkers you have to capture from somewhere that sees it: the gateway or router, a SPAN/mirror port, or the Wi-Fi access point.

TAP labels every run with the interface it watched and reports exactly what crossed it. It will not imply more. If you run it on a laptop plugged into a switch, the honest reading is “this laptop and the broadcast traffic around it” — and that is what the page will say.

Authorization & privacy

Capturing traffic is sensitive. Run TAP only on networks you are authorized to monitor.

capture.json holds addresses and resolved names, and those can identify devices and the people using them. It never holds packet contents — headers and byte counts only, by design and by construction, because the aggregator never stores a payload in the first place. On the drop-in path the file stays on your machine: this page reads it with the File API and uploads nothing.

About

Where it sits.

TAP joins the network shelf beside Network Labs, and complements Sensor, Grid and Hanta — but where those observe from inside a browser, TAP is the first property here with a real native half. The name is exact: a network tap is a box you insert to mirror the wire and watch what flows.

The dashboard is a house two-edition page with no framework: paper by default, dark one tap away, and both read the same file. Nothing on it is fetched, and nothing is remembered between visits except which edition you chose.

Read a capture Network Labs