PCAP Host Import,
Without Sending a Packet
Import a Wireshark or tcpdump capture and Neuron extracts the internal hosts, MAC addresses, hostnames, and services it saw. PCAP import for passive recon, no scanning.
Import Once. Report From One Place.
Some networks cannot be scanned on day one. An OT segment, a fragile clinical network, a client who wants passive results before approving active testing. A packet capture still tells you who is there, and Neuron turns it into the engagement's host inventory.
Import a .pcap, .pcapng, or .cap file and Neuron reads it on your own server. Hosts, MAC addresses, names learned from DNS, DHCP, and NetBIOS, and the TCP and UDP services seen on the wire land on the engagement, ready for the testing that follows.
Capture with tcpdump on site or save a Wireshark session, then import it from the browser or with neuron import. The CLI recognises pcap and pcapng from the file header, so there is no source to name.
$ sudo tcpdump -i eth0 -w acme-day1.pcap 482113 packets captured $ neuron import --tag passive acme-day1.pcap✓ PCAP: 143 hosts, 61 ports imported- 11:31 Finding LLMNR and NBT-NS enabled
- 11:24 Command neuron export hosts passive.txt
- 11:19 Import PCAP: 143 hosts, 61 ports
- 09:02 Command tcpdump -i eth0 -w acme-day1.pcap
Why PCAP Reporting Takes So Long
Wireshark is superb at showing one conversation in depth. Turning a whole capture into a host list is a different job: exporting endpoint statistics to CSV, filtering out broadcast and multicast, and matching DNS names to addresses by hand.
Passive discovery is also the work clients see least. The hosts found by listening on a span port, the names leaked over NBNS and DHCP, the SNMP traffic on a flat network: none of it counts as evidence unless it is on the engagement.
And a capture taken on day one is usually forgotten by day three, sitting in a home directory on a box that will be wiped.
Everything PCAP Produces, On the Engagement
Import PCAP output from the browser or with neuron import, and it lands the moment the import finishes.
Internal Hosts
Every address the capture saw, limited to RFC 1918 ranges by default, with loopback, multicast, and broadcast traffic left out.
MAC Addresses
The Ethernet source address of each host, recorded on new hosts and filled in on existing hosts that had none.
Hostnames From the Wire
Names from DNS answers, DHCP hostname options, and NetBIOS name service traffic, kept as each host's alternate hostnames.
Observed Services
TCP ports seen in handshakes, plus common UDP services such as DNS, DHCP, TFTP, NTP, SNMP, syslog, and RADIUS, recorded as open ports.
Noise Filtering
A minimum packet count, five by default, keeps a host that sent one stray packet from becoming an asset. Link-local addresses are included only when you ask.
Exposure Analysis
Captured hosts get the same exposure analysis as any scan, flagging suspicious internal services and likely high-value targets in Scan Issues.
How to Import PCAP Results
- 01
Capture the traffic
Record on the segment you are authorised to observe with tcpdump, tshark, or Wireshark. Any .pcap, .pcapng, or .cap file works.
$ sudo tcpdump -i eth0 -w acme-day1.pcap - 02
Keep the raw capture as evidence
Copy the capture off the box into the engagement File Share before the box is wiped. The host list is derived from it, and the original stays available if anyone asks to see the traffic.
$ neuron --ssh jumpbox copy /tmp/acme-day1.pcap neuron:Captures/ - 03
Choose what to keep
In the browser, keep private addresses only or include public ones, decide on link-local, switch hostname and service extraction on or off, and set the minimum packet count. Tags and an assessment can be set too.
- 04
Import the capture
Upload it, or pass it to neuron import. The capture is parsed on your own server, and the job appears in Import Jobs with a full rollback if it was not what you wanted.
$ neuron import --tag passive acme-day1.pcap
Your Infrastructure. Your Data.
Neuron is self-hosted. Import PCAP results from the browser or the CLI and they land on your own server, inside your network. Scan data never passes through a third-party cloud.
From PCAPto the Final Report
Passive results make a strong opening section. The report can show what an attacker plugged into a meeting room port learned without sending a packet: the hosts, their names, and the services they were already talking to.
Names broadcast over NBNS and DHCP, and services such as SNMP or TFTP seen on the wire, become findings with the affected hosts attached. When active testing is approved, Nmap and NetExec results merge into the same host records.
Because the capture is an import job like any other, it is attributed, timestamped, and kept with the engagement long after the laptop or jumpbox it was taken on has been rebuilt.
PCAP Integration FAQ
The questions teams ask most about PCAP and Neuron.
How do I import a PCAP file into a pentest report?
Upload the capture on the engagement's Import page under PCAP Files, or run neuron import with the file. Neuron extracts the hosts, MAC addresses, hostnames, and services in the PCAP and adds them to the engagement, where they back findings like any scanned host.
Which capture formats can Neuron import?
Classic pcap, including nanosecond-resolution captures, pcapng, and .cap files. Wireshark, tshark, and tcpdump all write one of these, and the Neuron CLI recognises a PCAP from its file header.
What does Neuron extract from a Wireshark capture?
IP addresses, Ethernet MAC addresses, hostnames from DNS answers, DHCP hostname options, and NetBIOS name service traffic, plus the TCP and UDP ports that behaved like listening services. Payloads and credentials in a Wireshark capture are not extracted.
Will a PCAP import add public IP addresses?
Not by default. The PCAP import keeps RFC 1918 private addresses only and skips loopback, multicast, and broadcast, so a capture full of internet traffic still produces a clean internal inventory. Turn off the private-only option in the browser import to keep public addresses.
How does Neuron keep a busy capture from creating junk hosts?
Hosts seen in fewer packets than the minimum you set, five by default, are dropped. Link-local addresses are excluded unless you include them, and hostname and service extraction can each be switched off for a PCAP import.
Is the capture uploaded to a third-party service?
No. Neuron is self-hosted, and the PCAP is parsed on your own server. Packet data from the client network never leaves your infrastructure.
More Neuron Integrations
Nmap Reporting: Nmap XML to Pentest Report
Network DiscoveryMasscan Reporting and Masscan XML Import
Network DiscoveryBloodHound Reporting and Attack Path Import
Active DirectoryNessus Reporting and .nessus File Import
Vulnerability ScannersQualys Report Import for Pentest Reporting
Vulnerability ScannersOpenVAS Reporting and Greenbone Report Import
Vulnerability ScannersNexpose and InsightVM Report Import
Vulnerability ScannersOpenAPI and Swagger Import for API Pentests
Web TestingReady to Transform Your Security Practice?
See how Neuron helps security teams replace fragmented tools with a single platform for offensive security, bringing structure, visibility, and consistency to every engagement.
Platform