v0.10.2

Game traffic, attributed to the process responsible for it.

Packet captures preserve network frames, not process ownership. fragcap correlates captured flows with Windows socket and process-lifecycle observations, including clients started through platform and publisher launchers. Resolved flows carry their observed attribution and fidelity; unresolved traffic remains visible rather than being discarded.

Capture passively records packets and process attribution. Deep Capture runs that same capture alongside an explicit, target-scoped local proxy for compatible targets, adding correlated application records and optional proxy-owned TLS key logs when the proxy can inspect the traffic.

Live packet capture requires the Npcap driver in WinPcap-compatible mode; fragcap never bundles, hosts, embeds, or redistributes it. Wireshark is recommended for live or post-session analysis, but any pcapng-aware analyzer can read Capture output. Run fragcap doctor for Capture and Deep Capture readiness.

fragcap targets

$ fragcap targets
Ready to capture:
  #  TARGET            CAPTURE  ENGINE         SENSITIVITIES
  1  sample_adventure  ready    Sample Engine  not scanned

Needs setup:
  #  TARGET        CAPTURE         ENGINE       SENSITIVITIES
  2  sample_arena  needs a target  not scanned  Sample Protection

Next command:  fragcap capture 1

fragcap groups discovered titles by capture readiness and ends by naming the first ready action; the row number is what fragcap capture honors.

flowchart TD
  fragcap["fragcap: Capture and Deep Capture"]
  npcap["npcap: capture driver (required)"]
  ws["Wireshark: analyzer (recommended)"]
  extcap["Wireshark extcap: optional"]
  fragcap -->|captures through| npcap
  fragcap -->|writes captures opened in| ws
  ws -->|installer bundles| npcap
  extcap -->|ships with| ws
  fragcap -.->|registered by fragcap extcap install| extcap

The dependency model: npcap is required, Wireshark recommended (its installer also provides npcap), and the extcap integration optional.

Resolved flows carry process attribution and fidelity in packet comments; unresolved flows remain in the capture. An unmodified analyzer still reads the file as ordinary pcapng. Output formats
fragcap discovers the installed titles on your machine and registers them as capture targets, so a client started indirectly through Steam or another launcher is matched without hunting for it. Getting started
Capture observes passively. Deep Capture runs only when explicitly selected and uses a session-scoped local proxy; neither mode injects code or reads target-process memory. Security posture