fragcap

fragcap v0.2.0 is the first functional release. A passive, process-attributed network capture tool for Windows: it reconstructs which process produced each packet, an association that capture below the socket layer has already discarded, and writes it into an extended pcapng that unmodified analyzers still read as ordinary pcapng.
Attribution survives indirect launches. Flows are attributed to the owning process even when a game client is started through a platform or publisher launcher, joining captured traffic against the operating system socket table by 5-tuple (with a retention window for closing connections) and against Event Tracing for Windows process ancestry.
Capture is live or replayed, and never loses silently. Live capture runs over npcap (detected, never bundled or installed); offline replay reads classic pcap. Every discarded packet is counted and named, per interface.
Profiles are validated before they run, reporting every diagnostic at once, and stage matching binds capture to the right process among several sharing an image name.
Two output formats, both readable by unmodified tooling: pcapng carrying attribution in packet comments, and JSON Lines.
Steam integration and managed launch discover installed titles, scaffold a validating profile, and start a title under capture through Steam's protocol handler, without ever opening a process handle.
Also included: Wireshark extcap integration, ring mode with triggers, transports and streaming sinks, shell wrappers for both shells, and a documentation site.
The security posture is absolute. fragcap observes: it never modifies, injects, or replays traffic, and never opens a process handle carrying memory-read rights against a target.

Highlights