CapLoader 2.2 Released
CapLoader 2.2 adds new alerts for services and infrastructure that may be abused, makes flow transcripts easier to navigate and improves alert-based coloring. It also includes more helpful BPF filter feedback and several bug fixes.
More alerts
CapLoader’s alerting has been expanded with built-in detections for online services and infrastructure that are commonly abused, along with support for external blocklists from IFIN, GAYINT and Spamhaus.
New alert types include:
- IPFS services and gateways
- Port forwarding services
- Abused web hosting and cloud storage services
- VPN, proxy and tunnel protocols
- Blockchain RPC nodes
- Paste bin domains
- Bulletproof, scanner and VPN ASNs
Many of these alerts are informational, while others are low severity.
Transcript navigation and row coloring
You can now move between flow transcripts using the arrow keys. To make moving to the next transcript quicker, CapLoader anticipates the next Flow Index and pre-fetches its frames.
Thanks to André for suggesting the transcript navigation feature during one of my trainings!
Video: Transcript of flows in Johannes Weber’s Ultimate PCAP
CapLoader 2.2 also adds the AlertSeverity row color scheme. It colors each flow, service and host according to the highest-severity alert associated with it.
Here’s CapLoader with the traditional Wireshark style color scheme:
This is what the same traffic looks like with the new AlertSeverity color scheme:
Both screenshots show the same capture file, which contains traffic from an XMRig sample on Triage.
BPF filter boxes now provide better error checking, with colors and tooltips to warn about possible syntax mistakes. You can also press Enter to open the transcript for a selected flow from any tab, not just the Flows tab. If you select multiple flows, Enter opens multiple transcripts.
Bug fixes
This release fixes an issue that could prevent the “About CapLoader” window from opening, as well as a crash that could occur when reading very large frames. It also fixes JA4 fingerprints when TLS Signature Algorithms contain GREASE values.
Posted by Erik Hjelmvik on Monday, 19 October 2026 08:48:00 (UTC/GMT)
Tags: #CapLoader #transcript
