PacketCache logo


PacketCache is a free Windows service designed to continuously monitor the network interfaces of a computer and store the captured packets in memory (RAM). The idea is to make full-content packets available for post-event incident response and network forensic analysis. PacketCache can be used either as a complement to solutions for centralized network packet capturing, or without any other network monitoring solution in place.

Download PacketCache

3 good reasons to run PacketCache

How PacketCache works

By default PacketCache reserves 1% of a computer's total physical memory for storing packets. A computer with 4 GB of RAM will thereby allow up to 40 MB of packets to be kept in memory. This might not seem like much, but PacketCache relies on a clever technique that allows it to store only the most important packets. With this technique just 40 MB of storage can be enough to store several days worth of “important” packets.

The “clever technique” we refer to is actually a simple way of removing packets from TCP and UDP sessions as they get older. This way recent communication can be retained in full, while older data us truncated at the end (i.e. only the last packets are removed from a session).

Product name: PacketCache
Latest version:
Download URL:
SHA256: 76523F569D2B12FA3B68453387F9896C65AA0511AE7D82C50C31FF2341879DF7
SHA1: 00890E483F3058D487CF2B4DC40BE08440798538"
Signed by: Netresec AB


Follow these steps to install PacketCache:

PacketCache services in services.msc

Reading packets captured by PacketCache

The easiest way to read packets from PacketCache is by using CapLoader:

CapLoader's Read from PacketCache

Reading PacketCache with PowerShell

Alternatively, here's a simple PowerShell script that can be used to read packets from PacketCache:

$pipeStream = new-object System.IO.Pipes.NamedPipeClientStream '.','PacketCache','In';
$epoch = Get-Date -UFormat %s -Millisecond 0;
$file = [System.IO.File]::OpenWrite('PacketCache-' + $epoch + '.pcap');
Write-Host "Writing packets to $file.Name";
try {
    $buffer = new-object byte[] 4096;
    $n = $pipeStream.Read($buffer, 0, $buffer.Length);
    while ($n -gt 0) {
        $file.Write($buffer, 0, $n);
        $n = $pipeStream.Read($buffer, 0, $buffer.Length);
finally {

However, if you get a PowerShell error message saying something like this:

.\ReadPacketCache.ps1 : File C:\Users\user\Documents\ReadPacketCache.ps1 cannot be loaded because running scripts is disabled on this system. For more information, see about_Execution_Policies at
At line:1 char:1
+ .\ReadPacketCache.ps1
+ ~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : SecurityError: (:) [], PSSecurityException
+ FullyQualifiedErrorId : UnauthorizedAccess

Then you need to change the execution policy to RemoteSigned before running the PowerShell script.

Set-ExecutionPolicy RemoteSigned

Also, please note that PacketCache only provides data to users with local admin privileges, so you will have to run the PowerShell script as administrator in order to read the captured packets.

Reading a remote PacketCache with WinRM / PowerShell Remoting

Packets can also be read from a PacketCache running on a remote host by using PowerShell Remoting (WinRM). To do so we recommend using our ReadRemotePacketCache.ps1 script like this:

.\ReadRemotePacketCache.ps1 DESKTOP-LT4711 Administrator
[*] Dumping PacketCache at DESKTOP-LT4711
[*] Copying PCAP dump from DESKTOP-LT4711
[*] Remote PacketCache data saved to DESKTOP-LT4711_181112_1337.pcap

For more details on how to read from a remote PacketCache using PowerShell remoting, please see our blog post "Remote Packet Dumps from PacketCache".

Download ReadRemotePacketCache.ps1

Reading PacketCache with Wireshark

Wireshark reading from PacketCache

It is also possible to read packets from PacketCache directly from Wireshark (version 2.3 or later required). Please read our blog post "Reading cached packets with Wireshark" for an in-detail description, or follow these steps:

  1. Start Wireshark with admin rights (right-click > “Run as administrator”)
  2. Click: Capture > Options
  3. Click “Manage Interfaces...”
  4. Select the “Pipes” tab
  5. Click the “+” button to add a named pipe
  6. Name the pipe “\\.\pipe\PacketCache” and press ENTER to save it
  7. Click “OK” in the Manage Interface window.
  8. Click “Start” to read the packets from PacketCache


USB broadband modem - Copyright Prolineserver 2010 (cc-by-sa-3.0)


Frequently Asked Questions (FAQ)

Q: If packets are stored in RAM, will all historical traffic be lost when my computer is rebooted?
A: No, PacketCache is designed to dump the packets from RAM into an encrypted file upon reboot. This file will then be read back into RAM when the computer boots up again.

Q: Is it possible to allocate more than 1% of my memory for PacketCache?
A: Yes, when registering PacketCache.exe with sc, simply append a number as an argument to the PacketCache command. For example, in order to allow up to 5% of RAM to be used, register the PacketCache service like this:

sc create PacketCache binPath= "C:\Program Files\PacketCache\PacketCache.exe 5" start= auto

Q: Is PacketCache free? Can I use this software commercially?
A: Yes, and yes. PacketCache is released under a Creative Commons Attribution-NoDerivatives 4.0 International License, which means that you can copy and redistribute PacketCache in any medium or format for any purpose, even commercially.

Creative Commons License

Please feel free to contact us if you have any additional questions regarding PacketCache!