Packet

Live network capture and pcap decode, in your Zelos workspace.

• 📡 Capture any NIC — Linux and macOS, several interfaces at once
• 🔍 Every packet as a row — addresses, ports, protocol, flags, and the raw bytes
• 🧭 Drag into a packet panel — Wireshark-style list, filter as you type
• 📈 Plot the capture itself — packet and byte rates, kernel drops
• 📁 Open a pcap — decode .pcap/.pcapng, plain or gzip/zstd compressed, with no privileges and no NIC
• 🚗 Automotive Ethernet — SOME/IP, SOME/IP-SD and DoIP, with SOME/IP payloads decoded by ARXML
• ⏱️ One timeline — packets line up with your CAN and sensor data

Capturing reads raw frames, which needs one grant per machine. Decoding a file does not.

uv run zelos-extension-packet check        # when denied, prints the exact command for this machine
sudo /path/to/python -m zelos_packet install-helper

• 🔐 Linux installs a small privileged helper (cap_net_raw only) and a zelos-packet group; macOS installs a boot-time daemon that puts /dev/bpf* in the access_bpf group
• 🛡️ Linux group members can capture on the machine, nothing more — the helper drops every capability before it reads a byte and streams decoded packets, so it never hands out a socket anyone could send with
• ⚠️ macOS access_bpf members can also send arbitrary frames: a bpf device is opened read-write and capture needs the write side
• 🔁 Log out and back in, then restart the agent — a session's groups are fixed at login
• ✅ python -m zelos_packet status says whether capture would work right now
• 🪟 Windows has no live capture this release — use replay_pcap

zelos extensions install packet
zelos extensions start packet --config '{"interfaces": [{"interface": "en0"}]}'

If the rights above are missing, the extension stops on start and logs the exact command to fix it.

Decoding a file needs no privileges and no NIC:

zelos extensions start packet --config '{"replay_pcap": "capture.pcapng"}'

Captures appear in the tree under Packet → your interface → packets. Drag that node into the workspace for a packet panel; drag stats for a plot.

On Linux without CAP_NET_RAW the capture runs in the privileged helper process and streams to the agent directly, so rows reach the tree the same way — Packet/check_permissions reports which backend a Start would use.

On by default, on every capture, replay and conversion:

With advanced.arxml, SOME/IP payloads decode into the SOMEIP source and SoAd PDUs into the PDU source:

• SOMEIP/<Service>/<Event|Method|Field>, one column per value, compu methods and units applied
• one event per method and per field, requests and responses as rows; every row carries message_type, session_id, client_id, return_code, instance_id (from SD); fields add method_id
• nested members join with _ (pos_x); fixed arrays up to 16 flatten to name_<i>; longer and dynamic arrays are one bytes column plus name_count
• SoAd PDUs: PDU/<PDU> by short-name (PDU/DemoPdu), contained and dynamic PDUs as PDU/<PDU>/<PDU>; columns header_id, src_ip, src_port, dst_ip, dst_port, then one per signal; an E2E-protected PDU adds e2e_status (ok, wrong_crc, wrong_sequence, repeated, not_checked), a secured one secoc; two SoAd PDUs with one short-name fail the load
• reads SOME/IP service interface deployments, R4.2 and R19-11 onward
• load the ECU extract for the ECUs on the tapped link, not a whole-vehicle file
• with advanced.arxml or advanced.someip.ports and no advanced.snaplen, 1518 bytes are captured per packet, so SOME/IP payloads arrive whole

uv run zelos-extension-packet interfaces               # list NICs
uv run zelos-extension-packet check                    # probe permissions
uv run zelos-extension-packet capture en0 en1          # capture, no app config
uv run zelos-extension-packet replay capture.pcap      # stream a file to the agent, paced, stamped from now
uv run zelos-extension-packet convert capture.pcap.gz  # write capture.trz, no agent needed (.gz/.zst read directly)
uv run zelos-extension-packet convert tap.pcapng --arxml ecu.arxml  # with SOME/IP payloads

capture, replay and convert take --arxml (repeatable), --someip-port (repeatable), --no-someip-sd and --no-doip.

• Documentation
• Issues

Apache-2.0. See LICENSE.