KestrelLITE
Support
We're here to help you get the most out of Kestrel.
Contact Us
Have questions, feedback, or need assistance? We'd love to hear from you.
Frequently Asked Questions
What file formats does Kestrel support?
Kestrel supports PCAP (.pcap) files. This is the standard format exported from tools like Wireshark, tcpdump, and other packet capture utilities.
How do I open a PCAP file in Kestrel?
Tap "Open Capture File" on the start screen and navigate to your PCAP file. You can transfer files to your device via AirDrop, iCloud Drive, Files app, email attachments, or any cloud storage service.
Is my data secure?
Kestrel runs entirely offline with zero network connections. Your PCAP files are analyzed locally on your device and are never uploaded anywhere. We did not add any trackers, analytics services, or crash reporting tools to Kestrel. While we have designed Kestrel with security in mind and process all data locally on your device, no software application can guarantee absolute security. See our Privacy Policy for details.
What are the limits of Kestrel LITE?
Kestrel LITE supports up to 50,000 packets per capture file. The Sensitive Data Scanner, File Carving, and Media Extraction features are available in Kestrel PRO. You can preview these PRO features using the built-in Demo mode.
Why does my capture show fewer packets than expected?
Kestrel LITE processes up to 50,000 packets. If your capture file contains more packets, only the first 50,000 will be analyzed. Kestrel Sight supports unlimited packet analysis.
Why is analysis slow on large files?
Larger PCAP files require more processing time and memory. Analysis speed depends on your device capabilities. For best performance on very large captures, ensure your device has sufficient available memory.
Can Kestrel capture live network traffic?
No. Kestrel analyzes existing PCAP files only. Due to iOS and iPadOS security restrictions, live packet capture is not possible. You'll need to capture traffic on another device or using dedicated hardware, then transfer the PCAP file to Kestrel for analysis.
Why don't I see any files or media extracted?
File carving and media extraction only work on unencrypted traffic. If your capture consists primarily of HTTPS/TLS encrypted connections, the payload data cannot be decoded and no files can be extracted. SSL/TLS certificate import for decrypting captured traffic is on our feature roadmap but not yet available. These features are also only available in Kestrel PRO.
How do I return to the start screen?
Tap the Kestrel logo in the top-left corner of the screen. This will close the current capture and return you to the start screen, freeing up memory.
LITE Version Features
Included in Kestrel Lite
- Up to 50,000 packets per capture
- Dashboard with traffic overview and statistics
- Packet browser with filtering and hex/ASCII view
- Flow reconstruction with bidirectional statistics BETA
- Host profiling with traffic analysis
- DNS query extraction and search
- Anomaly detection (credentials, port scans, auth protocols)
- TCP stream reassembly
- Timeline visualization
- Chain of custody BETA
- Sensitive Data Scanner PRO
- File Carving PRO
- Media Extraction PRO
App Information
Version
1.0
Requires
iOS 18.0 or later
Compatibility
iPhone and iPad
Supported Formats
PCAP, PCAPNG
Ideal For
Security Professionals
Network Admins
Incident Responders
Pen Testers