Vehere PCAP Datasheet

Full Packet Capture (PCAP) Datasheet

Table of content

Capture Every Packet. Reconstruct Every Attack. Eliminate Blind Spots at Petabyte Scale.

Alerts show the signal, but packets reveal the story. As modern attacks move across encrypted, east-west, and hybrid traffic, security teams need complete network evidence.

Vehere Full Packet Capture (PCAP) continuously captures, indexes, and preserves packet-level data at terabit speeds and petabyte scale, enabling teams to quickly search, reconstruct, investigate, and hunt across historical traffic. With full session visibility and Encrypted Traffic Intelligence (ETI), Vehere helps SOC teams understand what happened, how it happened, and what followed, all without decrypting payloads.

Full Packet Capture Features

Line-Rate Full Packet Capture

Continuous, lossless packet acquisition across high-throughput networks for complete network visibility.

L2–L7 Deep Packet Inspection (DPI)

Decode and inspect network traffic across protocols including DNS, TLS, SMB, HTTP/2, SSH, and VoIP.

Encrypted Traffic Intelligence (ETI)

Analyze encrypted traffic using TLS fingerprints, JA3/JA3S, certificate telemetry, and behavioral analysis without decrypting payloads.

On-demand Dynamic File Analysis

Extract files and objects directly from captured network traffic for deeper investigation.

180-Day Retrospective Threat Hunting

Search historical packet captures and flow telemetry to investigate previously unseen or emerging threats.

Patented Indexed RAW PCAP Storage

Enable ultra-fast packet indexing, search, and retrieval across large-scale network traffic.

Integrated IDS Engine

Perform real-time threat detection using signature-based inspection of network traffic.

Full Session Reconstruction & Traffic Replay

Reconstruct complete communication sessions and correlate East-West and North-South traffic flows to understand attacker activity.

IOC-driven Threat Hunting

Investigate threats using IP addresses, domains, hashes, JA3/JA3S fingerprints, and other network indicators of compromise.

Technical Specifications

Capture

Storage and Retention

Protocol and Metadata Intelligence

Real-Time Indexing and Search

Investigation and Threat Hunting

Encrypted Traffic Intelligence

Deployment and Scalability

Security, Integration and Operations

Full, Continuous Packet Capture vs. Event-based Packet Capture

Capability	Full Continuous PCAP	Event-based PCAP
Complete Network Visibility	Captures all packets continuously	Only captures packets after an alert triggers
Pre-attack Forensics	Full visibility before, during, and after attacks	No visibility before alert occurs
Unknown Threat Investigation	Enables investigation of unknown or zero-day threats	Limited to known signatures/alerts
Attack Timeline Reconstruction	Full attack chain reconstruction	Partial timeline due to missing packets
Retroactive Threat Hunting	Retroactive analysis of historical network traffic	Cannot go back to investigate past traffic
Alert Validation	Packet-level evidence for validation	Difficult to validate false positives
Insider Threat Detection	Detects slow, stealthy, insider attacks	May miss low-noise or stealthy activity
Compliance & Legal Evidence	Forensically sound packet records	Incomplete packet evidence
Protocol-level Deep Analysis	Full protocol decoding and payload inspection	Limited visibility
SOC Investigation Efficiency	Single source of truth with packet evidence	Requires multiple tools and assumptions

Why Choose Vehere PCAP

Continuous Packet Capture at Enterprise Scale
Capture network traffic continuously at line rate across terabyte-speed environments with a platform engineered to scale to petabytes, ensuring complete visibility for investigation and forensic analysis.
Deep Packet Inspection (DPI) & Protocol Intelligence
Gain Layer 2-Layer 7 visibility with advanced decoding across DNS, TLS, SMB, HTTP/2, SSH, and VoIP for comprehensive network analysis.
Accelerated Incident Investigation
Investigate incidents faster with historical lookback, session reconstruction, IOC hunting, and MITRE ATT&CK mapping.
Forensic Evidence for Audit & Compliance
Preserve complete packet-level evidence to support compliance, audits, digital forensics, and incident investigations while validating security events and reconstructing attack timelines.

Ultra-fast Packet Search & Retrieval
Patent-pending Indexed RAW packet storage enables ultra-fast packet indexing, search, and retrieval across massive volumes of captured network traffic.
Encrypted Traffic Intelligence
Analyze encrypted communications using TLS fingerprints, certificate telemetry, and behavioral analytics without decrypting network traffic.
SOC-Ready Battle-Tested Architecture
Support enterprise-scale operations with scalable storage, real-time indexing, and a seamless pivot from threat detection to forensic investigation.

Frequently Asked Questions

What is Full Packet Capture (PCAP)?

Full Packet Capture (PCAP) is the continuous recording of network packets, preserving complete network communications for investigation, threat hunting, forensic analysis, and compliance.

How is Full Packet Capture different from event-based packet capture?

Event-based packet capture records traffic only after predefined events or alerts occur. Full Packet Capture continuously records network traffic, enabling investigators to reconstruct events, validate alerts, and perform retrospective analysis using historical packet data.

Why Continuous Packet Capture Matters?

Not all packet capture solutions provide the same level of visibility. While event-based packet capture records traffic only after predefined events or alerts are triggered, continuous packet capture preserves a complete record of network activity. This enables security teams to reconstruct attack timelines, validate alerts, investigate historical incidents, and perform retrospective threat hunting with greater confidence.

What types of network traffic can Vehere inspect?

Vehere supports deep packet inspection across Layer 2 to Layer 7 and provides protocol decoding for protocols such as HTTP(S), DNS, FTP, SMB, VoIP, Email, and others, as specified in the datasheet.

Does Vehere support encrypted traffic analysis?

Yes. Vehere includes Encrypted Traffic Intelligence (ETI), which analyzes encrypted traffic using metadata such as JA3/JA3S fingerprints, SNI, TLS versions, cipher suites, certificate information, and behavioral indicators without relying on payload decryption.

Can Vehere perform historical threat hunting?

Yes. Vehere supports retrospective investigation by enabling searches across previously captured network traffic and using indicators of compromise (IOCs) to identify historical malicious activity.

What deployment options are supported?

Vehere supports deployment in physical, virtual (VM), and cloud environments, with centralized management and distributed probes for enterprise-scale deployments.

What security platforms can Vehere integrate with?

Vehere integrates with SIEM platforms, SOAR platforms, ticketing systems, REST APIs, and STIX/TAXII-compatible threat intelligence services, as detailed in the Integrations section of the datasheet.

Defense and Law Enforcement

Enterprise Security

Network Detection and Response

National Security

Enterprise Security

Next-Generation Firewall

A fully on-prem, intelligence fabric that underpins all Vehere solutions

Defense and Law Enforcement

Enterprise
Security

Investors

Full Packet Capture (PCAP) Datasheet

Capture Every Packet. Reconstruct Every Attack. Eliminate Blind Spots at Petabyte Scale.

Full Packet Capture Features

Technical Specifications

Full, Continuous Packet Capture vs. Event-based Packet Capture

Why Choose Vehere PCAP

Frequently Asked Questions

Defense and Law Enforcement

Enterprise Security

Defense and Law Enforcement

Enterprise Security