Cascade

Cascade is a free, open-source network protocol analyzer — a lightweight alternative to Wireshark — built with Qt 6 and C++17. Capture live traffic, dissect protocols, color-code packets, classify applications, and inspect every byte.

---

Features

• Live capture via Npcap with real-time packet display
• Protocol dissection: Ethernet, IPv4, TCP, UDP, HTTP, DNS
• Color-coded packet list — each protocol gets its own row color for instant visual scanning
• Traffic classification — shows application / service name (HTTP, DNS, SSH, RDP, OpenVPN, WireGuard, etc.)
• Three-pane GUI: packet list, protocol tree, hex dump
• Display filter — text search across all protocol fields (F7 to focus)
• Virtual adapter detection — virtual interfaces shown in grey with (virtual) label
• Open / save pcapng capture files
• Full in-app guide (F1) with keyboard shortcuts, color legend, and usage tips
• Admin elevation — double-click prompts for Administrator rights via UAC manifest
• Thread-safe capture engine — UI stays responsive during capture

---

Color Coding

Color	Matches
Yellow	HTTP traffic
Pink	DNS queries / responses
Red	TCP SYN packets
Green	UDP traffic
Blue	TCP traffic
Orange	Broadcast frames
Light grey	IPv4 packets

Color rules are defined in ColoringRules and sorted by priority. More specific rules (HTTP, DNS) override generic ones (TCP, IPv4).

---

Quick Start

Prerequisites

Tool	Version	Install
Visual Studio 2022	17.x+	visualstudio.microsoft.com — workload "Desktop development with C++"
CMake	3.20+	winget install Kitware.CMake
Qt	6.8.3	pip install aqtinstall && python -m aqt install-qt windows desktop 6.8.3 win64_msvc2022_64 --outputdir C:\Qt
Npcap	1.13+	npcap.com — install with "Install in WinPcap API‑compatible Mode"

Build

# Open "Developer Command Prompt for VS 2022"
cd C:\path\to\cascade
cmake -S . -B build -DCMAKE_PREFIX_PATH="C:\Qt\6.8.3\msvc2022_64"
cmake --build build --config Debug

CMake automatically downloads the Npcap SDK on first configure. Qt DLLs are deployed by windeployqt as a post-build step.

Run

.\build\Debug\Cascade.exe

Double-click the .exe — it will prompt for Administrator elevation automatically.

---

Usage Guide

Capture Live Traffic

1. Select a network interface from the toolbar dropdown (virtual adapters are marked in grey).
2. Click Start — packets appear in real time with color-coded rows.
3. Click Stop to end capture.
4. Click Clear to reset.

Note: Run as Administrator. Without elevation, Npcap cannot access raw packets on most interfaces.

Open a Capture File

• File > Open (Ctrl+O) — load a pcapng file.
• File > Save As (Ctrl+Shift+S) — export current packets to pcapng.

Filter Packets

Type a search term in the filter bar above the packet list and press Enter (F7 to focus). The filter searches all protocol names, field names, and values case‑insensitively.

Filter	Finds packets where
http	HTTP protocol or the string "http" in any field
10.0	Any address / value containing "10.0"
dns	DNS queries or responses
syn	TCP packets with SYN flag set

Click the X button to clear the filter.

Understand the Three-Pane Layout

Pane	What it shows
Packet List (top)	8 columns: No., Time, Source, Destination, Protocol, Length, Service, Info. Click a row to inspect.
Protocol Tree (bottom-left)	Hierarchical dissection of the selected packet — expand/collapse any protocol node.
Hex Dump (bottom-right)	Raw bytes with offset, hex, and ASCII columns.

Service Column

The Service column identifies the application-layer protocol or VPN tunnel:

Service	Detected by port
HTTP	TCP 80
HTTPS	TCP 443
DNS	UDP 53
SSH	TCP 22
RDP	TCP 3389
OpenVPN	UDP 1194
WireGuard	UDP 51820
PPTP	TCP 1723
L2TP	UDP 1701
IPsec	UDP 500, 4500

VPN detection highlights tunneled traffic for quick identification.

In-App Help

Press F1 at any time to open the built-in guide — it covers all features, color legend, keyboard shortcuts, and troubleshooting.

Keyboard Shortcuts

Key	Action
Ctrl+O	Open capture file
Ctrl+Shift+S	Save capture file
Ctrl+Q	Quit
F1	Open help guide
F7	Focus filter bar
Enter	Apply filter

---

Project Structure

cascade/
├── CMakeLists.txt
├── CMakePresets.json          (optional)
├── LICENSE.txt
├── vcpkg.json
├── .gitignore
├── resources/
│   ├── app.manifest           # UAC admin manifest
│   ├── app.rc                 # Windows resource script
│   ├── app.ico                # Application icon
│   └── logo.svg               # Logo source
├── src/
│   ├── main.cpp
│   ├── core/
│   │   ├── packet.h/.cpp               # Packet data structures
│   │   ├── protocol.h                  # Dissector base class
│   │   ├── dissector_manager.h/.cpp     # Dissector registry
│   │   ├── packet_capture.h/.cpp        # Npcap capture thread
│   │   ├── packet_list.h/.cpp           # Thread-safe packet store
│   │   ├── filter_engine.h/.cpp         # Display filter engine
│   │   ├── coloring_rules.h/.cpp        # Protocol color rules
│   │   └── traffic_classifier.h/.cpp    # Service / VPN detection
│   ├── dissectors/
│   │   ├── ethernet.h/.cpp
│   │   ├── ipv4.h/.cpp
│   │   ├── tcp.h/.cpp
│   │   ├── udp.h/.cpp
│   │   ├── http.h/.cpp
│   │   └── dns.h/.cpp
│   ├── ui/
│   │   ├── main_window.h/.cpp
│   │   ├── packet_list_widget.h/.cpp
│   │   ├── packet_detail_widget.h/.cpp
│   │   ├── packet_bytes_widget.h/.cpp
│   │   ├── filter_bar.h/.cpp
│   │   └── help_dialog.h/.cpp
│   └── io/
│       ├── pcapng_reader.h/.cpp
│       └── pcapng_writer.h/.cpp

---

Dissector Architecture

Packets flow through a chain of protocol dissectors:

Raw Frame
  +-- Ethernet (MAC addresses, EtherType)
       +-- IPv4 (addresses, TTL, protocol)
            +-- TCP (ports, sequence numbers, flags: SYN/ACK/FIN/RST/PSH)
            |    +-- HTTP (method, URI, headers, body)
            +-- UDP (ports, length)
                 +-- DNS (transaction ID, queries, answers)

Each dissector extracts protocol-specific fields and appends a ProtocolNode to the tree. The tree is then used by the UI, filter engine, and coloring rules.

---

Adding a New Dissector

1. Create src/dissectors/myproto.h and src/dissectors/myproto.cpp.
2. Inherit from Protocol and implement:
   • QString name() const override;
   • void dissect(Packet*, const quint8*, quint32, ProtocolNode*, quint32) override;
3. Register in dissector_manager.cpp:
   • #include "dissectors/myproto.h"
   • Add to the appropriate map (EtherType, IP protocol, TCP/UDP port).
4. Add source files to CMakeLists.txt.

---

Troubleshooting

Problem	Solution
"Npcap SDK not found"	CMake downloads it automatically. Check internet or place SDK in _npcap-sdk/.
"Qt6 not found"	Set -DCMAKE_PREFIX_PATH=C:/Qt/6.8.3/msvc2022_64
"Missing Qt6*d.dll"	windeployqt runs automatically. Run manually: windeployqt build\Debug\Cascade.exe
"Access denied" on capture	Run as Administrator (the .exe prompts for elevation automatically).
No interfaces found	Install Npcap from npcap.com.

---

License

This project is licensed under the MIT License. See LICENSE.txt.

---

Planned

• BPF capture filter (tcp port 80)
• Advanced display filter syntax (ip.src == 1.2.3.4)
• IPv6, ARP, ICMP, TLS dissectors
• Follow TCP stream
• Statistics and conversations
• pcap file format support
• Export to CSV / JSON

---

Cascade — a personal project. Built with Qt 6 and C++17. Powered by Npcap.