The packets left a trace.
Do the math on it.
A single-file, zero-dependency workbench for network forensic analysts. Build BPF filters without syntax errors, score beacons from Zeek conn.log with real interval statistics, rank domains for DGA using entropy and English bigram plausibility, and forge commands for tcpdump, tshark, Zeek, nfdump and Arkime. Runs entirely in the browser — drop it on an isolated analysis workstation with no internet and it still works.
Describe the evidence you want in plain language. Athar assembles the command. Curated templates work offline; the AI path (Section 06 key) handles anything not in the library.
Berkeley Packet Filter syntax is unforgiving and a wrong filter silently drops the evidence you needed. Compose it here, read the plain-English translation, then paste into tcpdump, Wireshark, or Arkime.
http.request.method == "GET") is a different language and is non-destructive. When in doubt at acquisition time, capture broadly and filter later.C2 callbacks are periodic. Human browsing is not. Paste Zeek conn.log (TSV or JSON) or any CSV with timestamp/source/destination columns — Athar groups by connection pair and scores periodicity from interval dispersion, payload-size consistency, and connection count.
Domain generation algorithms produce names no marketing team would ever ship. Paste a domain list (one per line, or a Zeek dns.log query column) and Athar scores each on Shannon entropy, English bigram plausibility, consonant clustering, digit ratio, length, and TLD risk.
th, er, on score high; xq, vk, zp score near zero. Real domains built from dictionary words cluster high. Randomly generated labels collapse. Expect false positives on CDN hashes, Azure/AWS resource names, and DoH resolvers — always corroborate with registration age, NXDOMAIN rate, and resolved infrastructure.Fast lookup for the artifacts you touch most. Filter across every table at once instead of searching a PDF mid-investigation.
Paste an artifact — a Zeek log line, a suspicious HTTP header block, a TLS client hello summary, a NetFlow record, a base64 blob — and get an analyst-grade read. Bring your own Anthropic API key. Nothing is stored; the key lives in page memory only.