Imagine you have a 50MB+ network capture (.pcap) from a critical infrastructure crash. You need to quickly find out why the network didn't converge. You could spin up Wireshark, or you could drop the file into a browser tab and get a full visual root-cause analysis in under 100ms.
That’s why I built Post-Mortem — an open-source suite of serverless web tools for network forensics.
The Problem with Traditional PCAP Parsing
- Desktop Overhead: Launching heavy desktop clients for quick triage is annoying.
- Security Risks: Uploading corporate network captures containing sensitive internal IPs and payloads to cloud-based parsers is a massive security compliance violation.
The Architecture: Rust + WASM to the Rescue
To achieve zero-server parsing with native-like performance, I paired Rust with WebAssembly.
- The Engine (Rust): Handles raw byte slicing of pcap/pcapng structures and executes state machines for complex networking protocols.
-
The Bridge (
wasm-pack): Compiles the Rust binary into a WebAssembly module (.wasm) with automated JavaScript glue-code. - The UI (Vanilla JS + CSS): A lightweight, ultra-fast dashboard that renders timelines, charts, and graphs instantly.
What it analyzes right now:
1. OSPF Post-Mortem (IP Protocol 89)
Tracks OSPF adjacency states. It automatically flags severe errors like Duplicate Router-IDs, MTU mismatches (which stall DBD exchanges), and Hello timer mismatches. It even simulates a force-directed layout to draw the live OSPF topology map using pure SVG.
2. DHCP Post-Mortem (UDP 67/68)
Deconstructs the classic DORA (Discover, Offer, Request, Acknowledge) sequence, mapping transaction IDs and tracking address allocation anomalies.
3. STP / RSTP / Rapid-PVST+ Post-Mortem
Analyzes Spanning Tree Protocol variants. It pinpoints exactly which bridge became the Root Bridge, captures Topology Change Notifications (TCNs), and tracks down loops and blocked ports.
The Power of Local-First Web Tools
Because the app relies entirely on WASM running in the browser thread, it is:
- 100% Private: Your packets never leave your computer.
- Insanely Fast: Parses thousands of packets in milliseconds.
-
Portable: You can download the single
index.htmlfile along with thepkgdirectory, and run it completely offline in the middle of a data center with no internet access.
Next Steps & Open Source
The project is entirely open-source. I’m currently looking for feedback from fellow systems/network engineers and web developers.
Check out the repos here: https://github.com/stars/casablanque-code/lists/network-forensics
What protocol do you think I should tackle next? BGP, QUIC, or maybe a deep-dive TLS handshake analyzer?
I would like to get your feedback and test results.
