Re-analyzing recordings

Every once in a while, Rayhunter refines its heuristics to detect more kinds of suspicious behavior, and to reduce noise from incorrect alerts.

This means that your old green recordings may actually contain data that is now deemed suspicious, and also old red recordings may become green.

You can re-analyze any old recording inside of Rayhunter by clicking on "N warnings" to expand details, then clicking the "re-analyze" button.

Analyzing recordings on Desktop

If you have a PCAP or QMDL file but no rayhunter, you can analyze it on desktop using the rayhunter-check CLI tool. That tool contains the same heuristics as Rayhunter and will also work on traffic data captured with other tools, such as QCSuper.

Since 0.6.1, rayhunter-check is included in the release zipfile.

You can build rayhunter-check from source with the following command: cargo build --bin rayhunter-check

Usage

rayhunter-check [OPTIONS] --path <PATH>

Options:
  -p, --path <PATH>   A file or directory of packet captures
  -P, --pcapify       Convert qmdl files to pcap after analysis
      --show-skipped  Show why some packets were skipped during analysis
  -j, --json <JSON>   Output report to a JSON file
  -q, --quiet         Only print warnings/errors to stdout
  -d, --debug         Show debug messages
  -h, --help          Print help
  -V, --version       Print version

Examples

rayhunter-check -p ~/Downloads/myfile.qmdl

rayhunter-check -p ~/Downloads/myfile.pcap

rayhunter-check -p ~/Downloads #Check all files in downloads

rayhunter-check -d -p ~/Downloads/myfile.qmdl #run in debug mode