drop pcap with mqtt · parse connect publish subscribe · clientId topics qos hints · flag wildcards credentials bursts · csv+json export · runs locally
ports 1883/8883/8884 heuristic · cleartext mqtt only · tls mqtt shows tcp flows without decrypt
partial pcap decode · heuristic only · parses artifacts locally · not definitive proof