Packet structure
Protocol framing, lengths, checksums, sequence behavior, and clean decoding in standard packet-analysis tools.
Realism and validation
Realism requires more than packets that decode correctly.
NetMetria traffic is checked for plausibility in normal packet-analysis workflows. A clean decode is necessary, but it is not sufficient.
What we check
Validation covers individual packets, conversations, endpoints, and the capture as a whole.
Checks cover structural correctness, conversation behavior, protocol consistency, endpoint characteristics, timing, identifiers, and artifacts that can reveal a synthetic generator.
Conversation coherence
TCP/session behavior, request-response relationships, service interactions, and consistency across related flows.
Protocol behavior
DNS, SMB, HTTP, TLS, and other represented protocol behavior are reviewed for internal consistency and plausible use.
Endpoint characteristics
Addressing, identifiers, transport characteristics, and host-facing network traits are checked for contradictions and obvious generator patterns.
Timing and scenario structure
Timing, event ordering, and conversation structure are examined across the scenario rather than only at individual packet level.
Synthetic fingerprints
Known compiler and generator artifacts are tested so recognizable synthetic patterns can be found and corrected.
Validation status
Automated validation is in place. Independent expert review of the final public PCAPs is still pending.
The current captures have passed automated structural and realism checks, including tests for known synthetic fingerprints and previously identified defects. They have not yet completed independent expert review. NetMetria therefore does not claim that the traffic is indistinguishable from live production traffic.
Inspect the public PCAPs
The public captures are available for independent inspection.
Detection engineers and packet analysts can inspect all three captures directly in Wireshark, tshark, tcpdump, or their own analysis stack.