...
Multiple alert conditions can be set by the user. Traffic is monitored in semi-real-time to trigger alerts.
When an alert condition is satisfied, the matching portion of traffic is extracted as a pcap PCAP file, and detailed analysis can be performed quickly.