Animate Circle: Packets now travel along the Circle's lines, in the direction they really went, during Demo Mode, a replay or a PCAP-over-IP capture. Turn it on under Options → Circle → Animate Circle. It follows Reduce Motion. Search the Circle by port: Type "port 5005", "port 8000-8100" or "port 80,443" in the search field to highlight every conversation that uses that port. Network blocks such as 10.0.0.0/24 work too. Name a port after its service: Touch and hold a port in a conversation's Ports list and choose "Assign service to port…". Handy for services on non-standard ports. You can also manage these in Options → Port mappings.

Networks, slow-server detection and a roomier Circle. • NEW: Networks layout. The Circle can group hosts by network: private networks on the left, the internet on the right, each network a coloured arc whose colour is the worst conversation quality in it. Tap an arc to open the network, double-tap to fold it. Name your own networks under Options → Circle → Known networks. • NEW: Slow server or slow network? Expert findings now split a TCP conversation's wait into the handshake round trip and the server's think time, and tell you which one dominates. • NEW: type "expert" in the Circle search to list the worst findings of the capture first. • NEW: Appearance. Choose Dark, Light or follow the device (Options). • The protocol legend folds to one row when a capture has many protocols. The Circle keeps its room while you search, and the keyboard closes when you touch the Circle. • Fewer host labels on the Networks ring; the arcs carry the names. • Compare, Decode, the PDF report and the Circle layouts now run on the same Rust engine as the Mac, Linux and Windows apps. • Fixes and polish throughout.

PacketCircle now keeps the interface and the analysis engine apart. The core is rewritten in Rust, and analyzing a capture is about 13× faster. Expert is sharper too. A new scan detector names SYN, service, Christmas-tree, and other scans, including common Nmap patterns. Web sessions that close with a reset after the server has already sent data are no longer treated as errors, and a reset that only refuses a connection is a warning instead of a health-score hit.

• PDF reports — generate a summary PDF from capture analysis (cover page, host names) • Sanitize before sharing — scrub payloads into a new PCAPNG; original file never modified • IGMP / MLD decode — multicast groups, queries, and reports • TLS on common alternate HTTP ports (8080, 8888, …) • Connect to remote PCAP-over-IP streams (Wireshark-style TCP source) • Richer mDNS and payload-based NetFlow / syslog classification • Infrastructure view (Based on Switching and Routing Info)