Standard capture happens at the network driver, below the socket layer, where the association between a packet and the process that produced it has already been discarded. For a game client started indirectly through a platform or publisher launcher, the process that owns the traffic is not the launcher that started it, so ordinary capture cannot say which process a flow belongs to.

fragcap is a passive network capture tool for Windows that reconstructs that association, attributing each captured flow to the process that produced it, including game clients launched indirectly through platform and publisher launchers.

$ fragcap run --profile eso --out capture.fcapng
armed: waiting for eso.exe
stage matched: eso.exe (pid 8124)
captured 4127 packets, 4127 attributed
wrote capture.fcapng

• Each flow is attributed to the process that owns it, and the attribution rides in packet comments, so an unmodified analyzer still reads the file as ordinary pcapng. Output formats
• Clients started indirectly through Steam and other launchers are matched by a profile rather than by the launcher that spawned them. Writing a profile
• fragcap observes only. It never modifies, injects, or replays traffic, and never reads the memory of another process. Security posture

Capture requires the npcap driver, installed with WinPcap-compatible mode. fragcap detects it and never installs it.