Capture Workspace

Capture Workspace is the live capture workflow in Osprio View. It takes the user from capture-device connection into a running packet capture session, then supports inspection and export of the collected traffic. It also reopens saved .ovb captures for offline review — the workflow that previously lived in a separate Analysis workspace.

Workspace story ​

Capture Workspace is easiest to understand as a three-stage flow:

1. connect capture-capable hardware
2. run live capture
3. inspect and export the collected packets

This workspace is focused on operational packet collection and offline review of saved captures. It does not own the USB transport layer directly.

What this workspace owns ​

Capture Workspace owns capture-session and offline-review UX:

• selecting and connecting capture-capable hardware
• starting and stopping live capture
• appending packet history into the active session
• filtering, selecting, and inspecting packets
• exporting capture data to .ovb
• reopening saved .ovb captures for read-only offline review

USB transport ownership, cross-tab exclusivity, and session binding remain in shared managers.

Stage 1: Connect hardware ​

Device setup ​

1. Open a Capture tab.
2. If no devices are listed, open the Pair Device dialog from the pair link in the empty-state hint ("Not seeing your device?") and pair a device over USB. Pairing is a browser-build step only — the desktop build auto-discovers connected devices. Paired devices are available across all workspaces.
3. Click a listed capture-capable device card to connect to it.

If the hardware is an Osprio Mini running a different app, switch it to the capture app first — the same hint offers a switch link into App Switcher.

What happens after connect ​

Once a device is connected, the workspace changes from device-selection UI into the live capture surface.

The header then exposes:

• Start or Stop capture
• an Advanced button that opens the Advanced Capture dialog
• the RS-485 bus baud-rate selector (9600–230400, default 115200)
• a Fold POLL/ACK toggle (on by default)
• Save and Clear
• the current packet count, as a popover with a per-type breakdown
• live capture-state and dropped-packet chips

The Start, Advanced, and baud controls only appear while the session is live; they are removed for a read-only saved capture or an orphaned session, and the baud selector is disabled while a capture is running.

Stage 2: Run live capture ​

Core capture flow ​

The normal capture path is:

1. connect a capture device
2. click Start
3. let packets stream into the table
4. stop the session when collection is complete
5. save or export the result

Captured packets are stored in the active workspace session, not in a backend service.

Advanced capture configuration ​

Before starting, the Advanced Capture dialog lets the user constrain what gets collected. Every section is optional — a blank section means "no constraint".

• PD address filter — capture only traffic to or from specific PD addresses. Up to 8 addresses (0x00–0x7f) can be listed; leave the filter off to capture all PDs.
• Start trigger — the device stays in an ARMED state and does not record until a matching OSDP frame is seen, then begins capturing starting with the matching frame. A trigger matches on an OSDP command or reply code, optionally narrowed to a specific PD address and a direction (CP → PD, PD → CP, or either).
• Auto-stop conditions — capture ends on the first condition that fires, and any combination can be active at once: stop when a specific packet is seen (same matcher shape as the start trigger), stop after a packet count, or stop after a duration.

Reducing noise and tracking drops ​

Two runtime aids help when a busy bus would otherwise bury the interesting traffic:

• Fold POLL/ACK — collapses each contiguous run of POLL and ACK packets into a single discard marker, so secure-channel setup, events, and command/reply exchanges stand out instead of scrolling past in a flood of polling.
• Drop statistics — the device reports how many packets or reports it had to drop (for example under sustained load); the workspace surfaces those counts so a gap in the capture is visible rather than silent.

Runtime behavior while capture is active ​

While capture is running:

• the bound device is reserved for that session
• other tabs should see the device as unavailable or in use
• packet rows are appended live into the packet table
• the shell can warn before unload or close if capture is still active or the session is dirty

If the device disconnects unexpectedly, the workspace can become orphaned so the collected packet history remains visible even though live capture has stopped.

Read-only and orphaned states ​

Capture Workspace can also appear in a non-live state:

• orphaned capture session after hardware disconnect
• read-only content from a saved capture reopened for offline review

In those cases, the runtime controls are reduced or disabled, but the packet inspection surfaces remain available.

Stage 3: Inspect and export packets ​

Packet table ​

The packet table is the main live inspection surface.

It supports:

• live packet row updates during capture
• packet filtering
• row selection
• clearing selection
• save-selection export behavior for filtered or selected subsets

If no packet is selected, the table occupies the full content area.

Packet details ​

When a packet is selected, the workspace splits vertically and opens the packet details panel below the table.

This panel is used for deeper inspection of:

• decoded sections
• packet structure
• protocol fields
• raw and derived values
• secure-channel handshake state, and decrypted payloads when the key context is available

Where a secure channel cannot be derived automatically, the Manual Keys popover lets you supply an SCBK by hand so the workspace can attempt to decrypt those exchanges.

That split layout lets the user monitor traffic continuously while drilling into a specific packet.

Save and export ​

Use Save in the header to export capture data. The Save Capture Session dialog opens, and its confirm action is Export to File.

The save flow supports:

• full capture export
• visible or filtered subset export; the current selection can also be exported directly with Save Selection as Binary… from the packet table's right-click menu
• optionally discarding POLL/ACK runs from the saved file (they collapse to a summary marker and cannot be recovered)
• optional password protection (minimum 6 characters), producing an encrypted .ovb

Exports are written as .ovb files. The .ovb format is the handoff format between live collection and offline review; an encrypted archive prompts for its password when reopened for offline review.

Offline review of saved captures ​

Capture Workspace also reopens saved .ovb captures for offline review, so collected evidence can be inspected without live hardware. This was previously a separate Analysis workspace; it now lives inside Capture.

Open a saved capture ​

From a Capture tab, the Open saved capture (.ovb) button opens an existing .ovb file through the native file picker, with a browser file-input fallback where the native picker is unavailable.

Encrypted archives ​

When the selected archive is encrypted, the workspace prompts for the decryption password before importing. After the password is accepted, the payload is decrypted, the capture is parsed into the tab, and signature status is checked as part of the import result. Malformed or non-.ovb content, corrupted payloads, a wrong password, or file-access failures surface an error and keep you in the import flow instead of creating a half-loaded session.

Read-only review session ​

A reopened capture loads into a read-only session: no Start or Stop capture controls, no live device ownership, and no device-side side effects. The packet table and packet-details panel behave exactly as they do during live capture, so offline review keeps the same decode and inspection surfaces. Because it never touches hardware, a saved capture can be inspected even when no Osprio device is connected or another workspace currently owns the hardware.

Firmware update boundary ​

Firmware update is related to capture hardware, but it is not part of an active capture session.

The device manager only exposes firmware update for eligible unbound devices, and the capture workspace should not treat firmware flashing as an in-session capture operation.

Session lifecycle and close behavior ​

Close behavior ​

Capture sessions participate in shell lifecycle protection:

• active capture can block tab close until the user confirms
• dirty capture sessions can prompt before discard
• returning to the workspace picker performs cleanup before resetting the tab

Disconnect behavior ​

If the device disconnects during capture, the tab is not silently destroyed.

Instead, the session can be marked orphaned so the user keeps:

• captured packet history
• current table filters and selection context
• packet details for the selected row

That makes the disconnect explicit without discarding the session state.