Capture Workspace

Capture Workspace is the live monitor workflow in OsprioView. It takes the user from monitor-device connection into a running packet capture session, then supports inspection and export of the collected traffic. It also reopens saved .ovb captures for offline review — the workflow that previously lived in a separate Analysis workspace.

Workspace story ​

Capture Workspace is easiest to understand as a three-stage flow:

1. connect monitor-capable hardware
2. run live capture
3. inspect and export the collected packets

This workspace is focused on operational packet collection and offline review of saved captures. It does not own the USB transport layer directly.

What this workspace owns ​

Capture Workspace owns capture-session and offline-review UX:

• selecting and connecting monitor-capable hardware
• starting and stopping live capture
• appending packet history into the active session
• filtering, selecting, and inspecting packets
• exporting capture data to .ovb
• reopening saved .ovb captures for read-only offline review

USB transport ownership, cross-tab exclusivity, and session binding remain in shared managers.

Stage 1: Connect hardware ​

Device setup ​

1. Open a Capture tab.
2. Click PAIR NEW if the device has not been authorized yet.
3. Select a listed monitor-capable device.
4. Click Connect.

If the hardware is an Osprio Mini and it is currently running emulator firmware, switch it to the monitor app before expecting capture to work.

What happens after connect ​

Once a device is connected, the workspace changes from device-selection UI into the live capture surface.

The header then exposes:

• Start or Stop capture
• Save Capture
• the current packet count
• the connected USB device badge
• current firmware version when available

Stage 2: Run live capture ​

Core capture flow ​

The normal capture path is:

1. connect a monitor device
2. click Start
3. let packets stream into the table
4. stop the session when collection is complete
5. save or export the result

Captured packets are stored in the active workspace session, not in a backend service.

Advanced capture configuration ​

Before starting, the Advanced Capture dialog lets the user constrain what gets collected. Every section is optional — a blank section means "no constraint".

• PD address filter — capture only traffic to or from specific PD addresses. Up to 8 addresses (0x00–0x7f) can be listed; leave the filter off to capture all PDs.
• Start trigger — the device stays in an ARMED state and does not record until a matching OSDP frame is seen, then begins capturing starting with the matching frame. A trigger matches on an OSDP command or reply code, optionally narrowed to a specific PD address and a direction (CP → PD, PD → CP, or either).
• Auto-stop conditions — capture ends on the first condition that fires, and any combination can be active at once: stop when a specific packet is seen (same matcher shape as the start trigger), stop after a packet count, or stop after a duration.

Reducing noise and tracking drops ​

Two runtime aids help when a busy bus would otherwise bury the interesting traffic:

• Fold POLL/ACK — collapses each contiguous run of POLL and ACK packets into a single discard marker, so secure-channel setup, events, and command/reply exchanges stand out instead of scrolling past in a flood of polling.
• Drop statistics — the device reports how many packets or reports it had to drop (for example under sustained load); the workspace surfaces those counts so a gap in the capture is visible rather than silent.

Runtime behavior while capture is active ​

While capture is running:

• the bound device is reserved for that session
• other tabs should see the device as unavailable or in use
• packet rows are appended live into the packet table
• the shell can warn before unload or close if capture is still active or the session is dirty

If the device disconnects unexpectedly, the workspace can become orphaned so the collected packet history remains visible even though live capture has stopped.

Read-only and orphaned states ​

Capture Workspace can also appear in a non-live state:

• orphaned capture session after hardware disconnect
• read-only content from a saved capture reopened for offline review

In those cases, the runtime controls are reduced or disabled, but the packet inspection surfaces remain available.

Stage 3: Inspect and export packets ​

Packet table ​

The packet table is the main live inspection surface.

It supports:

• live packet row updates during capture
• packet filtering
• row selection
• clearing selection
• save-selection export behavior for filtered or selected subsets

If no packet is selected, the table occupies the full content area.

Packet details ​

When a packet is selected, the workspace splits vertically and opens the packet details panel below the table.

This panel is used for deeper inspection of:

• decoded sections
• packet structure
• protocol fields
• raw and derived values

That split layout lets the user monitor traffic continuously while drilling into a specific packet.

Save and export ​

Use Save Capture to export capture data.

The save flow supports:

• full capture export
• visible or filtered subset export, and saving just the current selection
• optionally folding POLL/ACK runs out of the saved file
• optional password protection, producing an encrypted .ovb

Exports are written as .ovb files. The .ovb format is the handoff format between live collection and offline review; an encrypted archive prompts for its password when reopened for offline review.

Offline review of saved captures ​

Capture Workspace also reopens saved .ovb captures for offline review, so collected evidence can be inspected without live hardware. This was previously a separate Analysis workspace; it now lives inside Capture.

Open a saved capture ​

From a Capture tab you can open an existing .ovb file through the native file picker, the browser file-input fallback, or a recent-file entry from the current session. Recent-file entries are convenience shortcuts, not durable storage: if the runtime can still resolve the stored file handle the capture reopens directly, otherwise the workspace asks you to reselect it instead of pretending the archive is still accessible.

Encrypted archives ​

When the selected archive is encrypted, the workspace prompts for the decryption password before importing. After the password is accepted, the payload is decrypted, the capture is parsed into the tab, and signature status is checked as part of the import result. Malformed or non-.ovb content, corrupted payloads, a wrong password, or file-access failures surface an error and keep you in the import flow instead of creating a half-loaded session.

Read-only review session ​

A reopened capture loads into a read-only session: no Start or Stop capture controls, no live device ownership, and no device-side side effects. The packet table and packet-details panel behave exactly as they do during live capture, so offline review keeps the same decode and inspection surfaces. Because it never touches hardware, a saved capture can be inspected even when no Osprio device is connected or another workspace currently owns the hardware.

Firmware update boundary ​

Firmware update is related to capture hardware, but it is not part of an active capture session.

The device manager only exposes firmware update for eligible unbound devices, and the capture workspace should not treat firmware flashing as an in-session capture operation.

Session lifecycle and close behavior ​

Close behavior ​

Capture sessions participate in shell lifecycle protection:

• active capture can block tab close until the user confirms
• dirty capture sessions can prompt before discard
• returning to the workspace picker performs cleanup before resetting the tab

Disconnect behavior ​

If the device disconnects during capture, the tab is not silently destroyed.

Instead, the session can be marked orphaned so the user keeps:

• captured packet history
• current table filters and selection context
• packet details for the selected row

That makes the disconnect explicit without discarding the session state.