A packet tool that can send frames or open a capture is the kind of program Windows, antivirus software and download catalogues often treat with caution. That reaction is understandable. It is not, by itself, a verdict on a particular file.

This page covers every current Loosha Soft program listed on packetbuilder.net: Cat KARAT Packet Builder, PCAP Workbench, Loosha Mobile Core, GTP Session Tracker, and Loosha Visual Subnetting. It states the author's commitment that these tools contain no malware, advertisements or telemetry, and it explains how the current packages are shipped, how to check that your copy matches the official file, why a SmartScreen or antivirus warning can appear, what network access each tool actually needs, and how to remove the software — according to the current product pages and user guides.

Our commitment

I am the author of the Loosha Soft programs on this site. I build them as tools for work and learning: crafting packets, editing captures, testing lab devices, and teaching how networks behave.

I do not put viruses, backdoors, trojans, ransomware, or any other malicious code into these programs. I also do not include advertisements, and I do not add telemetry: no usage tracking, no analytics, and no crash reporters that send data off your computer.

None of these programs contact a server on their own to check for updates, activate a license, or report how you use them. Full Edition licenses for PCAP Workbench and Loosha Mobile Core are verified locally from a license.lic file on your computer. When a program sends packets or opens a session, it does so only to the addresses and interfaces you configure. Optional MCP interfaces listen on loopback by default. A Help or About link may open packetbuilder.net only if you click it.

This applies to every current Loosha Soft program listed on the site: Cat KARAT Packet Builder, PCAP Workbench, Loosha Mobile Core, GTP Session Tracker, and Loosha Visual Subnetting.

Download only from the official Downloads page (Dropbox is the primary host for every product; Cat KARAT, PCAP Workbench and Loosha Mobile Core also have a MEGA mirror if Dropbox is unavailable. GTP Session Tracker and Loosha Visual Subnetting are listed with Dropbox only). Then compare the SHA-256 of what you received with the value on the product page.

Current packages are portable

The current Windows releases are portable. They are not Windows installers: there is no setup wizard and nothing to uninstall through the system. You copy or unpack the files and run them.

  • PCAP Workbench and Loosha Mobile Core each ship as a Windows zip. The product pages say unzip and run. Workbench's User Guide adds that no installer and no administrator rights are needed to start the program; Npcap is required only if you use Send to network.
  • Cat KARAT Packet Builder is documented as a single executable (Karat-2.18.2.exe in the current release) with no installation. The same release folder holds the User Guide, release notes, scripting reference, examples, the license, and a companion checksum file.
  • GTP Session Tracker is a single Lua file. There is no installer and no separate runtime: you copy it into Wireshark's personal Lua plugins folder (typically %APPDATA%\Wireshark\plugins on Windows, or ~/.local/lib/wireshark/plugins on Linux) and reload the plugins.
  • Loosha Visual Subnetting is documented as a standalone Windows application — a single executable that needs nothing else — and as freeware. A Linux build is available upon request, as for the other desktop tools.

To remove a portable Windows package, delete the folder you unpacked (or the folder that holds the Karat or Visual Subnetting executable). For the Tracker, delete the .lua file from the Wireshark plugins folder. Settings or output written outside that folder are listed below.

Linux builds for the desktop tools are offered upon request on the live site. If you receive a Linux package, the Karat, Workbench and Mobile Core guides describe .deb, .rpm and .tar.gz packages, removed with the distribution's package manager or with uninstall.sh from an unpacked archive.

Files the programs may leave behind

Deleting the program folder does not always remove per-user settings. Only paths named in the current documentation are listed here.

Karat. Multistream stream files (stream-A.karat.json through stream-H.karat.json) are kept in %LOCALAPPDATA%\Karat\streams (Linux: ~/.local/share/Karat/streams; KARAT_STREAM_DIR overrides this). errorlog.txt and, if you start Karat with -d, debuglog.txt are written next to the program or in its working directory. On Linux, errorlog.txt goes to ~/.local/state/karat/.

PCAP Workbench. The User Guide lists %USERPROFILE%\.pcap_workbench.json (tshark path and the Auto-fix setting) and %USERPROFILE%\.pcap_workbench\ for saved recipes and Scale profiles. On Linux the same names live in your home folder. A Full Edition license check may cache a short-lived status file in %LOCALAPPDATA%\golicense (Linux: ~/.cache/golicense). The optional MCP server may also write an audit log and a token file under %AppData%\Loosha2\ (Linux: ~/.config/Loosha2/).

Loosha Mobile Core. Generated files go to an output folder next to the executable by default, or to %LOCALAPPDATA%\Loosha\output (Linux: ~/.local/share/Loosha/output) if the application folder is read-only. Settings are stored in .gtp_traffic_generator.json in the user home folder (~/.gtp_traffic_generator.json on Linux, and the same file name on Windows). The license-status cache uses the same golicense location as Workbench. The optional MCP token file is documented at %AppData%\Loosha\mcp-token (Linux: ~/.config/Loosha/mcp-token). An older default folder, ~/GTP_Traffic_Generator_Output, is documented as unused and ignored.

GTP Session Tracker and Visual Subnetting have no documented application settings folder of their own. The Tracker lives only as the Lua file you copied into Wireshark's plugins directory.

If you want a complete cleanup, delete those folders and files after you delete the program itself. Leave them if you plan to install the same tool again and keep your recipes, streams or license cache.

How to verify a download with SHA-256

The official integrity check for every current package is a SHA-256 digest published on the product page (and, for the Tracker and Visual Subnetting, also on the Downloads page). Compare the hash of the file you downloaded with that published value. Hashes change with every release, so always read the current product page rather than a hash copied from an old article or a third-party mirror.

Some packages also include a checksum file you can use after the download (or after unpacking):

  • Karat ships Karat-2.18.2.exe.sha256 next to the executable (the file name follows the version).
  • PCAP Workbench's Windows zip includes SHA256SUMS.txt, a SHA-256 of every file in the package.
  • Loosha Mobile Core's official Windows release also includes SHA256SUMS.txt in the package, and a SHA256SUMS.txt next to the zip that lists the zip itself. Linux packages for Karat, Workbench and Mobile Core document the check sha256sum -c SHA256SUMS.txt --ignore-missing.
  • GTP Session Tracker and Visual Subnetting are verified against the hash printed on the official page; they are a single Lua file and a standalone Windows package, not a multi-file zip with a bundled sums file.

On Windows, in PowerShell, hash the file you actually downloaded (this example uses the current Workbench zip name; substitute your file):

Get-FileHash -Algorithm SHA256 .\LooshaPcapWorkbench_1.8.9_Windows.zip

Or, with certutil:

certutil -hashfile LooshaPcapWorkbench_1.8.9_Windows.zip SHA256

On Linux or macOS:

sha256sum LOOSHA_MOBILE_CORE_1.19.2_WINDOWS.zip

If a SHA256SUMS.txt or *.sha256 file is present, you can also check against that file, for example sha256sum -c SHA256SUMS.txt. The value must still match the digest on the official product page. If it does not, do not run the file; download again from the Downloads page and contact the address listed there.

Check a file on VirusTotal yourself

After the SHA-256 matches, you can optionally look the file up on VirusTotal. The most precise way is to search for the same SHA-256 you just computed, so you inspect the report for that exact digest. You can also upload the file you hashed.

VirusTotal aggregates many antivirus engines. A packet builder, a capture editor or a tool that uses a capture driver may trigger a heuristic detection on one or two engines even when the file is the official build. That is not automatic proof of malware, and a clean report is not a certificate from Loosha Soft. Use VirusTotal as a second opinion; treat the official SHA-256 as the integrity check.

Why Windows SmartScreen or antivirus software may warn you

The current product pages and user guides present SHA-256 as the way to confirm a download. They do not describe a Windows Authenticode (code) signature as a verification method.

Windows SmartScreen and some antivirus products commonly warn on applications that are not signed with a widely trusted certificate, or that they have not seen often. Tools that send raw packets, use a packet-capture driver, or open raw sockets sit in a class those products often flag. The warning is a heuristic or reputation check, not a statement that the file failed the official SHA-256 comparison. If a warning appears, stop and compare the hash first. If the digest does not match the product page, do not run the file.

What network access each tool needs

None of these programs require a cloud account or a license server, and they do not contact a server on their own for updates, license activation, advertisements or telemetry. PCAP Workbench is documented as running fully offline, with Full Edition activation by a local license.lic. Visual Subnetting is documented as needing no network connection. The Tracker is a Wireshark plugin and has no network service of its own. When a program sends packets or opens a TCP session, it does so only to the addresses and interfaces you configure.

Live sending and capturing are separate from opening, building or editing files:

  • Karat needs Npcap on Windows (libpcap on Linux) to list adapters, transmit and capture. Without Npcap it still starts, builds packets, validates captures and writes pcap files. Sending and capturing may need administrator rights, depending on how Npcap was installed ("Restrict Npcap driver's access to Administrators only"). File-building and --output to a pcap do not. An optional Safety: loopback only mode (Options menu, or --safety-loopback) refuses to transmit on any adapter that is not a loopback interface.
  • PCAP Workbench and Loosha Mobile Core need Npcap only for Send to network. Both select loopback by default, so frames stay on the PC. A real interface is used only when you explicitly allow it (Allow real network in the GUI, or --allow-remote / --allow-real-network on the Workbench CLI). For Mobile Core probe and the conformance suite, the manual also asks for Npcap with WinPcap API compatibility. Linux sending needs root or CAP_NET_RAW.
  • Optional MCP interfaces, where documented, listen on loopback by default. A non-loopback listen address requires an explicit --allow-remote (or equivalent) option.
  • GTP Session Tracker does not send packets. It analyses a capture already opened in Wireshark.
  • Visual Subnetting has no documented capture driver, send function or network requirement.

Use send, replay, probe and live-driver features only on networks and devices you are authorized to test.

Third-party catalogue pages and older builds

Some uninstaller-log collectors and download-aggregator sites automatically generate pages for programs that appear in their databases. Those pages often repeat generic wording — crashes, "potentially malicious", leftover files — without product-specific evidence. They are not published by Loosha Soft, and they are not a substitute for the SHA-256 on the official product page.

They may also describe older packaging. The current Windows programs on packetbuilder.net are portable packages, not Windows installers. If you find an installer-style build on a third-party archive, treat it as a legacy copy and not as the current distribution. Download the current files from the official Downloads page and verify the hash printed there.

A short verification checklist

  1. Open the official Downloads page and follow the host link for the product you want.
  2. On that product's page, copy the published SHA-256 for the current package.
  3. Hash the file you received (Get-FileHash, certutil -hashfile, or sha256sum). The two digests must match.
  4. If the package includes SHA256SUMS.txt or a *.sha256 file, you can check the inner files against it as well. The zip or executable hash must still match the product page.
  5. Optionally search VirusTotal for the same SHA-256.
  6. Install any capture driver only if you need live send or capture, and start with loopback where the program offers it.

Downloads →

Product pages: Karat · PCAP Workbench · Mobile Core · GTP Session Tracker · Visual Subnetting

Limitations

  • A matching SHA-256 confirms that your file is the same bytes as the digest Loosha Soft published for that release. It does not predict how every antivirus engine will classify the file, and it is not a formal certification.
  • This article does not reproduce current hashes, because they change with each release. Always read them from the live product page.
  • Paths listed under "files left behind" are only those named in the current user guides. Other operating-system artefacts (for example a Windows Defender history entry) are outside the product documentation.
  • Linux package layout and removal commands apply only if you received a Linux build; the public Downloads page currently offers Windows packages and, for the Tracker, a Lua file.

FAQ

Do these programs contain viruses, ads or telemetry?
No. I build them as tools for work and learning, and I do not put malware, advertisements or telemetry into them. The details are in Our commitment above. You can still confirm that your copy matches the official file with the SHA-256 on the product page.

Why is there no Windows installer?
The current Windows releases are portable: a zip you unpack, a single executable, or a single Lua plugin. You run the program from the folder you chose. There is no setup wizard and nothing to register with the system.

If I just delete the folder, is anything left on the computer?
The program itself is gone. Settings, stream files, recipes or output may remain in the documented folders above (for example %USERPROFILE%\.pcap_workbench and %LOCALAPPDATA%\Karat\streams). Delete those too if you want a complete cleanup. The Tracker is removed by deleting the .lua file from Wireshark's plugins folder.

Why did SmartScreen or my antivirus warn me?
These tools send or inspect raw packets, and the published verification method is SHA-256 rather than a Windows code signature. SmartScreen and some antivirus products often warn in that situation. Compare the official hash before you decide to continue.

Do I need Npcap just to build or edit a pcap?
No. Karat builds and validates packets and writes pcap files without Npcap. Workbench and Mobile Core need Npcap only for Send to network. Visual Subnetting and the Tracker do not use Npcap.

Can I trust a third-party page that says the program left leftovers or is "potentially malicious"?
Not as a source of product-specific evidence. Auto-generated catalogue pages are not published by us. Use the official SHA-256 and the documented data folders on this page.