PCAP Analyzer

A packet capture records the frames that crossed a network interface, byte for byte, with the moment each one arrived. tcpdump and Wireshark write them as pcap or its successor pcapng, and every analyzer reads both.

Reading one shows what actually happened on the wire: which names were looked up, which connections opened and how they ended, which server a TLS connection asked for, and where a conversation stopped.

• Drop a .pcap or .pcapng file onto the field, or click it to choose one. Files up to 500 MB are read, and nothing is uploaded.
• The packet list shows every packet with its time, addresses, protocol and a line saying what it is. Click one, or move with the arrow keys, to see every field it holds and the bytes each field came from.
• The filter narrows the list: dns, tcp port 443, an address, not arp, or any text from the Info column.
• Conversations lists who talked to whom. A click on one filters the packet list to it.
• No capture at hand? Open the sample, recorded for this page.

• Encrypted traffic stays encrypted. Of TLS and QUIC only what travels in the clear is shown: the hellos, the record types and the connection IDs.
• Segments are not put back together. A TLS record or an HTTP message that continues in the next segment is read as far as the first one goes, and the segments after it show as TCP.
• A capture holds whatever crossed the interface, often passwords, cookies and session tokens. That is why it is read on this page and never uploaded, and why it is worth deleting when you are done.
• To capture: sudo tcpdump -i en0 -w capture.pcap on macOS or Linux, with your own interface name, or Wireshark on any system.