PCAP Analyzer

Open a pcap or pcapng capture in the browser and read it packet by packet: every layer from Ethernet to DNS and TLS decoded, with a filter, the conversations, and the bytes behind every field.

Overview

A packet capture records the frames that crossed a network interface, byte for byte, with the moment each one arrived. tcpdump and Wireshark write them as pcap or its successor pcapng. Reading one shows what actually happened: which names were looked up, which connections opened and how they ended, which server a TLS connection asked for, and where a conversation stopped.

This tool reads the file in the browser, in a background worker, so the page stays usable while hundreds of megabytes are worked through. The capture is never uploaded.

Web interface

Drop a capture onto the field or click it to choose one; Open the sample capture loads a short recording made for this page. While the file is read, a bar shows how far it has got.

The list is drawn only where it is on screen, so a capture of 850,000 packets scrolls as easily as one of ten. Click a packet, or move with the arrow keys, Page Up, Page Down, Home and End. A packet reset by TCP is marked in red in the Info column.

Files and link types

A capture compressed with gzip or packed in a zip is recognised as such and has to be unpacked first. A file that ends in the middle of a packet is read up to the last whole one, and the Capture panel says where it stopped.

What is decoded

TCP sequence and acknowledgement numbers are shown relative to the start of each direction, as Wireshark shows them: the SYN is 0, and in a stream whose SYN was not captured the first segment counts as byte 1. The window is multiplied by the scale both sides announced in their SYNs.

The decoding was checked against tshark 4.6.8, Wireshark's command-line version, on five captures: pcap with microsecond and with nanosecond timestamps, pcapng, a capture cut to 64 bytes per packet, and a Linux cooked capture. Lengths, times to the nanosecond, MAC and IP addresses, ports, TCP flags, relative sequence and acknowledgement numbers, window sizes, DNS IDs, names and answers, the TLS server name, HTTP methods, URIs and status codes, and ICMP and ARP types all matched, packet for packet. The one difference is a TLS segment tshark puts back together with the segment before it; see Limits.

The filter

Every word in the filter must match. or separates alternatives, and not or ! in front of a word turns it round.

So tcp port 443 not 10.0.0.1 finds HTTPS traffic of every host but one, and dns or rst finds the name lookups and the resets. A word the filter cannot use is explained under the field, such as "port" needs a number from 0 to 65535 after it. The filter is not Wireshark's display filter language, which is a project of its own.

Conversations

A conversation is all traffic between two endpoints in both directions: two addresses and two ports for TCP and UDP, two addresses for ICMP and the rest. They are sorted by bytes, and the 500 largest are listed. A click on one fills the filter with its protocol, addresses and ports, and the packet list shows only that conversation.

Limits

• Files up to 500 MB are read. In Chrome on a current Mac, a capture of 850,000 packets and 173 MB is read in about a second, and a search of the Info column across all of it takes about as long.
• Segments are not put back together. A TLS record or an HTTP message that continues in the next segment is read as far as the first one goes, and the segments after it show as TCP. Wireshark would show them as TLS or HTTP.
• Encrypted traffic stays encrypted. TLS and QUIC are shown only as far as they travel in the clear.
• The hex view shows the first 16,384 bytes of a packet, which only matters for captures taken before the network card split large segments.

How to capture

# macOS: the Wi-Fi or Ethernet interface is usually en0
$ sudo tcpdump -i en0 -w capture.pcap

# Linux: every interface at once, written as a Linux cooked capture
$ sudo tcpdump -i any -w capture.pcap

# Stop after 1000 packets, and only DNS
$ sudo tcpdump -i en0 -c 1000 -w dns.pcap port 53

tcpdump stops with Ctrl+C. Wireshark captures on macOS, Linux and Windows and saves pcapng. A capture holds whatever crossed the interface, often passwords, cookies and session tokens, so keep it only as long as you need it.

No API

Privacy

Nothing is uploaded. The file is read by a worker on this page and is gone when the page is closed. The sample capture comes from this site; it was recorded in an empty container and holds no one's traffic.