PCAP Analyzer

A packet capture records the frames that crossed a network interface, byte for byte, with the moment each one arrived. tcpdump and Wireshark write them as pcap or its successor pcapng, and every analyzer reads both.

Reading one shows what actually happened on the wire: which names were looked up, which connections opened and how they ended, which server a TLS connection asked for, and where a conversation stopped.

• Drop a .pcap or .pcapng file onto the field, or click it to choose one. Files up to 500 MB are read, and nothing is uploaded.
• The packet list shows every packet with its time, addresses, protocol and a line saying what it is. Click one, or move with the arrow keys, to see every field it holds and the bytes each field came from.
• The filter narrows the list: dns, tcp port 443, an address, not arp, or any text from the Info column.
• Conversations lists who talked to whom. A click on one filters the packet list to it.
• Follow TCP stream, above the details of a TCP packet, shows everything both sides sent, in order and with retransmissions taken out.
• No capture at hand? Open the sample, recorded for this page.

• Encrypted traffic stays encrypted. Of TLS and QUIC only what travels in the clear is shown: the hellos, the record types and the connection IDs.
• Only Follow TCP stream puts segments back together. In the packet list, a TLS record that runs over several segments is named where it starts and where it ends; an HTTP message that does is read as far as its first segment goes.
• A capture holds whatever crossed the interface, often passwords, cookies and session tokens. That is why it is read on this page and never uploaded, and why it is worth deleting when you are done.
• To capture: sudo tcpdump -i en0 -w capture.pcap on macOS or Linux, with your own interface name, or Wireshark on any system.