📦 PCAP Viewer
View and analyze PCAP / PCAPNG packet capture files online — packet list, protocol decode, conversations, and filters.
Drop a .pcap or .pcapng file here, or click to browse
Supports Wireshark/tcpdump capture files — all parsing happens locally
Conversations
| Address A | Address B | Proto | Packets | Bytes |
|---|
| # | Time | Source | Destination | Proto | Length | Info |
|---|
Packet detail
About this tool
Inspect packet capture files (.pcap and .pcapng) from tcpdump, Wireshark, or any network capture tool. Upload a file and get a full breakdown: packet list with timestamps, source/destination addresses, protocol decodes (Ethernet, IPv4, IPv6, TCP, UDP, DNS, ARP, ICMP, HTTP, TLS), and a conversation summary grouped by address pairs.
Filter by protocol or IP address to zoom in on specific traffic. Click any packet to see its full layer-by-layer decode with a hex dump.
Example: tcpdump -c 100 -w capture.pcap → upload here → 100 packets decoded with protocol breakdown and per-flow conversation stats. DNS queries show the queried domain and response IPs.
FAQ
How do I create a .pcap file? ›
Use tcpdump: "tcpdump -c 100 -w capture.pcap" to capture 100 packets. In Wireshark, use File → Save As. The file is parsed entirely in your browser and never uploaded anywhere.
Which protocols are supported? ›
The viewer decodes Ethernet, IPv4, IPv6, TCP, UDP, ARP, ICMP, DNS (queries and responses), HTTP (request line detection), and TLS (handshake detection). Other protocols appear as raw data in the hex dump.
What is a conversation? ›
A conversation groups packets between the same pair of IP addresses using the same transport protocol. It shows total packet count and bytes exchanged, which helps identify the heaviest flows in a capture.
Can I open .pcapng files from modern Wireshark? ›
Yes — basic pcapng support is included: Section Header, Interface Description, and Enhanced Packet blocks are parsed. Some advanced block types may be skipped.