PCAP viewer
To open a PCAP file, drop it in the box below. It opens straight away, even with no extension or the wrong one. Your browser opens it on your device: nothing is uploaded.
What you see
| PCAP in the viewer | |
|---|---|
| Versions | Microsecond and nanosecond times, both byte orders |
| Read in | A worker in your browser, a piece at a time, with Stop |
| Packets listed | The first 1,000,000; the rest are counted |
| Decoded | Ethernet, VLAN, SLL, IPv4, IPv6, ARP, ICMP, TCP, UDP, DNS, DHCP, HTTP, TLS, QUIC |
| Not done | Decrypting TLS, following streams, reassembling fragments |
| Extensions | .pcap, .cap, .dmp |
| Upload | None: opened on your device |
What is a PCAP file?
PCAP is the packet capture format of tcpdump, libpcap and older Wireshark: every packet a network card saw, with its time.
Every packet as a row in the table viewer: number, time from the first packet and the absolute time, source, destination, protocol, length and a summary line. Ethernet, VLAN tags, Linux cooked captures, raw IP and loopback are read; IPv4 and IPv6 with their extension headers, ARP, ICMP, TCP flags and sequence numbers, UDP, DNS questions and answers, DHCP, HTTP request and status lines with the Host, the server name in a TLS Client Hello, and QUIC. Details lists the packet count, duration, link types, protocols and the busiest conversations. Sort, filter and search like any table.
How to open a PCAP file
- Add your PCAP. Drop the file in the box, choose it or paste it.
- Look at it. Every packet as a row in the table viewer: number, time from the first packet and the absolute time, source, destination, protocol, length and a summary line. Ethernet, VLAN tags, Linux cooked captures, raw IP and loopback are read; IPv4 and IPv6 with their extension headers, ARP, ICMP, TCP flags and sequence numbers, UDP, DNS questions and answers, DHCP, HTTP request and status lines with the Host, the server name in a TLS Client Hello, and QUIC. Details lists the packet count, duration, link types, protocols and the busiest conversations. Sort, filter and search like any table.
- Take it further. Open in hands it, in a new tab, to File converter.
Questions
Drop it here. The packets are listed in a table you can sort and filter, and the converter saves them as CSV.
No. It is read in your browser, on your device. Captures often hold private traffic, so nothing leaves the computer.
The capture kept only the first bytes of each packet (its snapshot length), or the file ends inside a packet. What is there is read.
No. The viewer runs in your browser and opens the file on your device. Nothing is sent anywhere.