PCAP Analyzer

Analyze a .pcap or .pcapng capture in your browser. Protocol breakdown, top talkers, conversations and TCP flags. Nothing is uploaded.

Advertisement

PCAP Analyzer

Analyze a capture without installing anything

Drop a .pcap or .pcapng file and get an immediate summary of what is in it: how many packets, over what period, which protocols, which hosts talked the most, which conversations moved the most data, and which ports and TCP flags appeared. It is the quick triage view you would otherwise open Wireshark for.

The entire file is parsed in your browser. No capture data is uploaded to any server. This is not a convenience — packet captures routinely contain credentials, session tokens, internal addressing and personal data, and uploading them to a web service would be exactly the wrong thing to do. Because parsing is local, the file never leaves your machine.

What it reads

The analyzer understands the classic libpcap format in both byte orders and both timestamp resolutions, and the common subset of the newer PCAPNG format (section header, interface description and enhanced/simple packet blocks). It decodes Ethernet, Linux cooked, raw-IP and loopback link layers, unwraps VLAN tags, and parses IPv4, IPv6, TCP, UDP, ICMP and ICMPv6 headers.

From that it produces:

  • Transport protocol breakdown — the share of TCP, UDP, ICMP and other traffic.
  • Application protocols — inferred from well-known service ports (HTTP, HTTPS, DNS, SSH, SMB, RDP, and many more).
  • Top talkers — the hosts sending and receiving the most bytes.
  • Top conversations — the endpoint pairs that exchanged the most data.
  • Top ports and TCP flags — useful for spotting scans (lots of SYNs, few ACKs) or resets.

You can export the summary as a text report.

What it does not do

This is a summariser, not a full protocol dissector. It does not reassemble TCP streams, extract files, decode application-layer payloads, or decrypt TLS. For deep per-packet inspection, Wireshark remains the right tool — this exists for the fast "what is in this capture" pass, and for when you cannot or should not install desktop software.

Practical notes

Captures up to 100 MB are supported. Very large files are analysed up to a packet cap; if you hit it, trim the capture first in Wireshark with a display filter and Export Specified Packets, or capture with a tighter BPF filter. If a file will not open, confirm it was saved as pcap or pcapng — some tools default to other formats.

Related tools

Pull indicators out of logs or notes with the IOC Extractor, check a suspicious source address with the IP Risk Checker, or work out network ranges with the Subnet Calculator.

This tool is provided for informational and educational purposes only. All processing happens in your browser — no data is sent to or stored on our servers. While we strive for accuracy, we make no warranties about the completeness or reliability of results.