PCAP & PCAPNG Viewer
Read a network capture, follow a conversation, and inspect the packets behind it.
Understand who communicated
Start with TCP and UDP conversations, then inspect individual packets, protocol fields and hex bytes. Follow a TCP stream, read observed DNS messages, HTTP requests and responses, and TLS handshake metadata. Each finding links to its packet evidence.
Upload and storage
Your file is uploaded and stored using the site's normal artifact retention and sharing rules. Dissection then runs in your browser. This is not a local-only tool: treat an artifact URL as shared access to its contents. Captures are not sent to a third-party analyzer. The original capture remains available to download while the artifact is retained.
Supported captures and limits
The preview accepts up to 25 MiB and 100,000 packets, including captures extracted from supported archives. Actual PCAP/PCAPNG signatures identify renamed files. The .cap extension is ambiguous; other formats using that name are not promised. Large or expensive captures may exceed your browser's memory or the analysis deadline; you can cancel, retry, or download the original.
Encryption and recovered files
HTTPS usually exposes metadata, not readable HTTP content. PCAPNG may contain decryption secrets; supported keys may allow Wireshark to decode some traffic. Missing handshakes, encrypted DNS and missing or truncated packets can hide information. HTTP object export recovers supported observed content, which may be incomplete. This viewer does not scan networks or determine whether traffic is safe.
Filters and evidence
Use Wireshark display filters such as dns, http, tls or tcp.analysis.retransmission. These differ from tcpdump/BPF capture filters. Filters and packet navigation stay in the URL fragment; they are not submitted as server query strings.