Packet capture viewer (mini Wireshark)

A packet capture viewer that runs in the browser. Open a file from tcpdump, Wireshark, dumpcap or tshark and it is parsed on your machine, in a background worker so the page stays responsive with large files. It is not Wireshark — it knows a few dozen protocols, not three thousand — but it reads the same files, shows them the same way, and its display filters use the same syntax.

How to use it

Open a capture (or drop it on the page), or pick one of the examples. The examples are made up byte by byte: a home network (DHCP, ARP, DNS, HTTP, TLS 1.2 and 1.3, QUIC, NTP, mDNS, ping, IPv6, IP fragments, a VLAN tag), an MQTT and Modbus TCP session, and a tour of link types. You can download the first one to compare with Wireshark.
Packet list. Number, time, source, destination, protocol, length and an Info column like Wireshark’s, coloured the way Wireshark colours rows (TCP lavender, UDP blue, HTTP green, TCP problems black). Click a column heading to sort. Arrow keys move through the list; M marks a packet; Enter or a double-click follows its stream. The time column can show seconds since the start, since the previous packet, the time of day, UTC or epoch seconds. Resolve names shows the names the capture itself carries: pcapng name records and the answers of DNS responses in it.
Details and bytes. The tree shows each layer with its fields. Select a line to highlight its bytes; click a byte to find its field. Reassembled data (a TLS record or an HTTP response spread over several TCP segments, a fragmented IP datagram) gets its own tab in the bytes pane. Apply as filter (and …and, …or, Not) turns the selected field into a display filter.
Display filters. Type a filter and press Enter. The box turns green when the filter is valid and red, with the place of the mistake, when it isn’t. Examples: ip.addr == 192.168.1.0/24, tcp.port in {80, 443}, dns.qry.name contains "example", frame.len > 1000, tcp.analysis.flags && !tcp.analysis.window_update, tls.handshake.type == 1. The Filter help tab lists the operators and every field the viewer knows; values can be numbers, hex, IPv4 and IPv6 addresses and prefixes, MAC addresses, quoted strings and regular expressions (matches).
Statistics. Conversations and Endpoints for Ethernet, IPv4, IPv6, TCP and UDP (packets and bytes each way, start, duration, rate), the Protocols hierarchy, and an IO graph of packets or bytes per interval with a second series for any filter. Each can be limited to the displayed packets; a row’s Filter link filters on it.
Follow stream. The bytes of a TCP connection (or a UDP flow) in order, without retransmissions, client in red and server in blue, as ASCII, UTF-8, a hex dump or raw hex — and Save data writes it to a file.
Export. Save the displayed, marked or selected packets as pcapng (keeping interfaces, comments and names) or pcap; the packet list as CSV; HTTP objects (pages, images, JSON — chunked and gzip bodies decoded); and the HTTP requests as a HAR file.

What it dissects

Files: pcap (microsecond and nanosecond, either byte order) and pcapng (section header, interface description, enhanced, simple and obsolete packet blocks, several interfaces and link types in one file, several sections, comments, name resolution and interface statistics blocks). Large files are streamed from disk rather than read into memory at once.
Link layers: Ethernet II and 802.3 with LLC/SNAP, 802.1Q and QinQ VLAN tags, Linux cooked capture v1 and v2 (tcpdump -i any), raw IP, BSD and OpenBSD loopback, and 802.11 with or without radiotap (beacons and probes with SSID and channel, data frames with LLC/SNAP, protected frames shown as encrypted).
Network and transport: ARP, IPv4 (options, checksum, fragment reassembly), IPv6 (extension headers, fragment reassembly), ICMP (with the quoted datagram of an error), ICMPv6 (echo, neighbour and router discovery), IGMP, UDP, VXLAN and TCP. TCP gets stream numbers, relative sequence and acknowledgement numbers, window scaling, options (MSS, window scale, SACK, timestamps) and the analysis Wireshark does: retransmissions (plain, fast and spurious), out-of-order segments, previous segment not captured, duplicate ACKs, zero windows and probes, keep-alives, window updates, and the round-trip time of each ACK.
Applications: DNS, mDNS and LLMNR (A, AAAA, CNAME, NS, PTR, MX, TXT, SOA, SRV, NAPTR, CAA, HTTPS/SVCB, DS, DNSKEY, RRSIG, NSEC, NSEC3, TLSA, SSHFP, OPT/EDNS, with request–response pairing), DHCP, NTP, HTTP/1.x (reassembled across segments, Content-Length and chunked bodies, requests paired with responses), TLS records and handshakes (Client Hello with SNI, ALPN, cipher suites, groups, signature algorithms and supported versions; Server Hello; certificates with subject, issuer and validity; alerts; TLS 1.3 detected), QUIC long headers (version, connection IDs, Initial token and length, coalesced packets), MQTT 3.1.1 and 5, and Modbus TCP (registers, coils, writes, exceptions, request–response pairing).

I checked the dissectors against tshark 4 on the example captures: the Info column, the TCP analysis flags and the frames that each of more than sixty display filters selects all match.

Working with other tools

A certificate in a TLS handshake has Open in Certificate decoder, which opens the chain in the certificate decoder for the full X.509 view and chain check.
An MQTT payload, HTTP body or other data has Decode in Binary formats, which sends the bytes to binary formats (MessagePack, CBOR, protobuf, BSON).
A Modbus TCP frame has Open in Modbus tool, for the field-by-field view and register decoding in Modbus and CAN.
A DNS query has Look up … live, which opens the name in the DNS lookup tool — only when you press it there does anything leave the browser.
Export → HTTP as HAR writes the capture’s HTTP/1.x requests and responses as a HAR file that the HTTP request client imports (Import file) as a collection you can resend.
The TCP simulator and LAN protocols simulator have Open in packet viewer, which opens their simulated capture here.

Related, but not connected: MQTT client (a live broker connection), Mode S decoder (ADS-B frames from a receiver).

What it doesn’t do

It can’t capture — browsers have no access to network interfaces — so make the file with tcpdump -w, Wireshark or dumpcap first. It doesn’t decrypt TLS or QUIC (pcapng decryption-secret blocks are counted but not used), and it has no HTTP/2, HTTP/3 or SMB dissectors. QUIC packets after the header are shown as protected.

Browser support

Any current browser. The background worker is used where available; if it can’t start, the same code runs on the page.

Privacy

Captures are read and parsed in your browser and never uploaded. Nothing is stored except your display preferences (time format, colours, which tree branches are open). Share link carries only an example’s name and the display filter, never your capture. The hand-offs open the other tool in a new tab with the certificate, payload, frame or name in the address; the DNS tool sends a name to Cloudflare or Google only when you press Look up there.