PCAP Forensics - Free Online Network Capture Analyzer
PCAP Forensics
Inspect a packet capture, reassemble its TCP streams and dissect what was actually said on the wire - without uploading anything.
Drop a capture file here
pcap or pcapng - or click to browse from your device
Choose captureCapture Overview
What the container itself declares about this capture, before any packet is interpreted.
Packet List
Every decoded frame. Click a row to see its layer breakdown and a hex dump of the bytes.
--
| # | Time | Source | Destination | Protocol | Length | Info |
|---|
TCP Stream Reassembly
Segments are reordered by sequence number and overlapping retransmissions resolved first-writer-wins. Gaps are marked, never quietly filled.
HTTP Transactions
Requests paired with their responses, read out of the reassembled streams. Only unencrypted HTTP/1.x is visible here - HTTPS bodies are ciphertext.
--
DNS Queries & Answers
Names requested and the records returned. Compressed labels are expanded; a name that failed to resolve is shown with its response code.
--
| Name | Type | Result | Status |
|---|
TLS Handshakes & JA3
The server name, ALPN and negotiated version travel in the clear before encryption starts. JA3 fingerprints the client's hello so the same software can be recognised across connections.
--
| Server name (SNI) | Destination | Version | ALPN | JA3 | JA4 |
|---|
Top Talkers
Who moved the most data, and which conversations carried it. A host near the top that you cannot account for is worth explaining.
Conversations
Endpoints
Cleartext Exposure
Credentials and session material visible to anyone on the path. Values are masked here - the finding is that a secret was exposed, not what it was.
--
Anomalies
Hosts that behave like scanners, and addresses claimed by more than one MAC. Both are leads worth explaining, never proof on their own.
--
Indicator watchlist
No watchlist ships with this tool - inventing "known-bad" fingerprints would be fiction dressed as threat intelligence. Paste your own, one entry per line, optionally prefixed with ja3: or ip:. Matching runs in your browser against the JA3/JA3S hashes and addresses already computed from your capture.
Carved Objects
Files and payloads reconstructed from HTTP response bodies. An object whose stream had gaps is marked incomplete - treat its contents accordingly.
--
Traffic Timeline
Packet rate over the capture window. Steady, evenly-spaced conversations are flagged below as possible automated beaconing.
Read the chart for shape, not absolute height: a flat line of small, regular bursts is far more interesting than one large spike.
Understanding Network Capture Forensics
What a Capture Actually Contains
A pcap or pcapng file is a log of frames as they appeared on a network interface, each stamped with the time it was seen. Every frame is a stack of layers - Ethernet carries IP, IP carries TCP or UDP, and those carry whatever the application was saying. This tool walks that stack for you, but it can only report what was captured: if the capture was taken with a small snaplen, each frame was cut short, and the payloads you see are incomplete through no fault of the analysis.
Why Reassembly Is the Hard Part
TCP does not promise that packets arrive in order, exactly once. Segments get reordered, retransmitted, and sometimes overlap with different contents. Reconstructing what the receiving application actually saw means sorting by sequence number - correctly, even when the counter wraps past four billion - and keeping the bytes that arrived first where a retransmission disagrees. Where a segment was never captured at all, this tool records a gap rather than closing it up, because a silently-joined stream is worse than an obviously incomplete one.
What TLS Still Reveals
Encryption hides the contents of a connection, not its existence. The opening handshake names the server the client asked for, the protocols it offered and the versions it supports - all before any key is agreed. A JA3 fingerprint hashes the exact shape of that hello, which tends to be characteristic of the client software rather than the user, so the same browser or the same malware family produces the same value across different connections. It identifies software, not people, and different programs can collide on one value.
100% Private, In-Browser
Parsing, reassembly, dissection and every statistic on this page run locally on your device. Your capture is never uploaded to a server. That matters more here than for most tools: a packet capture can contain credentials, session cookies, internal hostnames and the full contents of unencrypted traffic, so it is exactly the kind of file that should not be handed to a third party.
Indicators, Not Proof
Everything on this page describes what was observed on the wire, which is not the same as what happened. Regular, evenly-spaced connections look like automated beaconing, but so does a software update checker or a monitoring agent. A host at the top of the talkers list may be a backup job. A cleartext credential is a real finding, but a missing one proves nothing - it may simply have been sent in a part of the conversation that was never captured. Captures can also be incomplete or deliberately manipulated before you receive them. Treat every result here as a lead to investigate, corroborate it against logs and system state, and where the stakes are high, involve someone qualified rather than relying on a single automated read.
Key Takeaways
- Both formats are supported: legacy pcap and modern pcapng, in either byte order, with microsecond or nanosecond timestamps.
- Gaps are shown, not hidden: streams missing segments are marked, so an incomplete reconstruction is never presented as a complete one.
- Encrypted traffic stays encrypted: this tool reads what TLS exposes before encryption begins; it does not and cannot decrypt session contents.
- Nothing leaves your device: every parse and every analysis pass runs client-side in your browser.