Read a Packet Capture Without Uploading It
Drop in a .pcap or .pcapng and see who talked to whom, what they asked for, and what went across in the clear. The file is read in this tab and never leaves your machine.
The capture
Drop a .pcap or .pcapng here
or click to choose one
Read inside this tab by your own browser. It is not uploaded, and once this page has loaded it works with the network off.
What is in it
What stood out
Who talked to whom
Every address, by how much it moved
What was asked for
The mix
How it reads a capture
- The file. pcap in all four of its magic numbers, big-endian and little, microseconds and nanoseconds; and pcapng, with the per-section byte order and the per-interface timestamp resolution both honoured. A file cut short mid-packet is read up to the cut and says so.
- The packet. Ethernet with any depth of VLAN tag, Linux cooked capture v1 and v2, raw IP and BSD loopback; then IPv4 or IPv6 with its extension header chain walked; then TCP, UDP or ICMP. A header that runs off the end of the captured bytes is the normal case when a snap length was set, and is handled rather than thrown on.
- What it says it is. DNS questions and answers, including the name compression pointers, with a budget so a message that points at itself cannot loop. HTTP request lines and headers, only where the version marker is really on the first line. The server name from a TLS client hello, walked field by field rather than searched for.
- What stood out. Credentials that crossed in the clear. Flows whose connection attempts are too regular to be a person. Protocols that carry their traffic readably. Names that were looked up and do not exist.
- What it will not do. It does not reassemble TCP streams, so a request split across segments is not read. It does not decrypt anything. It is not Wireshark and will not replace it - it answers the first ten minutes of questions, on a machine where you cannot install one and must not upload the file.
Questions people ask about WIRE