PCAP Viewer

About

PCAP Viewer turns your iPad into a network protocol analyzer. Open a pcap or pcapng file received by email, AirDrop or Files and explore it as on your desktop: a colorized packet list, a detail tree and a hex dump, all linked together. Available in English and French. EVERYTHING YOU NEED TO TROUBLESHOOT • Packet list with sortable columns, rule-based coloring and custom columns • Field-by-field details; tap a field to highlight its bytes, tap a byte to find its field • 40+ protocols: Ethernet, VLAN, ARP, IPv4/IPv6, ICMP, TCP, UDP, DNS, DHCP, HTTP, TLS (SNI, certificates), SIP/SDP, RTP/RTCP, DTMF, NTP, QUIC, STUN, LLDP, STP… • TCP analysis: relative sequence numbers, retransmissions, duplicate ACKs, zero window • TCP reassembly (HTTP, TLS, SIP) and IPv4 defragmentation DISPLAY FILTERS • Familiar syntax: ip.addr == 10.0.0.0/8 && tcp.port in {80 443} • contains, matches, slices eth.src[0:3], functions len(), count(), lower()…, layers ip.addr#2 • Live validation, field completion, history and saved filters • "Apply as filter" and "Apply as column" on any field VOICE OVER IP • SIP call list with call state • SIP and RTP flow (ladder) diagram • RTP streams: loss, jitter, delta, DTMF and G.711 playback STATISTICS AND TOOLS • Protocol hierarchy, conversations, endpoints, I/O graph, expert info • Follow TCP or UDP stream • Find packet, go to packet, marks and time reference • "Decode As…", editable coloring rules, import of filter and coloring files • Export displayed or marked packets as pcap / pcapng PRIVACY Your captures stay on your iPad. The app collects no data and never connects to a server. Sample captures are included to get started.