Follow the connections. See the whole conversation.
Turn a packet capture into an interactive network map. Explore hosts, traffic and packet evidence, entirely on your device.
PCAP / PCAPNG · Up to 128 MiB · First 200,000 packets
No cloud, analytics, external lookups or background uploads.
CONNECTION MAP
Drag nodes to arrange · Drag background to pan · Scroll to zoom · Select a host for details. Lines aggregate traffic in both directions; thickness shows volume.
TRAFFIC TIMELINE
Drag the range handles to investigate a time window. Packets without timestamps appear only in the full-capture view. Bar height represents wire bytes.
PROTOCOL MIX
CAPTURE OBSERVATIONS
Observations describe the visible capture. Missing replies may be outside the capture; these are not malware verdicts.
Hex preview shows the first 2,048 captured bytes. Payload is displayed as inert text.
Files are read locally in a background worker. No packet data, hostnames or addresses leave this tab. There are no remote scripts, DNS lookups, geolocation requests or analytics. Closing the capture releases its data; nothing is saved in browser storage.
Reads classic PCAP and multi-interface PCAPNG: Ethernet with VLANs, raw IP, loopback, Linux SLL/SLL2; IPv4, IPv6, TCP, UDP, ICMP and ARP. DNS answers, HTTP Host and TLS SNI are extracted when complete in a packet. No TCP/IP reassembly or decryption. Conversations group the same protocol and endpoint pair across the capture; they are not separate TCP sessions.
Download the standalone HTML app before disconnecting. Open it directly in a modern browser, including from a USB drive. All code and styles are inside the file. Analysis works without a server or an internet connection.