PCAP Analyzer reads packet capture files (pcap and pcapng) of up to 50 MB directly in your browser and turns them into clear findings: what protocols were used, who talked to whom, which ports and services appear, which DNS queries and HTTP or TLS hosts show up — and which packets deserve a closer security look.
Drag a file onto the upload box or click it to open the file picker. Files up to 50 MB are supported, in .pcap, .pcapng or .cap format. The file is read with your browser and analyzed locally; it is never transmitted anywhere.
After the analysis the dashboard shows the packet count, the byte volume, the duration of the capture and the average packets and bits per second. A protocol mix breaks the traffic down into Ethernet, IPv4/IPv6, ARP, TCP, UDP, ICMP, DNS, HTTP, TLS and the other application layers found in the file.
Top talkers lists the hosts that send or receive the most traffic, Conversations shows the busiest host-to-host connections and Ports & services collects the TCP and UDP ports seen, with the service they usually run and how many connections used them.
The DNS section shows the queries found in the capture (names, record types and responses), HTTP lists the hosts, request methods and URIs seen on port 80 and TLS collects the server names (SNI) and protocol versions from TLS handshakes.
The Findings section explains what stands out: cleartext passwords and usernames (HTTP Basic Auth, FTP, SMTP, POP3, IMAP, Telnet), unencrypted protocols and plain-text DNS, risky or unusual ports (Telnet, SMB, RDP, VNC, NetBIOS), possible port or host scanning, a high share of retransmissions, truncated or malformed packets, broadcast or ARP request storms and cases where several hosts announce the same IP address. Every finding has a status PASS, WARN, FAIL or INFO.
All parsing runs in your browser; the file is never uploaded to a server. The analyzer currently decodes the most common link types (Ethernet, VLAN and Linux cooked) and protocols. Captures using other link types, encrypted application payloads or uncommon protocols are shown in the overview but not dissected. The results are advisory and not a substitute for a deeper packet analysis.