What it decodes
Click any packet in the list to expand its layers and see the raw bytes. The reader understands the layers you meet most in a capture:
- Frame: Ethernet II (including 802.1Q VLAN tags), raw IPv4/IPv6, and Linux cooked captures.
- Network: IPv4 and IPv6 (addresses, TTL/hop limit, and the protocol inside).
- Transport: TCP (with flags such as SYN, ACK, FIN), UDP (with length), ICMP and ICMPv6.
- Also: ARP (who-has / is-at), and well-known ports named (443 → HTTPS, 53 → DNS, 22 → SSH…).
Anything it does not decode is still listed with its length and shown in the hex dump, so a packet is never hidden, just not broken down.
Learn to read what you see
Start with Wireshark basics and Reading packet captures, or decode one header field by field in the Packet Inspector.
Frequently asked questions
Is my capture uploaded anywhere?
No. It is read in your browser with the FileReader API and parsed locally. A capture can hold passwords and internal addresses, so nothing is sent to a server. It works offline and keeps no copy.
What file formats does it read?
Classic libpcap (.pcap / .cap) in every byte order and timestamp precision, and the newer .pcapng that Wireshark and tcpdump save by default. For anything else, export to .pcap.
Does this replace Wireshark?
No. It reads a capture, it does not take one, and it decodes the common layers rather than every protocol. It is for quickly reading a capture (yours or one someone sent you) without installing anything.