One frame table underneath. Edit a byte and every view updates.
Every edit is undoable and checked.
Type into any offset, or cut, copy and paste ranges as hex, text or a C array.
Recomputes lengths and checksums after every edit, padding included.
Undo a whole batch in one step, or revert every changed frame at once.
Annotate a byte range or a frame. Exports keep them.
From a guided form to a batch run across a whole capture.
TCP, UDP, DNS, ICMP, ARP and HTTP from real fields, with checksums done for you.
Expressions, series, mutation and fuzzing, and ready-made multi-frame scenarios.
XOR, add a template, rewrite addresses or recalculate seq/ack across many frames.
Save custom layouts and crafted frames. Reuse them in any capture.
The views you expect, next to the frame table.
From a keylog or PcapNG secrets, with certificate extraction and search.
Protocol hierarchy, hosts and ports, and a graph that selects frames on click.
Loss, reordering and jitter per stream.
Autocomplete, presets and fields like http.status and frame.cap_len.
Every distinct value of a field, counted and traced to its frames.
Find byte patterns across the whole capture.
Pick up where you left off.
Save frames, templates, rules and filters as one file. Restore it later.
Saved table views and rules, with a live preview as you tune a color.
Byte diff of up to five frames. Export as HTML, Markdown or unified diff.
Multi-gigabyte files without a frozen window.
Indexes the file and loads only the range or filter you pick.
Writes filtered output straight to disk in chunks.
Watches a growing capture and offers its new frames.
The whole capture, only your edits, or a filtered slice.
.pcap and PcapNGWith embedded TLS secrets and custom metadata.
A color-tinted frame list you can share without the capture.
Lossless, diffable, with notes and comments.
Templates, presets and rules in one portable file.
Change what a frame is, or bring in what was never a pcap.
Convert a stream either way. Seq/ack and checksums are rebuilt.
Stateless NAT64 translation through a configurable /96 prefix.
Sessions arrive as real, editable TCP and HTTP frames.
A saved MAC, IP and port preset, applied to every frame in scope.
Set a time exactly or shift by an offset, per frame or for the whole capture.
See nine scenarios, start to finish.
Read the scenarios
All Rights Reserved © Netomize