Easy packet capture
Simple, but powerful. Choose an interface, start recording, and keep packet capture calm even when the network is busy.
TCP Viewer
Native Packet Viewer for Mac
A simpler, Mac-native Wireshark alternative
Only Apple Silicon - macOS 15+
Explore TCP Viewer vs Wireshark and TCP Viewer vs mitmproxy.
Built by the Proxyman Team for network debugging on Mac
TCP Viewer MCP
Ask your AI agent about the packets
Connect TCP Viewer to Codex or another MCP client. Check capture status, explore interfaces, and find the packets that matter with a plain-language prompt.
Available with TCP Viewer PRO.
Saved captures
Open PCAP and PCAPNG files by drag and drop
Bring an existing capture into TCP Viewer and preview the packets right away, with no fresh recording session required.
Drag in a trace
Drop PCAP or PCAPNG files straight onto TCP Viewer.
Preview immediately
Open the packet list and decoded detail view without a live capture.
Keep the workflow native
Review saved evidence in the same Mac-first packet interface.
Drop capture.pcapng to preview
Follow TCP Stream
Read the whole TCP conversation
Get the familiar Wireshark Follow TCP workflow in a focused, Mac-native window—reassembled, direction-aware, and easy to trace back to the source packets.
- Reassemble one TCP conversation instead of reading payloads packet by packet.
- Keep both directions together, or isolate Client → Server and Server → Client.
- Switch between readable text and exact hex bytes without leaving the stream.
- Search the transcript, count matches, and move to the previous or next result.
- Reveal a transcript record in the packet table, then inspect its matching bytes.
Inspect without the clutter
Whatever you capture, TCP Viewer keeps the important traffic readable. Filter noise, open decoded fields, and save evidence for the next debug session.
Grouped traffic
Group packets by domain or client
Collapse busy captures into readable conversations by domain or client, then jump straight to the traffic that matters.
Protocol filters
Quickly filter TCP, UDP, DNS, and more
Tap protocol chips to focus the packet list without rebuilding a complex filter every time the capture changes.
Export captures
Save evidence as PCAP or PCAPNG
Package the exact packets you need into standard capture files for Wireshark, teammates, or the next debug session.
Export selected packets
Capture range
AllFilteredSelected
Packets1,284
Duration02:16
ProtocolsTCP, DNS, TLS
File format
.pcapngFull metadata.pcapClassic format
Filename
filtered-capture.pcapng
Packet detail
Read Wireshark-grade packet data
Open decoded fields, protocol trees, byte ranges, and field values with Wireshark-grade depth in a focused Mac interface.
TCP Viewer command line
Capture and inspect packets from Terminal
Start a capture, query matching traffic, follow TCP streams, and export PCAP files from a shell script.
- Run captures from scripts. Start, pause, resume, or stop a capture with the same commands every time.
- Query the exact traffic. Filter by protocol, domain, address, port, app, stream, or decoded field.
- Handle results in scripts. Parse stable JSON and use exit codes to stop a failed script.
- Export standard files. Export all or matching packets as PCAP or PCAPNG for another tool or teammate.
Read the command-line guide
Included with TCP Viewer. Normal CLI commands do not require PRO.
tcpviewer-cli / Terminal
$ CLI="/Applications/TCP Viewer.app/Contents/MacOS/tcpviewer-cli"$ "$CLI" capture start --interface en0 --bpf 'tcp port 443'{
"schema_version": 1,
"request_id": "7f3e2b1c-45a6-4789-b012-3456789abcde",
"ok": true,
"command": "capture.start",
"data": {
"action": "start_capture",
"bpf_capture_filter_action": "set",
"completed": true,
"previous_packets_cleared": true
}
}$ "$CLI" packets list --protocol TLS --client Safari --limit 3 --prettyWireshark display filters
Use the filters you already know
Paste a Wireshark display filter into TCP Viewer. It shows the packets that match and does not change your capture.
Try this filter
tcp.port == 443 and ip.addr == 192.168.1.10Shows port 443 traffic for one IP address.
- Find exact traffic. Match a protocol, address, port, stream, or packet field.
- Fix a typo fast. TCP Viewer selects the part of a filter that needs work.
- Keep every packet. Clear the filter and every hidden packet comes back.
Wireshark display filter demo
Wireshark filter
tcp.port == 443 and ip.addr == 192.168.1.10Apply3 matching packets
1824TLSClient Hello, server name: api.example.com
1823TCP443 → 53142 [ACK]
1818TLSApplication Data
Open source
TCP Viewer is open source.
Read the source, build the app yourself, or contribute on GitHub. TCP Viewer uses the GPL v2 or later license.
GPL v2 or laterPublic GitHub repoContributions welcome
Why choose TCP Viewer?
A native packet viewer from the team behind Proxyman.
Network development
6+ years
The Proxyman Team has spent more than six years building network debugging tools.
Proxyman users
800,000+
Developers worldwide use Proxyman, built by the same team as TCP Viewer.
Open source
GPL v2+
Read the source, build the app, or contribute on GitHub.
Built for macOS
Native
Made for Apple Silicon Macs running macOS 15 or later.
Network products
3
Proxyman, Tiny Shield, and TCP Viewer come from the same team.
Get started
Inspect network traffic with TCP Viewer
Download the app and see if it fits your packet workflow.