TCP Viewer Features
TCP Viewer brings the most common packet-analysis tasks into a focused native Mac app. Choose a workflow below.
Capture, filter, and inspect packets in the native Mac workspace.
1. Choose a TCP Viewer workflow
| Feature | Use it when you need to… |
|---|---|
| Live packet capture | Watch new TCP and UDP traffic from a Mac network interface. |
| Open capture files | Inspect PCAP, PCAPNG, or TCP Viewer session files. |
| Capture overview | Check traffic totals, protocols, top apps, domains, and IP addresses. |
| Endpoints | Compare packet and byte totals by app, domain, address, or port. |
| Group traffic | Find packets from one app, domain, IP address, or imported file. |
| Filter packets | Narrow a large packet list by protocol or exact field rules. |
| Wireshark display filters | Use Wireshark syntax to search protocol fields, addresses, ports, and packet content. |
| Follow TCP and UDP streams | Reassemble a TCP conversation or inspect a UDP flow, separate its directions, and return to source packets. |
| Packet inspection | Read decoded protocols, field values, and raw bytes. |
| Organize and customize | Pin sources, save packets, add comments or colors, and change columns. |
| Save, copy, and export | Share selected packets, a full capture, or readable table data. |
| TCP Viewer MCP | Let Codex, Claude Code, or another MCP client inspect and control TCP Viewer. |
| Command line | Control TCP Viewer from Terminal, scripts, and other apps with tcpviewer-cli. |
If this is your first time using the app, start with the Overview and Live packet capture.