Skip to main content

Live Packet Capture on macOS

Live capture watches packets as they pass through a network interface on your Mac. It is useful when you need to reproduce a network problem and see the traffic at the same time.

TCP Viewer uses the system libpcap capture API. A small privileged Helper Tool grants access to macOS BPF capture devices, so the main app does not need to run as root.

Watch TCP Viewer collect traffic and update the packet workspace.

1. Benefits​

  • ✅ Watch TCP and UDP packets while an app is running.
  • ✅ Choose the exact interface, such as Wi-Fi, Ethernet, or a local interface.
  • ✅ Pause and resume without losing the current packet list.
  • ✅ See current packet counts, memory use, and upload/download speed.
  • ✅ Group new traffic by app, domain, and IP address as it arrives.
  • ✅ Export the full capture or only the packets you select.

2. Install the Helper Tool​

TCP Viewer asks to install the Helper Tool before the first live capture.

  1. Select Install Helper Tool.
  2. Approve the macOS request.
  3. If macOS asks for background-item approval, open System Settings and allow TCP Viewer.
  4. Relaunch the app when prompted.

The helper only maintains packet-capture access. It does not inspect, store, or upload network traffic. You can manage it later in TCP Viewer Settings → Helper Tool. If its status is broken, select Repair Helper.

3. Start and control a capture​

  1. Open TCP Viewer.
  2. Choose an interface from the menu near the left side of the toolbar. The active interface is marked in the list.
  3. Select Start on the Getting Started screen, or use the capture button in the toolbar.
  4. Reproduce the activity you want to inspect.
  5. Use the capture button to pause, resume, or stop.

The selected interface is locked while the capture is active. Stop the capture before switching to another interface.

Select Clear or press Command-K to remove all packets from the current window. Export anything you need before clearing it.

4. Choose the right interface​

Start with the interface that currently carries your traffic:

  • Wi-Fi for normal wireless internet traffic.
  • Ethernet for a wired connection.
  • Loopback for services talking only inside the Mac.
  • A VPN or virtual interface when the target app routes traffic through it.

If no packets appear, try another active interface. Also check that a VPN, virtual machine, or security tool is not moving the traffic to a different interface.

5. Keep captures safe​

Packet captures may contain host names, IP addresses, cookies, authorization values, or application data. Stop the capture when you have enough evidence. Review the packets before sharing a file or including it in a public issue.