Skip to main content

Open PCAP and PCAPNG Files on macOS

TCP Viewer can inspect a saved capture without starting a live capture. Use this workflow for a packet trace from a teammate, a test run, another packet tool, or an earlier TCP Viewer session.

Drag a PCAP or PCAPNG file into TCP Viewer and browse it from the Files group.

1. Supported files​

FileBest use
.pcapA widely supported capture format for sharing packet data.
.pcapngA newer capture format that can hold richer capture metadata.
.tcpviewsessionA TCP Viewer session that keeps app-specific workspace data.

2. Benefits​

  • ✅ Review a capture without installing the live-capture Helper Tool.
  • ✅ Use the same sidebar, packet table, filters, and inspector as a live capture.
  • ✅ Open files from Finder or by drag and drop.
  • ✅ Keep multiple capture files visible under the Files section.
  • ✅ Export a smaller set of packets for another person or tool.
  • ✅ Return to saved TCP Viewer work with session files.

3. Open a file​

Choose any of these methods:

  • Double-click a supported file in Finder.
  • Drag a file onto the TCP Viewer app or its window.
  • In TCP Viewer, choose File → Open… and select a file.

TCP Viewer reads the file and adds it under Files in the sidebar. Large files may take time to load. Progress appears in the window, and you can cancel the load if you chose the wrong file.

4. Inspect one part of an imported file​

  1. Expand Files in the sidebar.
  2. Select the imported file to see all its packets.
  3. Expand its Apps or Domains groups when that metadata is available.
  4. Select an app, domain, or IP address to narrow the packet table.
  5. Select a packet to open the protocol tree and raw bytes.

Some saved captures do not contain enough process information to identify the original Mac app. Domain names may come from DNS answers or TLS metadata. When that evidence is not present, TCP Viewer still shows packet addresses and protocol details.

5. Save a reusable TCP Viewer session​

Use the Share menu in the toolbar and choose Export Session. A .tcpviewsession file is useful when you want to continue the same review in TCP Viewer, including supported packet comments and colors.

Use PCAP or PCAPNG when compatibility with Wireshark or another packet tool is more important. You can export the whole loaded set or right-click selected packets and export only those rows.