Packet capture for macOS

TCP Viewer.A TShark alternative for Mac.

Explore your capture in a Mac app, with familiar Wireshark filters. TCP Viewer puts packet fields, raw bytes, and TCP conversations within a click.

Download TCP Viewer Explore the features

Apple Silicon · macOS 15+

What changes with TCP Viewer

Explore packets in a visual list with decoded fields and linked bytes.
Paste familiar Wireshark display filters into the app.
Group live traffic by app or domain before inspecting individual packets.
Use the bundled CLI to control the Mac app and return JSON to scripts.

See supported display filters

TShark is a terminal tool for capture, field extraction, and scripted analysis. TCP Viewer suits interactive work on Mac. Its CLI controls the desktop app, so keep TShark for jobs that need a standalone terminal analyzer. TShark manual

Easy packet capture

Simple, but powerful. Choose an interface, start recording, and keep packet capture calm even when the network is busy.

See packet details like Wireshark

TCP Viewer is built on Wireshark's packet analysis engine. Explore decoded protocols, field values, and raw bytes in a native Mac interface.

Expand the protocol tree to inspect each layer of a packet.
Select a field to highlight its matching bytes in the hex view.
Search and copy details from live captures or saved PCAP files.

Explore packet inspection

TCP Viewer is distributed under GPL v2 or later, in line with Wireshark's license. See the open-source acknowledgements.

TCP Viewer MCP

Ask your AI agent about the packets

Connect TCP Viewer to Codex or another MCP client. Check capture status, explore interfaces, and find the packets that matter with a plain-language prompt.

Available with TCP Viewer PRO.

Codex querying TCP Viewer MCP for capture status, interfaces, and matching packets

Saved captures

Open PCAP and PCAPNG files by drag and drop

Bring an existing capture into TCP Viewer and preview the packets right away, with no fresh recording session required.

Drag in a trace

Drop PCAP or PCAPNG files straight onto TCP Viewer.

Preview immediately

Open the packet list and decoded detail view without a live capture.

Keep the workflow native

Review saved evidence in the same Mac-first packet interface.

Drop capture.pcapng to preview

Follow TCP Stream

Read the whole TCP conversation

Get the familiar Wireshark Follow TCP workflow in a focused, Mac-native window—reassembled, direction-aware, and easy to trace back to the source packets.

Reassemble one TCP conversation instead of reading payloads packet by packet.
Keep both directions together, or isolate Client → Server and Server → Client.
Switch between readable text and exact hex bytes without leaving the stream.
Search the transcript, count matches, and move to the previous or next result.
Reveal a transcript record in the packet table, then inspect its matching bytes.

Learn how to follow a stream

Inspect without the clutter

Whatever you capture, TCP Viewer keeps the important traffic readable. Filter noise, open decoded fields, and save evidence for the next debug session.

Grouped traffic

Group packets by domain or client

Collapse busy captures into readable conversations by domain or client, then jump straight to the traffic that matters.

Protocol filters

Quickly filter TCP, UDP, DNS, and more

Tap protocol chips to focus the packet list without rebuilding a complex filter every time the capture changes.

Export captures

Save evidence as PCAP or PCAPNG

Package the exact packets you need into standard capture files for Wireshark, teammates, or the next debug session.

Export selected packets

Capture range

AllFilteredSelected

Packets1,284

Duration02:16

ProtocolsTCP, DNS, TLS

File format

.pcapngFull metadata.pcapClassic format

Filename

filtered-capture.pcapng

Export capture

Packet detail

Read Wireshark-grade packet data

Open decoded fields, protocol trees, byte ranges, and field values with Wireshark-grade depth in a focused Mac interface.

Capture overview

See the whole capture at a glance

Overview puts packet totals, traffic over time, protocol use, and the top apps and destinations on one screen.

Check the main totals. See the capture duration, packet count, and sent and received data.
Spot busy moments. Use the traffic chart to see when upload or download activity changed.
Find busy apps and destinations. Rank apps, domains, and IP addresses by total traffic.
Check protocol use. See which protocols used the most data in the capture.
Open the packets behind a result. Select a top row, return to the packet list, or open Endpoints.

Learn about Capture overview

TCP Viewer command line

Capture and inspect packets from Terminal

Start a capture, query matching traffic, follow TCP streams, and export PCAP files from a shell script.

Run captures from scripts. Start, pause, resume, or stop a capture with the same commands every time.
Query the exact traffic. Filter by protocol, domain, address, port, app, stream, or decoded field.
Handle results in scripts. Parse stable JSON and use exit codes to stop a failed script.
Export standard files. Export all or matching packets as PCAP or PCAPNG for another tool or teammate.

Read the command-line guide

Included with TCP Viewer. Normal CLI commands do not require PRO.

tcpviewer-cli / Terminal

$ CLI="/Applications/TCP Viewer.app/Contents/MacOS/tcpviewer-cli"$ "$CLI" capture start --interface en0 --bpf 'tcp port 443'{
  "schema_version": 1,
  "request_id": "7f3e2b1c-45a6-4789-b012-3456789abcde",
  "ok": true,
  "command": "capture.start",
  "data": {
    "action": "start_capture",
    "bpf_capture_filter_action": "set",
    "completed": true,
    "previous_packets_cleared": true
  }
}$ "$CLI" packets list --protocol TLS --client Safari --limit 3 --pretty

Wireshark display filters

Use the filters you already know

Paste a Wireshark display filter into TCP Viewer. It shows the packets that match and does not change your capture.

Try this filter

tcp.port == 443 and ip.addr == 192.168.1.10

Shows port 443 traffic for one IP address.

Find exact traffic. Match a protocol, address, port, stream, or packet field.
Fix a typo fast. TCP Viewer selects the part of a filter that needs work.
Keep every packet. Clear the filter and every hidden packet comes back.

See filter examples

Wireshark display filter demo

Wireshark filter

tcp.port == 443 and ip.addr == 192.168.1.10Apply

3 matching packets

1824TLSClient Hello, server name: api.example.com

1823TCP443 → 53142 [ACK]

1818TLSApplication Data

Demo video coming soon

Open source

TCP Viewer is open source.

Read the source, build the app yourself, or contribute on GitHub. TCP Viewer uses the GPL v2 or later license.

View source on GitHub Read the GPL license

GPL v2 or laterPublic GitHub repoContributions welcome

Why choose TCP Viewer?

A native packet viewer from the team behind Proxyman.

Network development

6+ years

The Proxyman Team has spent more than six years building network debugging tools.

Proxyman users

800,000+

Developers worldwide use Proxyman, built by the same team as TCP Viewer.

Open source

GPL v2+

Read the source, build the app, or contribute on GitHub.

Built for macOS

Native

Made for Apple Silicon Macs running macOS 15 or later.

Network products

Proxyman, Tiny Shield, and TCP Viewer come from the same team.

Get started

Inspect network traffic with TCP Viewer

Download the app and see if it fits your packet workflow.

Download TCP Viewer View pricing