Easy packet capture
Simple, but powerful. Choose an interface, start recording, and keep packet capture calm even when the network is busy.
TCP Viewer vs mitmproxy
TCP Viewer vs mitmproxy: packets or intercepted flows?
TCP Viewer captures and decodes packets. mitmproxy intercepts and changes application traffic. Compare which workflow fits the problem you are debugging.
Download TCP Viewer for MacOnly Apple Silicon - macOS 15+
Side-by-side
Compare TCP Viewer and mitmproxy
These tools overlap in network debugging, but they operate at different layers and are often useful together.
Area
TCP Viewer
mitmproxy
Native macOS
TCP Viewer
Designed and built for macOS 26, with a Mac-first look and feel that is easy to use every day.
mitmproxy
Offers console, command-line, and browser-based interfaces. Local Capture supports macOS, but the UI is not a native Mac app.
Capture all interfaces
TCP Viewer
Capture activity across all available network interfaces in one place, so important traffic is less likely to be missed.
mitmproxy
Supports regular proxy, Local Capture, WireGuard, and other modes. Traffic is routed through mitmproxy instead of recorded as network frames.
Detailed packets
TCP Viewer
Built on top of Wireshark, so you get familiar, Wireshark-grade packet details in a native Mac app.
mitmproxy
Focuses on interceptable flows and request or response content, not a Wireshark-style protocol tree for every packet.
Display by apps / domains
TCP Viewer
Groups traffic by app and domain, turning a busy capture into clearer conversations to scan.
mitmproxy
Organizes intercepted flows by host. Its view is request and response oriented rather than a packet list grouped by application.
Advanced filters
TCP Viewer
Build focused multi-rule filters in a clear form, so everyday checks do not require complex filter syntax.
mitmproxy
Uses powerful flow filter expressions for intercepted traffic.
TCP Viewer MCP
TCP Viewer
Connect Codex or another MCP client to check capture status, explore interfaces, and find packets with a plain-language request. Available with TCP Viewer PRO.
mitmproxy
The core mitmproxy tools do not include a built-in MCP server.
Choose by workflow
Packet visibility or request interception?
Start with the layer you need to inspect. Packet capture and HTTP interception solve different problems.
Choose TCP Viewer when you need
- Seeing packet-level TCP, UDP, DNS, TLS, and other protocol activity.
- Inspecting traffic without installing a trusted interception certificate.
- Opening, filtering, and exporting standard PCAP or PCAPNG files.
- Grouping a Mac's packet activity by application or domain.
Choose mitmproxy when you need
- Reading decrypted HTTP and HTTPS requests and responses.
- Changing headers or bodies, mapping content, and replaying flows.
- Automating application-layer traffic changes with Python.
- Capturing through regular proxy, Local Capture, WireGuard, or reverse proxy modes.
They can work together
Use mitmproxy when you need readable or editable application data. Use TCP Viewer beside it when you need the packet path, handshakes, retransmissions, DNS, or traffic that is not represented as an HTTP flow.
Official sources checked for this comparison
Powered by Wireshark
See packet details like Wireshark
TCP Viewer is built on Wireshark's packet analysis engine. Explore decoded protocols, field values, and raw bytes in a native Mac interface.
- Expand the protocol tree to inspect each layer of a packet.
- Select a field to highlight its matching bytes in the hex view.
- Search and copy details from live captures or saved PCAP files.
TCP Viewer is distributed under GPL v2 or later, in line with Wireshark's license. See the open-source acknowledgements.
TCP Viewer MCP
Ask your AI agent about the packets
Connect TCP Viewer to Codex or another MCP client. Check capture status, explore interfaces, and find the packets that matter with a plain-language prompt.
Available with TCP Viewer PRO.
Saved captures
Open PCAP and PCAPNG files by drag and drop
Bring an existing capture into TCP Viewer and preview the packets right away, with no fresh recording session required.
Drag in a trace
Drop PCAP or PCAPNG files straight onto TCP Viewer.
Preview immediately
Open the packet list and decoded detail view without a live capture.
Keep the workflow native
Review saved evidence in the same Mac-first packet interface.
Drop capture.pcapng to preview
Follow TCP Stream
Read the whole TCP conversation
Get the familiar Wireshark Follow TCP workflow in a focused, Mac-native window—reassembled, direction-aware, and easy to trace back to the source packets.
- Reassemble one TCP conversation instead of reading payloads packet by packet.
- Keep both directions together, or isolate Client → Server and Server → Client.
- Switch between readable text and exact hex bytes without leaving the stream.
- Search the transcript, count matches, and move to the previous or next result.
- Reveal a transcript record in the packet table, then inspect its matching bytes.
Inspect without the clutter
Whatever you capture, TCP Viewer keeps the important traffic readable. Filter noise, open decoded fields, and save evidence for the next debug session.
Grouped traffic
Group packets by domain or client
Collapse busy captures into readable conversations by domain or client, then jump straight to the traffic that matters.
Protocol filters
Quickly filter TCP, UDP, DNS, and more
Tap protocol chips to focus the packet list without rebuilding a complex filter every time the capture changes.
Export captures
Save evidence as PCAP or PCAPNG
Package the exact packets you need into standard capture files for Wireshark, teammates, or the next debug session.
Export selected packets
Capture range
AllFilteredSelected
Packets1,284
Duration02:16
ProtocolsTCP, DNS, TLS
File format
.pcapngFull metadata.pcapClassic format
Filename
filtered-capture.pcapng
Packet detail
Read Wireshark-grade packet data
Open decoded fields, protocol trees, byte ranges, and field values with Wireshark-grade depth in a focused Mac interface.
Open source
TCP Viewer is open source.
Read the source, build the app yourself, or contribute on GitHub. TCP Viewer uses the GPL v2 or later license.
GPL v2 or laterPublic GitHub repoContributions welcome