Open a capture, right in your browser
Parsed locally by a Rust→WebAssembly engine — your capture never leaves your device. Opens captures up to 256 MB.
- .pcap
- .pcapng
- .cap
About PCAP Analyzer
Loft PCAP Analyzer is a pcap viewer that runs in your browser. It opens .pcap and .pcapng captures with no Wireshark install and no upload. Filter packets with Wireshark-style expressions such as ip.addr == 10.0.0.5 && tcp.port == 443, click a packet to see its protocol tree and bytes, and follow a TCP or UDP stream. Conversations, hosts, a protocol breakdown, an IO graph and expert notes on retransmissions and resets help you find the problem. Export the filtered packets as .pcap, CSV or JSON.
What it does
- Opens .pcap and .pcapng captures, and .cap files saved in pcap format, up to 256 MB
- Wireshark-style display filters: ip.addr, ip.src, tcp.port, udp.port, tcp.flags.syn, dns.qry.name, http.host, frame contains, protocol names, and && || !
- Packet list, protocol tree and hex view, with the bytes of the selected field highlighted
- Decodes Ethernet, ARP, IPv4, IPv6, ICMP, TCP and UDP headers, DNS queries, HTTP requests and responses, and TLS handshakes with the server name (SNI)
- Labels common services such as SSH, QUIC, DHCP, NTP, SMTP and RDP by port, so you can filter on them
- Conversations, hosts and protocol tables; click a row to filter on it
- Follow a TCP or UDP stream, with client and server in different colours
- IO graph and expert notes on retransmissions, resets, zero windows and malformed packets
- Export the filtered packets as .pcap, or the packet list as CSV or JSON
- Parsed by a WebAssembly engine in your browser; the capture never leaves your device
How to use PCAP Analyzer
Open a capture
Drag a .pcap or .pcapng file onto the page, or click to choose one. It loads in your browser.
Filter the packets
Type a display filter such as tcp.port == 443 && http, or click a conversation or host to filter on it.
Inspect a packet
Click any packet to see its protocol tree and raw bytes. Select a TCP or UDP packet and choose Follow stream to read the whole conversation.
Analyze and export
Open the Analysis panel for conversations, hosts, protocols, the IO graph and expert notes, then export the filtered packets as .pcap, CSV or JSON.
Frequently asked questions
How do I open a pcap file online?
Drop it on this page. The viewer reads .pcap and .pcapng captures in your browser, so you can look at the packets, filter them and follow a stream with nothing to install.
Is my packet capture uploaded anywhere?
No. The whole tool runs in your browser through a local WebAssembly engine, so your capture never touches a server. Open your browser's DevTools Network tab and you will see it stay on the page. That matters because captures are full of internal IP addresses, hostnames and sometimes credentials.
Does it open pcapng and .cap files?
Yes. It opens classic .pcap, the newer .pcapng format that Wireshark saves by default, and .cap files that use the pcap format. Captures from tcpdump, Wireshark, dumpcap, firewalls and cloud traffic mirroring all work the same way.
Which protocols does it decode?
Full headers for Ethernet, ARP, IPv4, IPv6, ICMP, TCP and UDP, plus DNS queries, HTTP requests and responses, and TLS handshakes with the server name (SNI). Common services such as SSH, QUIC, DHCP, NTP, SMTP, IMAP, LDAP, RDP and SIP are labelled by port, so a filter like dhcp or ssh finds them.
Which display filters can I use?
A subset of Wireshark's syntax: ip.addr, ip.src, ip.dst, tcp.port, udp.port, eth.addr, frame.len, the tcp.flags fields, dns.qry.name, http.host, http.request, protocol names, and frame contains "text". Compare with ==, !=, <, >, <= or >=, and combine with && (and), || (or) and ! (not). The Reference panel has a filter cheat sheet.
How do I get a packet capture without Wireshark?
You often already have one, or can make one without installing anything. On Windows 10 and Server 2019 or later, pktmon is built in: run pktmon start --capture, reproduce the issue, run pktmon stop, then pktmon pcapng PktMon.etl -o cap.pcapng (older Windows 10 builds call it etl2pcap). On Linux and macOS, use tcpdump. Network gear, firewalls and cloud VPC traffic mirroring also export pcap or pcapng.
What is the largest capture I can open?
Up to 256 MB, a tested ceiling for a 32-bit WebAssembly engine that keeps the file and a packet index in memory. Larger captures are refused, so split them first, for example with editcap. The packet list scrolls smoothly on large captures, and a display filter narrows a busy one.
Can it decrypt TLS?
No. It shows the TLS handshake messages and the server name (SNI), which is often enough to tell which service an encrypted session went to. Decrypting the application data with a key log file is not available yet.
Do I still need Wireshark?
For deep work, yes. Desktop Wireshark is free, local, and has thousands of dissectors and live capture. This viewer covers the common protocols for quick, private triage when you can't or don't want to install software. There is no live capture; you bring the file.