What is an online PCAP analyzer?

An online PCAP analyzer is a browser-based tool that accepts packet capture files and decodes network traffic without installing desktop software. PCAP (Packet Capture) files record raw frames from network interfaces — typically saved as .pcap or .pcapng by Wireshark, tcpdump, or cloud mirroring products. The analyzer parses each frame through protocol dissectors aligned with the OSI model: Ethernet and ARP at Layer 2, IP at Layer 3, TCP and UDP at Layer 4, and application protocols like HTTP, DNS, and TLS at Layer 7. ScanSuite's online PCAP analyzer targets analysts who need fast triage on small captures during incident response, developer debugging, or classroom exercises — especially on workstations where Wireshark installation is restricted by corporate policy.

How is this different from Wireshark?

Wireshark is the industry-standard desktop packet analyzer with live capture, over three thousand protocol dissectors, display filters, decryption support via key log files, and scripting through Lua and tshark. ScanSuite's online analyzer is a lightweight Wireshark alternative focused on upload-based analysis of existing captures. You cannot capture live traffic from your network interface in the browser, and advanced dissectors for proprietary or niche protocols are not available. However, for common triage tasks — reading HTTP headers, listing DNS queries, inspecting TLS cipher suites and SNI values, and reviewing ARP tables — the browser tool delivers results in seconds without installation. Many analysts use ScanSuite for initial review and open the same file in Wireshark when deep inspection is required.

What file formats does the analyzer support?

ScanSuite accepts standard libpcap .pcap files and PCAP Next Generation .pcapng files. PCAP is the legacy format produced by tcpdump -w and older Wireshark versions. PCAPNG adds section headers, interface metadata, comments, and enhanced timestamp resolution — it is the default save format in modern Wireshark releases. Files captured on Linux with tcpdump, on macOS with Wireshark, or exported from cloud VPC flow log converters are typically compatible. Exotic formats such as Sniffer, NetMon, or ERFCAP must be converted with Wireshark or editcap before upload. If a file fails to parse, verify it opens correctly in Wireshark locally and that the extension matches the actual container format.

What is the free tier upload size limit?

The free tier accepts PCAP and PCAPNG files up to 10 megabytes per upload. This limit covers most single-session diagnostic captures — for example, a filtered tcpdump of one host and port during a failed API call, or a short Wireshark recording focused on DNS resolution. Captures from full-port SPAN mirrors or multi-hour recordings often exceed 10 MB and require trimming before upload or a Premium subscription for larger files. Use capture filters in Wireshark or tcpdump to reduce file size: tcpdump -w small.pcap host target.example.com and port 443 records only relevant traffic. Ring-buffer captures with editcap can split large files into analyzable segments without losing the critical frames.

How long does ScanSuite keep uploaded capture files?

ScanSuite automatically deletes uploaded PCAP and PCAPNG files within 24 hours of upload. This retention policy applies to both free and Premium tiers and exists to minimize exposure of sensitive network traffic on shared infrastructure. PCAP files frequently contain credentials in cleartext HTTP, session cookies, internal IP addresses, hostnames, and occasionally personal data from user-generated content. The 24-hour window allows you to complete triage, document findings, and share conclusions with your team while ensuring captures do not persist indefinitely on third-party servers. If your organization requires immediate deletion, contact ScanSuite support for enterprise options. Always retain local copies on encrypted storage if long-term evidence preservation is required for compliance or legal hold.

Can the analyzer decode HTTP and HTTPS traffic?

The analyzer decodes HTTP traffic in cleartext — request methods, Host headers, paths, status codes, and headers like User-Agent and Content-Type. HTTPS on port 443 encrypts application data with TLS, so HTTP bodies are not visible without decryption keys. TLS handshake records remain readable: ClientHello and ServerHello expose protocol version, cipher suites, extensions, and Server Name Indication (SNI), revealing the intended hostname on shared CDN IPs. Certificate subject, issuer, and validity dates from the ServerHello chain are also visible. Supply a compatible SSLKEYLOGFILE to decrypt HTTPS payloads when your tier supports session key import.

How does DNS analysis work in a PCAP file?

DNS traffic typically uses UDP port 53 and TCP port 53 for large responses. The analyzer extracts transaction IDs, query types, queried names, and answer, authority, and additional records. Supported types include A, AAAA, CNAME, MX, TXT, NS, PTR, and SOA — the same records our DNS lookup tool queries, but observed on the wire during capture. This helps diagnose split-horizon failures, DNS tunneling with long subdomain labels, DGA domains in malware callbacks, and resolver mismatches with application errors. Compare PCAP-derived answers against live lookups to detect stale caching or hijacked resolvers during incident timelines.

What SSL and TLS information can I inspect?

SSL and TLS analysis focuses on cleartext handshake metadata before application encryption. For each session, the analyzer reports protocol version (TLS 1.2, TLS 1.3, or legacy SSL), negotiated cipher suite, key exchange, and certificate chain details including subject, issuer, and validity. ClientHello SNI identifies the target hostname when virtual hosts share one IP. Alert messages surface certificate failures, downgrade attempts, and abrupt termination — useful for mTLS troubleshooting and browser warning diagnosis. Combine findings with our SSL checker to verify whether live certificates match those in historical captures during incident response.

Why would I analyze ARP traffic in a capture?

ARP (Address Resolution Protocol) operates at OSI Layer 2, mapping IPv4 addresses to MAC addresses on local Ethernet segments. Analyzing ARP in a PCAP reveals which devices responded to address resolution requests, detects gratuitous ARP announcements that may indicate IP conflicts, and identifies potential ARP spoofing or man-in-the-middle attacks on flat networks. During "host unreachable" investigations, missing ARP replies often explain failures that appear as application timeouts at higher layers. The analyzer reconstructs an ARP table from request and reply frames, showing IP-to-MAC bindings observed during the capture window. This complements IP-layer analysis — if TCP SYN packets leave the host but no SYN-ACK returns, checking whether ARP resolution succeeded for the next-hop gateway narrows the fault domain significantly.

What is Premium file extraction?

Premium file extraction recovers files transferred over HTTP cleartext directly from capture payloads without manual hex carving. During malware investigations, analysts need executables or documents delivered over HTTP without revisiting live URLs. Extraction reads Content-Type and Content-Disposition headers, reassembles TCP segments, and presents artifacts for download. This mirrors Wireshark Export Objects in a browser workflow. Extracted files may contain active malware — analyze artifacts in an isolated sandbox. File extraction requires Premium and is unavailable on the free tier, which focuses on protocol metadata rather than payload recovery.

Is it safe to upload PCAP files containing sensitive data?

PCAP files often contain cleartext passwords, API keys, session cookies, internal topology, and proprietary data. Upload only captures you are authorized to analyze and filter sensitive traffic when possible. ScanSuite mitigates risk with HTTPS uploads, automatic 24-hour deletion, and no advertising use of capture contents. No cloud analysis is zero-risk — evaluate organizational policy and regulations (GDPR, HIPAA, PCI-DSS) before uploading production traffic. Redact or truncate captures when feasible. For air-gapped environments, use local Wireshark instead. Review scansuite.io/privacy-policy for retention and processing details.

Can I analyze captures from tcpdump?

Yes. tcpdump is one of the most common capture sources for ScanSuite's analyzer. Use tcpdump -w output.pcap with appropriate filters to record traffic to a file, then upload the result. Example: tcpdump -i eth0 -w api-debug.pcap host api.example.com and port 443 captures HTTPS traffic to a single API endpoint. tcpdump defaults to PCAP format compatible with our parser. On systems without a GUI, tcpdump paired with ScanSuite's browser analyzer provides a complete capture-and-review workflow for remote servers accessed via SSH. Ensure the tcpdump process has sufficient permissions (typically root or CAP_NET_RAW) and that capturing traffic complies with your organization's monitoring policy. Convert PCAPNG to PCAP with editcap -F pcap if downstream tooling requires the legacy format.

Does the analyzer show TCP and UDP conversations?

Yes. At the transport layer, the analyzer groups packets into TCP and UDP conversations identified by the four-tuple: source IP, source port, destination IP, and destination port. TCP analysis includes flag fields (SYN, ACK, FIN, RST, PSH), sequence and acknowledgment numbers, window sizes, and retransmission indicators useful for diagnosing latency and connection failures. UDP conversations list datagram counts and payload sizes — common for DNS, DHCP, SNMP, and streaming protocols. Understanding transport-layer behavior is essential because many application errors originate from connection resets, half-open states, or MTU fragmentation issues visible only at TCP level. The OSI model framework helps structure investigation: confirm ARP and IP delivery first, then transport-layer handshake success, then application-protocol content like HTTP or DNS.

How does PCAP analysis relate to the OSI model?

The OSI model divides network communication into seven layers, and PCAP analysis traverses each layer in a capture. Layer 2 (Data Link) includes Ethernet and ARP. Layer 3 (Network) covers IPv4 and IPv6 with addresses, TTL, and protocol IDs. Layer 4 (Transport) encompasses TCP and UDP with ports, flags, and sequencing. Layers 5–7 map to TLS, HTTP, DNS, SMTP, and FTP decoded from payloads. ScanSuite presents this hierarchy like Wireshark's packet detail pane. Studying captures alongside the OSI model builds skills for Network+, Security+, and CISSP certification paths.

Can I use this tool for malware analysis?

PCAP analysis is standard in malware triage and incident response. Captures reveal C2 beacon intervals, DGA domain queries, HTTP POST exfiltration, and TLS connections to bulletproof hosts. ScanSuite identifies suspicious flows — rare ports, high-entropy DNS TXT labels, and known-malware User-Agent strings. Premium extraction recovers dropped payloads for sandbox submission without re-executing malware. Caveats: extracted files may be malicious, encrypted C2 hides payloads without keys, and PCAP alone does not replace memory forensics or EDR telemetry. Handle artifacts in isolated environments and stay within authorized investigation scope.

What should I do if my file exceeds the upload limit?

When a capture exceeds the 10 MB free tier limit, trim it with Wireshark Export Specified Packets or editcap to include only the relevant time range — most triage needs dozens of frames, not millions. Apply tighter capture filters before recording: specify host, port, or protocol in tcpdump or Wireshark to skip broadcast noise. Upgrade to Premium when full captures are essential for forensic timelines. Split large files with editcap -c 10000 into segments under the limit. Document which segment holds critical evidence so colleagues locate it quickly during collaborative investigations.

How does ScanSuite protect my privacy during analysis?

ScanSuite protects PCAP uploads with HTTPS encryption in transit and automatic deletion within 24 hours — files are not archived for training, advertising, or resale. Free tier requires no account, so captures are not linked to profiles unless you authenticate for Premium. Processing uses controlled infrastructure with restricted operational access. PCAP content may still contain PII and credentials — you remain responsible for upload authorization and regulatory compliance. Organizations with data residency requirements should evaluate enterprise options. See scansuite.io/privacy-policy for subprocessors, regional processing, and data subject rights.

What standards and references define packet capture formats?

Packet capture formats and the protocols they contain are defined by IETF RFCs and industry documentation. RFC 791 specifies IPv4 header structure observed in every captured IP packet. TCP and UDP transport behavior follows RFC 793 and RFC 768 respectively. DNS message format is defined in RFC 1035. TLS 1.3 appears in RFC 8446. The libpcap file format is documented in the tcpdump and Wireshark project specifications. Wireshark's official documentation at wiki.wireshark.org describes dissector behavior and capture file compatibility that ScanSuite's parser aligns with for common protocols. OWASP testing guidance references traffic analysis during web application security assessments. Understanding these authoritative sources helps analysts interpret decoded fields correctly and distinguish normal protocol behavior from anomalies during security investigations.

Online PCAP Analyzer — Wireshark Alternative

An online PCAP analyzer parses packet capture files (.pcap or .pcapng) to decode network traffic at multiple OSI layers — revealing TCP/UDP flows, HTTP requests, DNS queries, SSL/TLS handshakes, and ARP frames without installing desktop software like Wireshark.

Upload a .pcap or .pcapng file up to 10 MB on the free tier. ScanSuite decodes packets in your browser, surfaces HTTP, DNS, SSL/TLS, and ARP conversations, and deletes uploaded captures automatically after 24 hours. Premium unlocks larger files and file extraction from traffic.

Packet capture analysis is the process of inspecting recorded network traffic to diagnose connectivity failures, investigate security incidents, audit protocol behavior, and verify application performance. Captures produced by Wireshark, tcpdump, or cloud mirroring contain raw frames that must be decoded before they become actionable intelligence.

ScanSuite's online PCAP analyzer lets you upload .pcap and .pcapng files directly from your browser — no Wireshark installation, no local disk space for multi-gigabyte captures on locked-down laptops. The tool decodes TCP and UDP flows, HTTP and HTTPS metadata, DNS queries and responses, SSL/TLS handshake details, and ARP traffic, presenting structured results you can review during incident response or classroom labs.

ScanSuite's online PCAP analyzer lets you upload .pcap and .pcapng files and inspect HTTP, DNS, SSL/TLS, and ARP traffic without installing Wireshark. The free tier handles captures up to 10 MB and deletes files after 24 hours. Premium adds larger uploads and file extraction — a browser-based Wireshark alternative for incident response, network troubleshooting, and security education.

Frequently Asked Questions

What is an online PCAP analyzer?: An online PCAP analyzer is a browser-based tool that accepts packet capture files and decodes network traffic without installing desktop software. PCAP (Packet Capture) files record raw frames from network interfaces — typically saved as .pcap or .pcapng by Wireshark, tcpdump, or cloud mirroring products. The analyzer parses each frame through protocol dissectors aligned with the OSI model: Ethernet and ARP at Layer 2, IP at Layer 3, TCP and UDP at Layer 4, and application protocols like HTTP, DNS, and TLS at Layer 7. ScanSuite's online PCAP analyzer targets analysts who need fast triage on small captures during incident response, developer debugging, or classroom exercises — especially on workstations where Wireshark installation is restricted by corporate policy.
How is this different from Wireshark?: Wireshark is the industry-standard desktop packet analyzer with live capture, over three thousand protocol dissectors, display filters, decryption support via key log files, and scripting through Lua and tshark. ScanSuite's online analyzer is a lightweight Wireshark alternative focused on upload-based analysis of existing captures. You cannot capture live traffic from your network interface in the browser, and advanced dissectors for proprietary or niche protocols are not available. However, for common triage tasks — reading HTTP headers, listing DNS queries, inspecting TLS cipher suites and SNI values, and reviewing ARP tables — the browser tool delivers results in seconds without installation. Many analysts use ScanSuite for initial review and open the same file in Wireshark when deep inspection is required.
What file formats does the analyzer support?: ScanSuite accepts standard libpcap .pcap files and PCAP Next Generation .pcapng files. PCAP is the legacy format produced by tcpdump -w and older Wireshark versions. PCAPNG adds section headers, interface metadata, comments, and enhanced timestamp resolution — it is the default save format in modern Wireshark releases. Files captured on Linux with tcpdump, on macOS with Wireshark, or exported from cloud VPC flow log converters are typically compatible. Exotic formats such as Sniffer, NetMon, or ERFCAP must be converted with Wireshark or editcap before upload. If a file fails to parse, verify it opens correctly in Wireshark locally and that the extension matches the actual container format.
What is the free tier upload size limit?: The free tier accepts PCAP and PCAPNG files up to 10 megabytes per upload. This limit covers most single-session diagnostic captures — for example, a filtered tcpdump of one host and port during a failed API call, or a short Wireshark recording focused on DNS resolution. Captures from full-port SPAN mirrors or multi-hour recordings often exceed 10 MB and require trimming before upload or a Premium subscription for larger files. Use capture filters in Wireshark or tcpdump to reduce file size: tcpdump -w small.pcap host target.example.com and port 443 records only relevant traffic. Ring-buffer captures with editcap can split large files into analyzable segments without losing the critical frames.
How long does ScanSuite keep uploaded capture files?: ScanSuite automatically deletes uploaded PCAP and PCAPNG files within 24 hours of upload. This retention policy applies to both free and Premium tiers and exists to minimize exposure of sensitive network traffic on shared infrastructure. PCAP files frequently contain credentials in cleartext HTTP, session cookies, internal IP addresses, hostnames, and occasionally personal data from user-generated content. The 24-hour window allows you to complete triage, document findings, and share conclusions with your team while ensuring captures do not persist indefinitely on third-party servers. If your organization requires immediate deletion, contact ScanSuite support for enterprise options. Always retain local copies on encrypted storage if long-term evidence preservation is required for compliance or legal hold.
Can the analyzer decode HTTP and HTTPS traffic?: The analyzer decodes HTTP traffic in cleartext — request methods, Host headers, paths, status codes, and headers like User-Agent and Content-Type. HTTPS on port 443 encrypts application data with TLS, so HTTP bodies are not visible without decryption keys. TLS handshake records remain readable: ClientHello and ServerHello expose protocol version, cipher suites, extensions, and Server Name Indication (SNI), revealing the intended hostname on shared CDN IPs. Certificate subject, issuer, and validity dates from the ServerHello chain are also visible. Supply a compatible SSLKEYLOGFILE to decrypt HTTPS payloads when your tier supports session key import.