Online PCAP Analyzer
An online PCAP analyzer parses packet capture files (.pcap or .pcapng) to decode network traffic at multiple OSI layers — revealing TCP/UDP flows, HTTP requests, DNS queries, SSL/TLS handshakes, and ARP frames without installing desktop software like Wireshark.
Upload a .pcap or .pcapng file up to 10 MB on the free tier. ScanSuite parses the capture on the server, shows HTTP, DNS, SSL/TLS, and ARP conversations, and deletes the file within 24 hours. Premium unlocks larger files and file extraction from traffic.
ScanSuite vs Wireshark desktop
Packet capture analysis is the process of inspecting recorded network traffic to diagnose connectivity failures, investigate security incidents, audit protocol behavior, and verify application performance. Captures produced by Wireshark, tcpdump, or cloud mirroring contain raw frames that must be decoded before they become actionable intelligence.
ScanSuite's online PCAP analyzer lets you upload .pcap and .pcapng files directly from your browser — no Wireshark installation, no local disk space for multi-gigabyte captures on locked-down laptops. The tool decodes TCP and UDP flows, HTTP and HTTPS metadata, DNS queries and responses, SSL/TLS handshake details, and ARP traffic, presenting structured results you can review during incident response or classroom labs.
Supported protocols
A PCAP analyzer reads packet capture files in the libpcap format (.pcap) or the newer PCAP Next Generation format (.pcapng), which preserves interface metadata, comments, and enhanced timestamps. Each frame is parsed according to the OSI model: Ethernet and ARP at Layer 2, IP at Layer 3, TCP and UDP at Layer 4, and application protocols like HTTP, DNS, and TLS at Layer 7.
Desktop tools like Wireshark and command-line utilities like tcpdump remain industry standards for deep inspection. An online analyzer delivers a subset of that capability through a browser — ideal when you need quick triage on a capture shared by a colleague, a quick look at a suspicious DNS query, or TLS certificate details without launching a full GUI. ScanSuite processes uploads server-side and returns decoded summaries while enforcing strict retention limits for privacy.
Is my PCAP private?
The free tier accepts a .pcap or .pcapng upload up to 10 MB. The file is sent over HTTPS, parsed on the server, and deleted within 24 hours on both free and paid tiers. Keep a local copy if you need the capture longer than that.
Security analysts often receive small capture files via ticket attachments during phishing investigations, malware callbacks, or unauthorized DNS tunneling reports. Installing Wireshark on every analyst workstation is not always feasible on managed corporate images. A browser-based analyzer removes that friction while still exposing the protocol fields needed for initial triage.
Developers debugging API integrations can upload a short capture from a staging environment to confirm HTTP headers, TLS cipher suites, and DNS resolution order. Network engineers validating firewall rules upload captures taken before and after a change to verify that expected traffic passes and blocked traffic does not. The free tier's 10 MB limit covers most single-session diagnostic captures while Premium supports larger files and embedded file extraction from HTTP or SMTP payloads.
Who Uses PCAP Analysis Tools?
SOC analysts and incident responders inspect captures to identify C2 beaconing, data exfiltration over DNS, and credential theft over unencrypted HTTP. Penetration testers review traffic from authorized assessments to document proof-of-exploit chains. Malware researchers correlate PCAP evidence with sandbox reports and VirusTotal submissions.
Network administrators troubleshoot intermittent latency by examining TCP retransmissions and window sizes. DevOps engineers validate service mesh mTLS handshakes and certificate chains. Students studying the OSI model practice decoding real-world traffic alongside Wireshark labs. ScanSuite serves each audience with a lightweight Wireshark alternative accessible from any modern browser.
Open a pcapng file without Wireshark
After you select a .pcap or .pcapng file, ScanSuite validates file size against your tier limit — 10 MB on the free plan — and uploads the capture over HTTPS. The backend parses each frame using standard dissectors aligned with Wireshark's protocol definitions: Ethernet II headers, IPv4/IPv6, TCP and UDP segments, and application-layer payloads for HTTP, DNS, SSL/TLS, and ARP.
Decoded results are grouped into conversations and summary tables. HTTP requests show method, host, path, status codes, and response sizes. DNS entries list query types, queried names, and answer records. TLS records expose cipher suites, protocol versions, and certificate subject details where visible in cleartext handshakes. ARP tables map IP addresses to MAC addresses on the local segment. Uploaded files are automatically deleted after 24 hours; Premium subscribers may access file extraction features that recover files transferred over HTTP or other supported protocols.
Example: HTTP redirect chain in a capture
A capture from a suspected phishing link may show an HTTP 302 redirect from http://evil.example/ to https://login-fake.example/login. The analyzer lists each request method, Host header, status code, and Location header so analysts can document the redirect chain without scrolling through thousands of unrelated frames.
Example: DNS tunneling indicators
Unusually long subdomain labels in repeated DNS TXT or NULL queries — for example, a.b.c.d.e.data.exfil.example — often signal DNS tunneling. The analyzer surfaces query names and response sizes so you can compare entropy and frequency against baseline resolver behavior captured during the same time window.
Browser Analyzer vs Wireshark Desktop
| Feature | ScanSuite PCAP Analyzer | Wireshark | |
|---|---|---|---|
| Installation | None — browser upload | Desktop install required | |
| Live capture | Not supported | Full interface capture | |
| Protocol decode | HTTP, DNS, TLS, ARP, TCP/UDP | 3,000+ dissectors | |
| File extraction | Premium feature | Built-in Export Objects | |
| Capture size | 10 MB free / Premium larger | Limited by local disk only | |
| Data retention | Auto-delete after 24 hours | Local files persist until deleted |
Free vs Premium PCAP Analysis
| Capability | Free Tier | Premium | |
|---|---|---|---|
| Upload limit | 10 MB per file | Larger captures supported | |
| Protocol analysis | HTTP, DNS, TLS, ARP, TCP/UDP | Same core protocols | |
| File extraction | Not included | Extract files from HTTP traffic | |
| Account required | No | Premium subscription | |
| File deletion | 24 hours | 24 hours | |
| Use case | Quick triage and education | Deeper forensics and malware recovery |
PCAP Analyzer Troubleshooting
If upload fails, verify the file extension is .pcap or .pcapng and size is within your tier limit. Corrupt captures from interrupted tcpdump writes may fail parsing — reopen in Wireshark locally to confirm integrity before re-uploading. Convert exotic formats with editcap or mergecap if needed.
If expected protocols are missing, confirm the capture filter did not exclude relevant traffic. Wireless captures in monitor mode may use radiotap headers that require full Wireshark for complete decode. Empty HTTP results on port 443 are normal — TLS encrypts application data unless session keys are supplied.
Related tools
- Port Scanner — Free online Nmap port scan
- Subnet Calculator — Calculate CIDR blocks
- DNS Lookup — Check DNS records
- Subdomain Finder — Discover subdomains for domains resolved in captures
- Port Scanner — Scan open ports on hosts identified in captures
- DNS Lookup — Verify DNS records for hostnames found in PCAP traffic
- What Is My IP — Check your public IP address and egress metadata
- Subnet Calculator — Calculate CIDR ranges for IP addresses in captures
- SSL Checker — Validate TLS certificates for HTTPS hosts in traffic
- All Free Tools — Browse the complete ScanSuite tool catalog
- Network Scanning — Enterprise network vulnerability scanning
Frequently Asked Questions
How do I open a pcapng file without Wireshark?
Upload a `.pcapng`, `.pcap` or `.cap` file (up to 10 MB on the free tool) to this analyzer. It lists packets, protocols and conversations in your browser with nothing to install. Processing runs on our servers; reports are deleted after 24 hours.
How do I open a PCAP file online?
Drag the file onto the upload area above or click to choose it. When it is processed, you can filter by protocol, inspect individual packets and view summary statistics.
Is my capture file private?
Files are processed on our servers and deleted after 24 hours. They are not shared or used for anything else. Captures can contain credentials and personal data, so remove sensitive traffic before uploading.
Is this an online Wireshark alternative?
It handles quick analysis such as viewing packets, protocols and statistics without installing anything. For deep dissection, live capture or very large files, desktop Wireshark is still the better choice.
What's the difference between PCAP and PCAPNG?
PCAPNG is the newer format. It can store several interfaces, comments and richer metadata in one file. Classic PCAP is simpler and more widely supported by older tools. This analyzer accepts both, plus `.cap`.
Can I use this as Wireshark online?
Upload a saved .pcap or .pcapng file and review HTTP, DNS, and TLS metadata in the browser. It is a PCAP viewer for captures you already have. It does not sniff a live network the way desktop Wireshark does.
What is an online PCAP analyzer?
An online PCAP analyzer is a browser-based tool that accepts packet capture files and decodes network traffic without installing desktop software. PCAP (Packet Capture) files record raw frames from network interfaces \u2014 typically saved as .pcap or .pcapng by Wireshark, tcpdump, or cloud mirroring products. The analyzer parses each frame through protocol dissectors aligned with the OSI model: Ethernet and ARP at Layer 2, IP at Layer 3, TCP and UDP at Layer 4, and application protocols like HTTP, DNS, and TLS at Layer 7. ScanSuite's online PCAP analyzer targets analysts who need fast triage on small captures during incident response, developer debugging, or classroom exercises \u2014 especially on workstations where Wireshark installation is restricted by corporate policy.
How is this different from Wireshark?
Wireshark is the industry-standard desktop packet analyzer with live capture, over three thousand protocol dissectors, display filters, decryption support via key log files, and scripting through Lua and tshark. ScanSuite's online analyzer is a lightweight Wireshark alternative focused on upload-based analysis of existing captures. You cannot capture live traffic from your network interface in the browser, and advanced dissectors for proprietary or niche protocols are not available. However, for common triage tasks \u2014 reading HTTP headers, listing DNS queries, inspecting TLS cipher suites and SNI values, and reviewing ARP tables \u2014 the browser tool delivers results in seconds without installation. Many analysts use ScanSuite for initial review and open the same file in Wireshark when deep inspection is required.
What file formats does the analyzer support?
ScanSuite accepts standard libpcap .pcap files and PCAP Next Generation .pcapng files. PCAP is the legacy format produced by tcpdump -w and older Wireshark versions. PCAPNG adds section headers, interface metadata, comments, and enhanced timestamp resolution \u2014 it is the default save format in modern Wireshark releases. Files captured on Linux with tcpdump, on macOS with Wireshark, or exported from cloud VPC flow log converters are typically compatible. Exotic formats such as Sniffer, NetMon, or ERFCAP must be converted with Wireshark or editcap before upload. If a file fails to parse, verify it opens correctly in Wireshark locally and that the extension matches the actual container format.
What is the free tier upload size limit?
The free tier accepts PCAP and PCAPNG files up to 10 megabytes per upload. This limit covers most single-session diagnostic captures \u2014 for example, a filtered tcpdump of one host and port during a failed API call, or a short Wireshark recording focused on DNS resolution. Captures from full-port SPAN mirrors or multi-hour recordings often exceed 10 MB and require trimming before upload or a Premium subscription for larger files. Use capture filters in Wireshark or tcpdump to reduce file size: tcpdump -w small.pcap host target.example.com and port 443 records only relevant traffic. Ring-buffer captures with editcap can split large files into analyzable segments without losing the critical frames.
How long does ScanSuite keep uploaded capture files?
ScanSuite automatically deletes uploaded PCAP and PCAPNG files within 24 hours of upload. This retention policy applies to both free and Premium tiers and exists to minimize exposure of sensitive network traffic on shared infrastructure. PCAP files frequently contain credentials in cleartext HTTP, session cookies, internal IP addresses, hostnames, and occasionally personal data from user-generated content. The 24-hour window allows you to complete triage, document findings, and share conclusions with your team while ensuring captures do not persist indefinitely on third-party servers. If your organization requires immediate deletion, contact ScanSuite support for enterprise options. Always retain local copies on encrypted storage if long-term evidence preservation is required for compliance or legal hold.
Can the analyzer decode HTTP and HTTPS traffic?
The analyzer decodes HTTP traffic in cleartext \u2014 request methods, Host headers, paths, status codes, and headers like User-Agent and Content-Type. HTTPS on port 443 encrypts application data with TLS, so HTTP bodies are not visible without decryption keys. TLS handshake records remain readable: ClientHello and ServerHello expose protocol version, cipher suites, extensions, and Server Name Indication (SNI), revealing the intended hostname on shared CDN IPs. Certificate subject, issuer, and validity dates from the ServerHello chain are also visible. Supply a compatible SSLKEYLOGFILE to decrypt HTTPS payloads when your tier supports session key import.
How does DNS analysis work in a PCAP file?
DNS traffic typically uses UDP port 53 and TCP port 53 for large responses. The analyzer extracts transaction IDs, query types, queried names, and answer, authority, and additional records. Supported types include A, AAAA, CNAME, MX, TXT, NS, PTR, and SOA \u2014 the same records our DNS lookup tool queries, but observed on the wire during capture. This helps diagnose split-horizon failures, DNS tunneling with long subdomain labels, DGA domains in malware callbacks, and resolver mismatches with application errors. Compare PCAP-derived answers against live lookups to detect stale caching or hijacked resolvers during incident timelines.
What SSL and TLS information can I inspect?
SSL and TLS analysis focuses on cleartext handshake metadata before application encryption. For each session, the analyzer reports protocol version (TLS 1.2, TLS 1.3, or legacy SSL), negotiated cipher suite, key exchange, and certificate chain details including subject, issuer, and validity. ClientHello SNI identifies the target hostname when virtual hosts share one IP. Alert messages surface certificate failures, downgrade attempts, and abrupt termination \u2014 useful for mTLS troubleshooting and browser warning diagnosis. Combine findings with our SSL checker to verify whether live certificates match those in historical captures during incident response.
Why would I analyze ARP traffic in a capture?
ARP (Address Resolution Protocol) operates at OSI Layer 2, mapping IPv4 addresses to MAC addresses on local Ethernet segments. Analyzing ARP in a PCAP reveals which devices responded to address resolution requests, detects gratuitous ARP announcements that may indicate IP conflicts, and identifies potential ARP spoofing or man-in-the-middle attacks on flat networks. During "host unreachable" investigations, missing ARP replies often explain failures that appear as application timeouts at higher layers. The analyzer reconstructs an ARP table from request and reply frames, showing IP-to-MAC bindings observed during the capture window. This complements IP-layer analysis \u2014 if TCP SYN packets leave the host but no SYN-ACK returns, checking whether ARP resolution succeeded for the next-hop gateway narrows the fault domain significantly.
What is Premium file extraction?
Premium file extraction recovers files transferred over HTTP cleartext directly from capture payloads without manual hex carving. During malware investigations, analysts need executables or documents delivered over HTTP without revisiting live URLs. Extraction reads Content-Type and Content-Disposition headers, reassembles TCP segments, and presents artifacts for download. This mirrors Wireshark Export Objects in a browser workflow. Extracted files may contain active malware \u2014 analyze artifacts in an isolated sandbox. File extraction requires Premium and is unavailable on the free tier, which focuses on protocol metadata rather than payload recovery.
Is it safe to upload PCAP files containing sensitive data?
PCAP files often contain cleartext passwords, API keys, session cookies, internal topology, and proprietary data. Upload only captures you are authorized to analyze and filter sensitive traffic when possible. ScanSuite mitigates risk with HTTPS uploads, automatic 24-hour deletion, and no advertising use of capture contents. No cloud analysis is zero-risk \u2014 evaluate organizational policy and regulations (GDPR, HIPAA, PCI-DSS) before uploading production traffic. Redact or truncate captures when feasible. For air-gapped environments, use local Wireshark instead. Review scansuite.io/privacy-policy for retention and processing details.
Can I analyze captures from tcpdump?
Yes. tcpdump is one of the most common capture sources for ScanSuite's analyzer. Use tcpdump -w output.pcap with appropriate filters to record traffic to a file, then upload the result. Example: tcpdump -i eth0 -w api-debug.pcap host api.example.com and port 443 captures HTTPS traffic to a single API endpoint. tcpdump defaults to PCAP format compatible with our parser. On systems without a GUI, tcpdump paired with ScanSuite's browser analyzer provides a complete capture-and-review workflow for remote servers accessed via SSH. Ensure the tcpdump process has sufficient permissions (typically root or CAP_NET_RAW) and that capturing traffic complies with your organization's monitoring policy. Convert PCAPNG to PCAP with editcap -F pcap if downstream tooling requires the legacy format.
Does the analyzer show TCP and UDP conversations?
Yes. At the transport layer, the analyzer groups packets into TCP and UDP conversations identified by the four-tuple: source IP, source port, destination IP, and destination port. TCP analysis includes flag fields (SYN, ACK, FIN, RST, PSH), sequence and acknowledgment numbers, window sizes, and retransmission indicators useful for diagnosing latency and connection failures. UDP conversations list datagram counts and payload sizes \u2014 common for DNS, DHCP, SNMP, and streaming protocols. Understanding transport-layer behavior is essential because many application errors originate from connection resets, half-open states, or MTU fragmentation issues visible only at TCP level. The OSI model framework helps structure investigation: confirm ARP and IP delivery first, then transport-layer handshake success, then application-protocol content like HTTP or DNS.
How does PCAP analysis relate to the OSI model?
The OSI model divides network communication into seven layers, and PCAP analysis traverses each layer in a capture. Layer 2 (Data Link) includes Ethernet and ARP. Layer 3 (Network) covers IPv4 and IPv6 with addresses, TTL, and protocol IDs. Layer 4 (Transport) encompasses TCP and UDP with ports, flags, and sequencing. Layers 5\u20137 map to TLS, HTTP, DNS, SMTP, and FTP decoded from payloads. ScanSuite presents this hierarchy like Wireshark's packet detail pane. Studying captures alongside the OSI model builds skills for Network+, Security+, and CISSP certification paths.
Can I use this tool for malware analysis?
PCAP analysis is standard in malware triage and incident response. Captures reveal C2 beacon intervals, DGA domain queries, HTTP POST exfiltration, and TLS connections to bulletproof hosts. ScanSuite identifies suspicious flows \u2014 rare ports, high-entropy DNS TXT labels, and known-malware User-Agent strings. Premium extraction recovers dropped payloads for sandbox submission without re-executing malware. Caveats: extracted files may be malicious, encrypted C2 hides payloads without keys, and PCAP alone does not replace memory forensics or EDR telemetry. Handle artifacts in isolated environments and stay within authorized investigation scope.
What should I do if my file exceeds the upload limit?
When a capture exceeds the 10 MB free tier limit, trim it with Wireshark Export Specified Packets or editcap to include only the relevant time range \u2014 most triage needs dozens of frames, not millions. Apply tighter capture filters before recording: specify host, port, or protocol in tcpdump or Wireshark to skip broadcast noise. Upgrade to Premium when full captures are essential for forensic timelines. Split large files with editcap -c 10000 into segments under the limit. Document which segment holds critical evidence so colleagues locate it quickly during collaborative investigations.
How does ScanSuite protect my privacy during analysis?
ScanSuite protects PCAP uploads with HTTPS encryption in transit and automatic deletion within 24 hours \u2014 files are not archived for training, advertising, or resale. Free tier requires no account, so captures are not linked to profiles unless you authenticate for Premium. Processing uses controlled infrastructure with restricted operational access. PCAP content may still contain PII and credentials \u2014 you remain responsible for upload authorization and regulatory compliance. Organizations with data residency requirements should evaluate enterprise options. See scansuite.io/privacy-policy for subprocessors, regional processing, and data subject rights.
What standards and references define packet capture formats?
Packet capture formats and the protocols they contain are defined by IETF RFCs and industry documentation. RFC 791 specifies IPv4 header structure observed in every captured IP packet. TCP and UDP transport behavior follows RFC 793 and RFC 768 respectively. DNS message format is defined in RFC 1035. TLS 1.3 appears in RFC 8446. The libpcap file format is documented in the tcpdump and Wireshark project specifications. Wireshark's official documentation at wiki.wireshark.org describes dissector behavior and capture file compatibility that ScanSuite's parser aligns with for common protocols. OWASP testing guidance references traffic analysis during web application security assessments. Understanding these authoritative sources helps analysts interpret decoded fields correctly and distinguish normal protocol behavior from anomalies during security investigations.
Summary
ScanSuite's online PCAP analyzer lets you upload .pcap and .pcapng files and inspect HTTP, DNS, SSL/TLS, and ARP traffic without installing Wireshark. The free tier handles captures up to 10 MB and deletes files after 24 hours. Premium adds larger uploads and file extraction — a browser-based Wireshark alternative for incident response, network troubleshooting, and security education.