Packet Capture Analyzer & Knowledgebase

Paste tcpdump or Wireshark text output — or drag and drop a real .pcap, .pcapng, or rotation file — and get a plain-English explanation of what the traffic is doing. The analyzer decodes Ethernet, Linux cooked-mode, loopback and MPLS captures, then walks TCP, UDP, ICMP and ARP conversations to tell you which endpoints look healthy, which look broken, and why. Each conversation gets a sequence diagram with readable labels, including dashed markers where a reply was expected but never arrived.

Everything runs in your browser. Your capture is never uploaded, stored, or sent to a server — the parser is plain JavaScript running on your own machine.

The Knowledgebase tab is a searchable reference for the most common things you'll see in a capture: Wireshark dissection entries covering TCP, DNS, HTTP, TLS, ICMP and ARP, plus tcpdump flag-level field references and CLI troubleshooting patterns. Each entry explains what it means, why it matters, and gives concrete troubleshooting notes.