Packet Capture Analyzer

Packet Capture Analyzer is a Linux alternative to Wireshark, written in pure Python.

Features:
- Open and save classic libpcap .pcap files (micro- and nanosecond, both byte orders; Ethernet, Linux cooked SLL/SLL2, raw IP, BSD loopback link types)
- Dissectors: Ethernet/802.1Q, ARP, IPv4 (header checksum check), IPv6 (+extension headers), TCP (flags, options), UDP, ICMP, ICMPv6, DNS (queries/answers, name compression, also over TCP), HTTP/1.x request/response headers, TLS record type
- Packet list, protocol detail tree and hex dump with field highlighting
- Display filters: protocol names, ip.addr / ip.src / ip.dst (incl. CIDR), port / tcp.port / udp.port, frame.len, tcp.flags.syn, dns.qry.name, http.host, frame contains "text", combined with and / or / not and parentheses
- Statistics: protocol hierarchy and TCP/UDP/IP conversations
- Follow TCP Stream with retransmission removal, ASCII or hex, save raw stream
- Live capture through an AFPACKET raw socket (saved as Linux cooked capture)

Live capture needs root (or CAPNET_RAW). In the snap connect the interfaces
'sudo snap connect packet-capture-analyzer:network-observe' and
'sudo snap connect packet-capture-analyzer:network-control' and run the app with sudo.
Without those permissions the app shows a clear message and you can still analyse
.pcap files. pcapng files are not supported (convert with editcap -F pcap).

Not affiliated with or endorsed by the Wireshark Foundation.

Support development: https://buymeacoffee.com/thanhnv128b