Open a .pcap File and Actually Read It.

A .pcap file is a saved recording of network traffic — every packet that crossed an interface, frozen on disk so you can study it later. Tools like tcpdump and tshark write these files all day, and the moment something breaks on a network, a capture is usually the first thing someone hands you. The catch is that reading one has traditionally meant installing desktop software and sitting at a computer. PCAP Analyzer from Rush Tools changes that: it's a genuine pcap file analyzer that lives on your iPhone, iPad, or Mac. Open a .pcap or .pcapng and it dissects every frame down to the field, with a tappable detail tree and a raw hex view, so you can read a capture the way you would on a workstation — only now it's in your pocket, fully offline.

This is a real packet analyzer, not a thin viewer. It decodes more than 30 protocols across the stack — Ethernet with 802.1Q VLAN tags, IPv4 and IPv6, TCP, UDP, SCTP, ICMP and ICMPv6, IGMP, ARP, GRE, and ESP at the lower layers, and DNS, mDNS, LLMNR, DHCP, HTTP, HTTP/2, TLS, DTLS, QUIC, SMB2, SNMP, RADIUS, TFTP, NTP, MQTT, and NetFlow v5 / IPFIX above them. From a TLS ClientHello it computes both JA3 and JA4 client fingerprints natively, right on the device — the same fingerprints threat hunters use to spot a client regardless of its IP. Whether you call it a pcap viewer, a pcap reader, a packet capture analyzer, or a network protocol analyzer, this is the tool that opens the file and tells you what's inside it.

Finding the packets that matter is where a capture lives or dies, so PCAP Analyzer ships a field-aware display filter language with autocomplete and saved filters. If you've written filters before, the syntax will feel immediately familiar — tcp.port == 443, tls.sni contains "example", tcp.analysis.zero_window, or a simple dns or http. Tap any field inside a packet and the app builds a filter from it instantly, so you can pivot from one interesting frame to every related one without typing. On top of filtering, expert diagnostics flag the trouble automatically: TCP retransmissions, duplicate ACKs, zero-window stalls, connection resets, ICMP unreachable and TTL-expired messages, HTTP 4xx/5xx errors, TLS alerts, and DNS failures like NXDOMAIN and SERVFAIL. Packets are color-coded so the problems jump out of a busy capture instead of hiding in it.

Beyond protocol decoding, the app gives you the statistics and visuals that turn a wall of packets into a story. There's a Conversations view and an Endpoints view, a Protocol Hierarchy breakdown, a network topology map, an I/O graph and packet timeline, a packet-size distribution, and Follow Stream with a TCP sequence/time graph — plus automatic name resolution so you see hostnames instead of raw IP addresses. For security work it adds threat detection: it flags port and host scans, suspicious C2 and backdoor ports, possible DNS tunneling, and cleartext credentials sent over FTP, Telnet, or HTTP. That makes it a practical companion for network forensics, malware traffic analysis, and CTF pcap challenges — the kind of work where you need to read a capture carefully, not just glance at it. A native streaming engine opens very large, multi-gigabyte captures without running out of memory, so files that crash other mobile viewers open here.

Everything happens on your device, and that's the whole point. PCAP Analyzer analyzes saved capture files only — it captures no live traffic, needs no special permissions, and never uploads your data. A capture can carry sensitive internal hostnames, credentials, and private payloads, so it stays local: nothing is sent to a server, there's no account to create, and there's nothing phoning home. On supported iPhones where Apple Intelligence is available (iOS 26 and later), an optional on-device AI can summarize a capture in plain language and turn plain-English requests like "show failed connections" into a display filter — and even that runs entirely on the phone, so the capture never leaves it. You can explore a built-in demo capture for free to see exactly how the app reads a file; PCAP Analyzer Pro unlocks unlimited file opening with a weekly or annual subscription, and there's no account on any of it.