A native macOS packet analyzer.
PCAP capture, plugin-based protocol dissection, and macOS-native UI — fully rewritten in Swift.
Built for the way you analyze.
Capture
Capture network traffic using Ethernet or Wi-Fi interfaces.
Analyze
A variety of network protocol analyzers to display and filter your trace files are included.
QuickLook
Preview packet traces in Finder - a QuickLook extension is included just for it.
Enhance
Creating analyzer plugins using the Cocoa bundles plugin technology should be straightforward.
Dark Mode
Supporting all appearance modes of macOS.
Bring your traces to paper.
Notarized
Releases are notarized by Apple. Beta builds might not be.
Localization
English, German and basic Japanese localizations are included.
TLS / HTTPS
Dissect the TLS handshake and certificates, and decrypt TLS 1.2 / 1.3 traffic with an SSLKEYLOGFILE.
MITM Proxy
A built-in HTTPS proxy with a live flow inspector so decryption just works — no key-log file required.
pcapng
Read and write the modern pcapng format, with per-packet comments and embedded TLS decryption secrets.
TLS Keys
See every TLS session in a trace, which ones decrypt, and exactly why the others do not.
From capture to conversation.
Start a capture
Pick an interface, set SnapLen, toggle promiscuous or Wi-Fi monitor mode, and drop in a tcpdump-compatible filter expression. The daemon compiles the BPF program before a single packet is copied to user space.
Capture to file or switch to live capturing from the same sheet — your default mode is remembered in Settings.
Live capturing
In live mode packets are dissected as they arrive. The toolbar shows a real-time traffic monitor with packet count and elapsed time while the packet list, protocol detail tree, and hex view all update continuously.
Menu bar capture
A menu bar extra for quick capture without opening a document. The popover hosts the interface picker, start/stop controls, and a live 48-bar activity histogram that keeps ticking even when the popover is closed.
Choose File mode to write a .pcap with Open / Reveal / Discard actions on stop, or Live mode to open a fresh document with capture already running — packets stream into both surfaces at once.
Pin the popover into a standalone window that survives app switches — or let it auto-detach while a capture is running so the histogram stays visible without stealing focus.
Packet details, byte by byte
The packet-details outline has been rewritten in SwiftUI — roomier rows, center-aligned protocol icons, tooltips on long values, and ⌘C copies the selected row.
Click any leaf field and the hex view highlights only that field's bytes on the wire. Per-leaf byte ranges are wired across the full analyzer suite, down to individual flag bits in IPv4, IPv6, and TCP.
PCAP filter builder
A structured editor covering every category from the tcpdump manpage — hosts, networks, ports, VLAN, MPLS, 802.11, byte comparisons, and raw primitives. Each keystroke is validated against a dead pcap handle, so invalid filters never reach the capture daemon.
Wrap rows in NOT, combine them with AND/OR, and nest sub-groups with explicit parentheses.
The document window
Four coordinated panes: a recents sidebar, a sortable packet list with analyzer-contributed columns, an outline view with the protocol dissection tree, and a hex view that highlights the bytes behind the selected header.
Protocol color coding in the packet list makes traffic patterns obvious at a glance.
Filter and find
The toolbar search field is a single entry point for filtering: a token-style query builder, a sectioned autocomplete dropdown, rich-editor popovers for dates, protocols and grouped expressions, and a saved-query library — all without leaving the document window.
Toggle Open result in new document to route the filtered subset into its own window, ready to save as a standalone .pcap.
Follow TCP stream
Reassemble any bidirectional TCP conversation and switch between four view modes: Conversation (speech bubbles with packet numbers and flags), ASCII transcript, side-by-side hex dump, and a parsed HTTP request/response view.
The HTTP view pairs each request with its reply, lists the headers, and reconstructs the message body straight from the segments — decoding chunked and gzip transfers and rendering image payloads inline. A header strip tracks the client, server, segment and byte counts, duration, and connection state, and every message links back to its packet in the trace.
The stream popup walks every conversation detected in the trace.
TLS, dissected and decrypted
The TLS analyzer breaks down the record layer, handshake, and extensions with per-field byte highlighting in the hex view, parses the certificate chain (subject, issuer, validity, serial, SANs), and pairs each ClientHello with its ServerHello. TLS is detected by content, so it is recognised on any port.
Point Cocoa Packet Analyzer at an SSLKEYLOGFILE and Follow TCP Stream decrypts TLS 1.2 (AEAD) and TLS 1.3 application data, re-feeds the plaintext through the inner interpreters, and surfaces the decrypted HTTP request ↔ reply pairings — each mapped back to every contributing packet.
CPA MITM Proxy
A built-in man-in-the-middle HTTPS proxy that makes decryption just work — no key-log file required (non–App Store builds). It generates its own root certificate authority, installs it into your login keychain on request, mints per-host leaf certificates on the fly, and toggles the system web proxy for you, restoring your previous settings when it stops.
A live Flow Inspector window lists HTTP(S) transactions as they happen, with full request and response detail (headers, body, hex / JSON) plus drag and copy. Turn on Decrypt HTTPS while capturing and the proxy's session keys are bridged straight into the trace, so captured HTTPS is decrypted end to end.
Subscriber Session Inspector
Follow a broadband subscriber through the whole bring-up. The inspector stitches PPPoE, L2TP, PPP control, and RADIUS exchanges into a single session and draws them as a LAC ↔ LNS ladder — Setup, Link, Auth, Network, and Data phases laid out in order, each arrow pointing the way the message travelled.
A summary bar pulls out the essentials: user, session and tunnel IDs, authentication method, assigned IP, LNS, and call duration. The sidebar lists every session in the trace, and any rung expands to its full protocol detail.
Protocol statistics
Get a one-look summary of any trace: a bar chart of protocol distribution next to the file's metadata — link type, packet count, byte totals, and capture time span.
Open it from the Data Sources Manager or the document sidebar, and send it straight to the printer when you need a paper copy for a report.
Know what decrypts
The TLS Keys window lists every TLS session in a trace beside the key material held for it, and says plainly which ones decrypt — and for the rest, why not: no keys were ever recorded, a secret is missing, the key belongs to another session, or the version is out of reach.
A coverage band sums up the whole capture at a glance. Export the secrets you need as a key-log file or a CSV report, or jump straight from a session to its first packet.
The key store remembers
Keys outlive the capture that produced them. The key store is an app-wide vault of every secret Cocoa Packet Analyzer has recorded, frozen per trace and stamped with a fingerprint and path so it knows which file a set belongs to.
Each entry carries its state plainly: Linked when the trace is still where it was and has not changed, Unattributed when secrets arrived with no trace to pin them to. Verify All re-checks every entry against disk, and the dated live keylog keeps collecting so a session recorded weeks ago still opens today.
Tuned to how you work.
Capture
Buffer and snaplen are dials rather than sliders, so the value you are about to capture with is readable at a glance instead of inferred from a knob position. Around them sit the interface picker, the file-or-live mode switch, monitor and promiscuous mode, the menu bar extra, and Decrypt HTTPS.
The capture filter lives at the bottom with its Build… button. Whatever you type is compiled before the daemon is asked to capture anything, so a malformed expression fails here rather than halfway through a session.
Analyzers
Pick a protocol analyzer and its settings appear beside it — no nested sheet to open and dismiss. Each plugin declares what it offers, so the pane builds itself: name resolution, checksum verification, credential masking, HTTP/2 detection, and whatever else that protocol supports.
The Ports table decides which traffic reaches the analyzer at all, and the colour well beside Packet coloring sets the shade that protocol wears in the packet list. Reset restores one analyzer’s defaults without touching the rest.
General
Three tiles for appearance — Light, Dark, or Auto to follow macOS. Every window is drawn for both, so neither is the afterthought.
Packet traces carry no time zone of their own, so timestamps default to yours; pick a different one and the whole trace re-reads in it. Update checks are opt-in, and so is the anonymous system profile that comes with them.
Fonts
Six surfaces, six independent choices: the packet list, the hex and stream console, the protocol detail tree, the statistics chart, and both halves of the Data Sources list.
The console setting reaches everywhere raw bytes and reconstructed streams are shown, so Follow TCP Stream, Follow UDP Flow and the Subscriber Session Inspector all follow it.
MITM Proxy
One switch routes your Mac’s HTTP and HTTPS through Cocoa Packet Analyzer, and one field sets the port it listens on. Turning it off puts your previous proxy configuration back the way it was.
Beside them, the root certificate reports its own SHA-256 fingerprint and whether macOS currently trusts it, with the trust, untrust and export actions in the gear menu. Decryption either works or tells you which of these two things is missing. Direct-download builds only.
Get CocoaPacketAnalyzer.
Version 3.0.0
The latest release. Universal binary.
Requires macOS 26 or later. Adds the TLS Keys window — every TLS session in a trace, which ones decrypt, and the reason the others do not. Saving now writes the format you asked for, fixing a case where a .pcapng was rewritten as pcap and lost its embedded keys, and the save panel gained a format picker. Rebuilt progress reporting so long reads, exports and filters show real progress and cancel cleanly. On top of 2.6.0's TLS / HTTPS analyzer, built-in MITM proxy with a live flow inspector, and native pcapng read & write.
CPAPluginSDK 3.0.0
Single-import Swift SDK for writing .cpaplugin protocol analyzers. Analyzer settings are now declarative — declare your packet coloring, options and ports, and the app renders the pane for you under Settings ▸ Analyzers, matching the built-in analyzers. Includes DocC documentation and an NTP analyzer sample (XCFramework workflow). Requires CPA 3.0.0+.
Version 2.1.4
Previous release. Universal binary.
For Macs running macOS 10.14.6 – 15.7.4. Not compatible with macOS 26.
Frequently asked questions.
The ethernet and wifi interfaces that come with your Mac should just work fine!
Ethertypes: ARP, IP (v4/v6), PPP, PPPoED/S, 802.1Q VLAN, MPLS
Linktypes: Loopback, PPP, LinuxSLL, IEEE802.11-RadioTap
Analyzer plugIns for the following protocols are included:
Link & framing: Ethernet, ARP, 802.1Q VLAN, MPLS, PPP, PPPoE (Discovery & Session), LinuxSLL, IEEE 802.11 RadioTap, Loopback
Network: IP (v4/v6), ICMP (v4/v6), IGMP, OSPF, Mobility, ESP
Transport & tunneling: TCP, UDP, L2TP, MPLS-in-IP
PPP control: LCP, IPCP (v4/v6), CCP, PAP, CHAP
Application: HTTP, WebSocket, DNS, DHCP (v4/v6), FTP, SMTP, POP3, IMAP, NNTP, SSH, Telnet, SIP, IAX, SNMP, LDAP, BGP, RADIUS, SMB, SOAP, Hotline
Promiscuous mode can be enabled in the capture preferences. Most interfaces in Apple Computers should support it.
Monitor mode allows packets to be captured without having to associate with an access point or ad hoc network first. Monitor mode only applies to wireless networks. Not all wifi interfaces support it. It can be enabled in the capture preferences.
Monitor and promiscuous mode wont work if both are enabled.
Captured HTTPS is encrypted. From the packets alone you can see that your Mac talked to a host, when, and how much — but not a word of what was said. That is HTTPS working as intended, and no amount of analysis undoes it after the fact.
The proxy solves it by standing in the middle, with your permission. It runs locally, mints its own certificate authority, and asks macOS to route your web traffic through it. To your browser it looks like the far end; to the far end it looks like your browser. Because it terminates each connection itself, it holds the keys — so it can show you every request and response as plain text, and hand those keys to the analyzer so your captured packets decrypt too.
“MITM” is man-in-the-middle, normally the name of an attack. This is the same technique aimed at your own machine, and only while you switch it on: you have to trust its certificate, your previous proxy settings are restored when you stop, and nothing leaves your Mac. While it is running it can read the HTTPS of every app that uses the system proxy — so turn it off when you are done, and only inspect traffic you are entitled to.
Part of the direct-download build. The Mac App Store sandbox does not permit it.
A key log is a small text file that writes down the secret each encrypted connection used, so a capture can be read afterwards.
When a browser opens an HTTPS connection it negotiates a fresh secret with the server. Nobody watching the wire can work it out — that is the whole design. But both ends know it, and either end is free to write it down. A key log is exactly that: one line per session, linking a connection to its secret. Most browsers will produce one if you set the SSLKEYLOGFILE environment variable before launching them.
Point Cocoa Packet Analyzer at that file and the matching sessions decrypt — a capture you recorded weeks ago suddenly reads as ordinary requests and replies. The packets never change; you have simply supplied the missing piece.
Keys reach CPA three ways: the proxy records them automatically while it runs, you can choose a key log yourself in Settings › Analyzer › TLS Analyzer, and a pcapng file can carry its keys inside the trace — so a keyed capture stays readable when you archive it or send it to a colleague.
Keys are as sensitive as the traffic they open. CPA keeps them in a key store tied to the trace they belong to, and the TLS Keys window lists every session in a capture, which ones decrypt, and for the rest, plainly why not.
No. The proxy is the convenient route — switch it on, capture, and decryption just happens — but it is not the only one.
If you already have a key log, or a pcapng trace that carries its own keys, CPA decrypts from those alone. That matters for traffic the proxy could never sit in front of: a capture from another machine, a trace a colleague sent you, or an app that ignores the system proxy setting.
It also matters on the Mac App Store, where the sandbox rules the proxy out entirely. That edition still decrypts — from a key log you choose, or from a keyed pcapng.
Download the CPAPluginSDK above. The SamplePlugIn/CPAPluginSDK.docc/ catalog contains a step-by-step walkthrough (WritingYourFirstPlugin, ProtocolContract, ThreadingModel, DistributingYourPlugin), and the included NTPAnalyzer-XCF Xcode project shows a complete working analyzer you can build and ship as a .cpaplugin bundle. Questions welcome — feel free to reach out.
Yes — CocoaPacketAnalyzer 2.5.0 requires macOS 26 or later. Earlier systems (macOS 10.14.6 – 15.7.4) can stay on 2.1.4.