A native macOS packet analyzer.
PCAP capture, plugin-based protocol dissection, and macOS-native UI — fully rewritten in Swift.
Built for the way you analyze.
Capture
Capture network traffic using Ethernet or Wi-Fi interfaces.
Analyze
A variety of network protocol analyzers to display and filter your trace files are included.
QuickLook
Preview packet traces in Finder - a QuickLook extension is included just for it.
Enhance
Creating analyzer plugins using the Cocoa bundles plugin technology should be straightforward.
Dark Mode
Supporting all appearance modes of macOS.
Bring your traces to paper.
Notarized
Releases are notarized by Apple. Beta builds might not be.
Localization
English, German and basic Japanese localizations are included.
TLS / HTTPS
Dissect the TLS handshake and certificates, and decrypt TLS 1.2 / 1.3 traffic with an SSLKEYLOGFILE.
MITM Proxy
A built-in HTTPS proxy with a live flow inspector so decryption just works — no key-log file required.
pcapng
Read and write the modern pcapng format, with per-packet comments and embedded TLS decryption secrets.
From capture to conversation.
Start a capture
Pick an interface, set SnapLen, toggle promiscuous or Wi-Fi monitor mode, and drop in a tcpdump-compatible filter expression. The daemon compiles the BPF program before a single packet is copied to user space.
Capture to file or switch to live capturing from the same sheet — your default mode is remembered in Settings.
Live capturing
In live mode packets are dissected as they arrive. The toolbar shows a real-time traffic monitor with packet count and elapsed time while the packet list, protocol detail tree, and hex view all update continuously.
Menu bar capture
A menu bar extra for quick capture without opening a document. The popover hosts the interface picker, start/stop controls, and a live 48-bar activity histogram that keeps ticking even when the popover is closed.
Choose File mode to write a .pcap with Open / Reveal / Discard actions on stop, or Live mode to open a fresh document with capture already running — packets stream into both surfaces at once.
Pin the popover into a standalone window that survives app switches — or let it auto-detach while a capture is running so the histogram stays visible without stealing focus.
Packet details, byte by byte
The packet-details outline has been rewritten in SwiftUI — roomier rows, center-aligned protocol icons, tooltips on long values, and ⌘C copies the selected row.
Click any leaf field and the hex view highlights only that field's bytes on the wire. Per-leaf byte ranges are wired across the full analyzer suite, down to individual flag bits in IPv4, IPv6, and TCP.
PCAP filter builder
A structured editor covering every category from the tcpdump manpage — hosts, networks, ports, VLAN, MPLS, 802.11, byte comparisons, and raw primitives. Each keystroke is validated against a dead pcap handle, so invalid filters never reach the capture daemon.
Wrap rows in NOT, combine them with AND/OR, and nest sub-groups with explicit parentheses.
The document window
Four coordinated panes: a recents sidebar, a sortable packet list with analyzer-contributed columns, an outline view with the protocol dissection tree, and a hex view that highlights the bytes behind the selected header.
Protocol color coding in the packet list makes traffic patterns obvious at a glance.
Filter and find
The toolbar search field is a single entry point for filtering: a token-style query builder, a sectioned autocomplete dropdown, rich-editor popovers for dates, protocols and grouped expressions, and a saved-query library — all without leaving the document window.
Toggle Open result in new document to route the filtered subset into its own window, ready to save as a standalone .pcap.
Follow TCP stream
Reassemble any bidirectional TCP conversation and switch between four view modes: Conversation (speech bubbles with packet numbers and flags), ASCII transcript, side-by-side hex dump, and a parsed HTTP request/response view.
The HTTP view pairs each request with its reply, lists the headers, and reconstructs the message body straight from the segments — decoding chunked and gzip transfers and rendering image payloads inline. A header strip tracks the client, server, segment and byte counts, duration, and connection state, and every message links back to its packet in the trace.
The stream popup walks every conversation detected in the trace.
TLS, dissected and decrypted
The TLS analyzer breaks down the record layer, handshake, and extensions with per-field byte highlighting in the hex view, parses the certificate chain (subject, issuer, validity, serial, SANs), and pairs each ClientHello with its ServerHello. TLS is detected by content, so it is recognised on any port.
Point Cocoa Packet Analyzer at an SSLKEYLOGFILE and Follow TCP Stream decrypts TLS 1.2 (AEAD) and TLS 1.3 application data, re-feeds the plaintext through the inner interpreters, and surfaces the decrypted HTTP request ↔ reply pairings — each mapped back to every contributing packet.
CPA MITM Proxy
A built-in man-in-the-middle HTTPS proxy that makes decryption just work — no key-log file required (non–App Store builds). It generates its own root certificate authority, installs it into your login keychain on request, mints per-host leaf certificates on the fly, and toggles the system web proxy for you, restoring your previous settings when it stops.
A live Flow Inspector window lists HTTP(S) transactions as they happen, with full request and response detail (headers, body, hex / JSON) plus drag and copy. Turn on Decrypt HTTPS while capturing and the proxy's session keys are bridged straight into the trace, so captured HTTPS is decrypted end to end.
Subscriber Session Inspector
Follow a broadband subscriber through the whole bring-up. The inspector stitches PPPoE, L2TP, PPP control, and RADIUS exchanges into a single session and draws them as a LAC ↔ LNS ladder — Setup, Link, Auth, Network, and Data phases laid out in order, each arrow pointing the way the message travelled.
A summary bar pulls out the essentials: user, session and tunnel IDs, authentication method, assigned IP, LNS, and call duration. The sidebar lists every session in the trace, and any rung expands to its full protocol detail.
Protocol statistics
Get a one-look summary of any trace: a bar chart of protocol distribution next to the file's metadata — link type, packet count, byte totals, and capture time span.
Open it from the Data Sources Manager or the document sidebar, and send it straight to the printer when you need a paper copy for a report.
Get CocoaPacketAnalyzer.
Version 2.6.0
The latest release. Universal binary.
Requires macOS 26 or later. New TLS / HTTPS analyzer with certificate and handshake dissection and TLS 1.2 / 1.3 decryption via an SSLKEYLOGFILE in Follow TCP Stream; a built-in CPA MITM Proxy with a live flow inspector so HTTPS decryption just works, no key-log file required; native pcapng read & write with embedded TLS decryption secrets, plus QuickLook previews and pcapng file metadata; a redesigned Xcode-style Welcome window; link-layer-padding fix for TCP reassembly; and expanded German & Japanese localization.
CPAPluginSDK 2.5.6
Single-import Swift SDK for writing .cpaplugin protocol analyzers. Includes DocC documentation and an NTP analyzer sample (XCFramework workflow). Requires CPA 2.5.6+.
Version 2.1.4
Previous release. Universal binary.
For Macs running macOS 10.14.6 – 15.7.4. Not compatible with macOS 26.
Frequently asked questions.
The ethernet and wifi interfaces that come with your Mac should just work fine!
Ethertypes: ARP, IP (v4/v6), PPP, PPPoED/S, 802.1Q VLAN, MPLS
Linktypes: Loopback, PPP, LinuxSLL, IEEE802.11-RadioTap
Analyzer plugIns for the following protocols are included:
Link & framing: Ethernet, ARP, 802.1Q VLAN, MPLS, PPP, PPPoE (Discovery & Session), LinuxSLL, IEEE 802.11 RadioTap, Loopback
Network: IP (v4/v6), ICMP (v4/v6), IGMP, OSPF, Mobility, ESP
Transport & tunneling: TCP, UDP, L2TP, MPLS-in-IP
PPP control: LCP, IPCP (v4/v6), CCP, PAP, CHAP
Application: HTTP, WebSocket, DNS, DHCP (v4/v6), FTP, SMTP, POP3, IMAP, NNTP, SSH, Telnet, SIP, IAX, SNMP, LDAP, BGP, RADIUS, SMB, SOAP, Hotline
Promiscuous mode can be enabled in the capture preferences. Most interfaces in Apple Computers should support it.
Monitor mode allows packets to be captured without having to associate with an access point or ad hoc network first. Monitor mode only applies to wireless networks. Not all wifi interfaces support it. It can be enabled in the capture preferences.
Monitor and promiscuous mode wont work if both are enabled.
Download the CPAPluginSDK above. The SamplePlugIn/CPAPluginSDK.docc/ catalog contains a step-by-step walkthrough (WritingYourFirstPlugin, ProtocolContract, ThreadingModel, DistributingYourPlugin), and the included NTPAnalyzer-XCF Xcode project shows a complete working analyzer you can build and ship as a .cpaplugin bundle. Questions welcome — feel free to reach out.
Yes — CocoaPacketAnalyzer 2.5.0 requires macOS 26 or later. Earlier systems (macOS 10.14.6 – 15.7.4) can stay on 2.1.4.