Open PCAP files in your browser
What tcpdump and Wireshark record of a network, packet by packet. Open a capture right here as a row for each packet. Nothing leaves your device.
Or drop it anywhere on this page
What you'll see
Your capture opens as a row for each packet, the first rows on show while the rest are read.
- A row for each packet • Time, source, destination, protocol and info
- Sort and filter • Counts for every column
- Each packet's layers • Its bytes as hex
- Export • Save as CSV, Excel, JSON or Parquet
About PCAP
PCAP is the capture format of tcpdump and its library, libpcap, which Van Jacobson, Steve McCanne and others at Lawrence Berkeley Laboratory wrote in the late 1980s. Wireshark, tcpdump, Npcap and most network tools read and write it, so it's how captures are handed in for classes, shared in CTFs and sent with support tickets.
A PCAP is a short header naming the link, like Ethernet or Wi-Fi, the most of each packet it keeps and whether its times are in micro or nanoseconds, then each packet with the moment it was captured, its length on the wire, how much of it was kept, and its bytes.
Filepeek reads the file in your browser in pieces and shows every packet as a row: its time, source, destination, protocol, length and a line of info, from Ethernet, Wi-Fi, ARP, IPv4 and IPv6 up to TCP, UDP, ICMP, DNS, DHCP, HTTP, TLS, QUIC, SSH and SMB, to sort and filter like any table. Double-click a packet for its layers, each with its fields, and its bytes as hex. Nothing is decrypted, and packets are never put back together into streams.
Packet Capture
.pcap
Format
- MIME type
- application/vnd.tcpdump.pcap
- Made by
- Van Jacobson, Steve McCanne and others at Lawrence Berkeley Laboratory, for tcpdump
- Released
- 1980s
Inside the file
- Header
- The link, the most of each packet kept and the time's precision
- Packets
- Each with its time, its length and its bytes
- Links
- Ethernet, Wi-Fi, Linux cooked, loopback and raw IP
- Written by
- tcpdump, Wireshark, Npcap and most network tools
Opens in every browser
Browsers download PCAP files, and Wireshark needs installing. Filepeek opens them in Chrome, Edge, Firefox and Safari, read in pieces so the first packets show at once.
- YouChromeOpens through Filepeek
- YouEdgeOpens through Filepeek
- YouFirefoxOpens through Filepeek
- YouSafariOpens through Filepeek
Questions
How do I open a PCAP file?
Drop it on this page or choose Peek a PCAP. Its packets show as rows while the rest of the file is read, with nothing to install.
Can I see a packet's headers?
Yes. Double-click a packet to see its layers, from the link up to the application, each with its fields, and its bytes as hex. Copy puts them on your clipboard as text.
Can I find the packets of one host or protocol?
Yes. Filter Source, Destination or Protocol to what you're after. A column's card counts its values, so the busiest hosts and protocols come first.
Does Filepeek decrypt TLS?
No. Encrypted traffic shows as it was sent: TLS records by their kind and length, and QUIC, SSH and WireGuard packets by their headers. A Client Hello still names the site it asked for.
Can I save the packets as a spreadsheet?
Yes. Choose Export to save every packet, or only the ones on show, as CSV, TSV, Excel, JSON, JSON Lines or Parquet.
Is my file uploaded?
No. The file is read inside your browser and never leaves your device.