Open PCAPNG files in your browser
Wireshark's own capture format, packet by packet. Open a capture right here as a row for each packet, with every interface it listened on. Nothing leaves your device.
Or drop it anywhere on this page
What you'll see
Your capture opens as a row for each packet, the first rows on show while the rest are read.
- A row for each packet • Time, source, destination, protocol and info
- Sort and filter • Counts for every column
- Each packet's layers • Its bytes as hex
- Export • Save as CSV, Excel, JSON or Parquet
About PCAPNG
PCAPNG is the format Wireshark saves captures in. WinPcap's developers drew it up in 2004 to keep more than PCAP can, Wireshark made it its default in 2012, and it's now an IETF draft that dumpcap, tshark and most capture tools write and tcpdump reads.
A PCAPNG is made of blocks: a section header with the machine, the system and the app that captured, a block for each interface with its name, link and time precision, then the packets, each on its interface and often with a comment, and the names it resolved, its statistics and sometimes the keys of the TLS sessions it saw.
Filepeek reads the file in your browser in pieces and shows every packet as a row: its time, source, destination, protocol, length and a line of info, from Ethernet, Wi-Fi, ARP, IPv4 and IPv6 up to TCP, UDP, ICMP, DNS, DHCP, HTTP, TLS, QUIC, SSH and SMB, to sort and filter like any table. Double-click a packet for its interface, comments, layers and bytes, and Show details for every interface with its statistics. Nothing is decrypted, not even with keys the file carries.
PCAP Next Generation
.pcapng
Format
- MIME type
- application/x-pcapng
- Made by
- WinPcap's developers, then Wireshark's
- Released
- 2004
Inside the file
- Section
- The machine, the system and the app that captured
- Interfaces
- Each with its name, link, time precision and statistics
- Packets
- Each with its interface, its time, its bytes and a comment
- Written by
- Wireshark, dumpcap, tshark and most capture tools
Opens in every browser
Browsers download PCAPNG files, and Wireshark needs installing. Filepeek opens them in Chrome, Edge, Firefox and Safari, read in pieces so the first packets show at once.
- YouChromeOpens through Filepeek
- YouEdgeOpens through Filepeek
- YouFirefoxOpens through Filepeek
- YouSafariOpens through Filepeek
Questions
How do I open a PCAPNG file?
Drop it on this page or choose Peek a PCAPNG. Its packets show as rows while the rest of the file is read, with nothing to install.
Can I see a packet's headers and comments?
Yes. Double-click a packet to see its interface, its comments, its layers from the link up to the application, each with its fields, and its bytes as hex. Copy puts them on your clipboard as text.
Which interfaces did the capture listen on?
Choose Show details. Each interface has its name, link, filter and time precision, and the packets it received and dropped when the capture saved them.
Does Filepeek decrypt TLS with the keys in the file?
No. Show details says which keys the capture carries, and Filepeek never uses them. Encrypted traffic shows as it was sent, and a Client Hello still names the site it asked for.
Can I save the packets as a spreadsheet?
Yes. Choose Export to save every packet, or only the ones on show, as CSV, TSV, Excel, JSON, JSON Lines or Parquet.
Is my file uploaded?
No. The file is read inside your browser and never leaves your device.