Cocoa Packet Analyzer

About

Cocoa Packet Analyzer is a free, native macOS app for capturing network traffic and tracing each packet back to the app that sent it. It supports live capture on Ethernet and Wi-Fi interfaces, including a menu bar mode and several captures side by side, and it can read and write pcap and pcapng files. Its Record processes option attaches the sending or receiving app to every packet, and an Applications window totals packets and bytes per app.

The app decrypts TLS 1.2 and 1.3 traffic from a key log or from keys embedded in a pcapng, and it includes a built-in HTTPS proxy with a live monitor that names each request's app. Decrypted HTTP/2, gRPC, and HTTP/3 over QUIC can be inspected by headers, bodies, and request-response pairs. It also imports and exports HAR files and can copy requests as cURL. More than 50 protocol analyzers are included, and developers can write their own in Swift with the Plugin SDK.

Cocoa Packet Analyzer is available as a direct download, through Homebrew, or on the Mac App Store. The download includes capturing; the Mac App Store version omits capture features but still analyzes files, follows streams, decrypts HTTPS, and includes the MITM Proxy. The app supports macOS 26, is notarized by Apple, and is available in English, German, and Japanese.