TCP Viewer

About

TCP Viewer is a native packet viewer for Mac that aims to be a simpler alternative to Wireshark. You choose an interface, start recording, and keep the capture readable even when the network is busy. It is built on Wireshark's packet analysis engine, so you can explore decoded protocols, field values, and raw bytes in a Mac interface. You can also follow a TCP stream to read a whole conversation, with both directions together or isolated, and switch between text and hex views.

TCP Viewer also works with saved captures. You can drag and drop PCAP or PCAPNG files to preview packets without a live recording session. To keep traffic manageable, it offers grouping by domain or client, protocol filters for TCP, UDP, DNS, and more, and support for pasting Wireshark display filters without changing the capture. An Overview dashboard shows packets and throughput over time, top apps, domains, and ports, and flags lost segments, retransmissions, and resets. Packet Diff compares two packets side by side or in a unified view.

You can export selected or filtered packets as PCAP or PCAPNG files for Wireshark or teammates. A command-line tool is included with TCP Viewer for starting and stopping captures, querying packets, and exporting files from scripts. TCP Viewer runs on Apple Silicon Macs with macOS 15 or later and is distributed under GPL v2 or later, in line with Wireshark's license.