PCAP and PCAPNG analysis in your browser

Online PCAP Analyzer Uncover what happened on your network.

Detect exposed credentials, trace suspicious connections and recover HTTP files fast. A-Packets ties each finding to its hosts and sessions in one interactive investigation report.

Analyze PCAP Free Explore Real Reports

Free uploads create public reports. Use only sanitized captures.

Up to 25 MB. No account required. For sensitive traffic, choose private analysis or OnPrem.

374,134 PCAPs analyzed

What can you learn from a PCAP?

See what these captures reveal: SQL injection attempts, exposed logins, a DNS tunnel and the connections and files behind the activity. Open a report and follow the evidence.

Browse all 20 sample reports

Follow the evidence through the capture.

Start with a host. Inspect its connections, read the captured exchanges, and examine the credentials and files they carried.

  1. 1. Upload your capture

    Upload a PCAP or PCAPNG. Use free public analysis only for sanitized captures, paid private analysis for sensitive data, or OnPrem inside your infrastructure.

  2. 2. Trace the activity

    Follow hosts across the network map, connections and protocol views. Find the sessions that explain a suspicious destination, an exposed login or a transferred file.

  3. 3. Inspect the evidence

    Read the requests, review exposed logins and examine recovered HTTP files. Confirm packet-level details in Wireshark and share public reports only when their contents are appropriate to share.

What you can find out from a capture

The report brings up what needs attention as soon as it opens, and every view below takes you from a finding to the evidence behind it. What a view can show depends on the traffic that reached the capture point.

  • Did passwords cross the network in clear text?

    Credentials lists each login the capture exposes with its protocol, client, server, user name and password or challenge-response hash. FTP, Telnet, HTTP Basic, SMTP, IMAP and SNMP carry the secret itself; treat NTLM and Kerberos exchanges as exposed until the password is checked. Logins typed into web forms appear in the HTTP view.

    See seven mail logins in one capture

  • What did web clients ask for, and what came back?

    HTTP pairs every request with its response: method, URL, headers, status and the start of each body, grouped by connection. A SQL injection in a URL, a password in a POST or a script pulled by PowerShell reads the way the server received it, and larger bodies download as files.

    See a traversal proven by the response

  • Which files crossed the wire?

    Pictures and Documents gather the images, PDFs and Office files carved from HTTP, with gzip and chunked encoding undone. The HTTP view shows the request behind each one, so you know where a file came from before you open it in an isolated VM. Transfers over TLS, FTP, SMB or email are not carved.

    See the archives a macOS stealer uploaded

  • Which hosts talked to whom, and how much?

    Network draws every IP address and its peers, with a filter per protocol; click a host for its country, NetBIOS name, OS and User-Agent. Connections ranks host pairs by bytes, so the biggest transfer stands out, and Open Ports lists the TCP ports that answered.

    See which of 1,000 scanned ports answered

  • Do these DNS lookups look normal?

    DNS lists every DNS, mDNS and NBNS query by client and server, with failed lookups and their error codes. Hundreds of long, random names under one domain, or a wall of NXDOMAIN answers for guessed subdomains, are easy to spot in one table. Calling it a tunnel stays your decision.

    See 1,301 guessed subdomains

  • What does encrypted traffic still give away?

    SSL/TLS shows each session's server name, versions, ciphers and certificate chain, and flags expired or self-signed certificates and Heartbleed attempts. Payloads stay encrypted, yet a host that keeps opening sessions to a look-alike domain is visible without them.

    See a Cobalt Strike beacon behind TLS

  • What else is on this LAN or Wi-Fi capture?

    ARP maps which MAC answered for which address and marks the router. Ethernet names MAC vendors, SMB shows host announcements with OS versions, and SIP, SSDP, FTP and Telnet each get a view of their messages. From 802.11 captures you also get access points, probe requests and WPA handshakes.

    See four ARP frames take over a gateway

  • Want an email when a private capture holds a finding?

    Private workspaces can email you after each report. On Advanced the email covers cleartext logins and hashes, failed DNS lookups, expired or self-signed certificates, Heartbleed attempts, ARP spoofing and signs of an Nmap scan; Professional covers failed DNS lookups. Public analysis sends no email.

    Compare private plans

Between the alert and Wireshark

A capture usually arrives with a question attached: an IDS alert on a workstation, an EDR detection, a client asking what left their network. A-Packets gets you to the answer fast: what looks wrong, which hosts were involved, what they sent and which logins and files crossed the wire, before anyone scrolls through packets.

Nothing in your stack has to change: the SIEM raises the alert, A-Packets explains the capture, and Wireshark or tshark proves the frames at the host, port and time the report points to.

Weighing other tools? See online PCAP analyzers compared, including the jobs where Wireshark, NetworkMiner or PacketSafari is the better pick.

Who uses it

  • SOC analysts checking what a host did behind an alert
  • Incident responders and DFIR consultants working through a client's capture in a private workspace
  • Pentesters and auditors showing which logins still travel in clear text
  • Network engineers, teachers and students who need to open a capture without installing Wireshark

What you bring

A .pcap or .pcapng file from Wireshark, tcpdump, pktmon, a SPAN port or a sensor. Nothing is installed on your hosts, and every finding comes with the evidence to act on it.

Analysis Modes

Choose by what is in the capture

A lab or CTF capture can be public. A client's network or an open incident cannot. Pick the mode before you pick the file.

Start Free

Lab, CTF or sample capture

Public analysis

Free, with no account. The report gets a public link and is listed in the public feed, so upload only traffic you would be comfortable posting.

  • No signup required
  • Report opens in your browser after processing
  • 25 MB per capture
Upload a sanitized PCAP
Private Plans

Client, incident or internal capture

Private analysis

The report stays in your workspace and never reaches the public feed. Buy credits for one case, or subscribe when private captures are part of the job.

Packs from $6.99 · Workspaces from $11.99/month

  • Visible only to your workspace
  • Captures up to 50 MB on Professional, 100 MB on Advanced
  • REST API and email alerts on Professional and Advanced
See private plans
On-Prem

Capture can't leave your network

On-prem deployment

Run A-Packets on your own infrastructure when policy, regulation or an air gap keeps captures inside.

  • Captures and reports stay on your servers
  • Docker Compose, Kubernetes with Helm or an air-gapped package
  • Install guides published in the documentation
See the self-hosted PCAP analyzer

Online PCAP analyzer FAQ

What people ask before their first upload.

Do I need to install anything or sign up?
No. Upload a .pcap or .pcapng file of up to 25 MB and the report opens in your browser, with no account and nothing to install. The report is public, so upload sanitized or sample captures only.
Is it safe to upload a capture with real traffic?
Not in public mode: anyone with the link can open the report and the files carved from it. For client, incident or internal traffic, use a private plan, or run the self-hosted PCAP analyzer so the capture never leaves your network.
What file formats does A-Packets support?
A-Packets reads .pcap and .pcapng files written by Wireshark, tcpdump, dumpcap and similar tools, and a .cap file when it holds libpcap data. Compressed archives are not accepted, and a Windows pktmon .etl file needs converting first. See how to record a capture.
How do I choose between Packs, subscriptions, and on-prem?
Buy a Pack when one sensitive capture needs a private report, subscribe when private captures are part of regular SOC or DFIR work, and choose on-prem when captures may not leave your environment.

See what your capture reveals

Free uploads create public reports. Use only sanitized captures. Keep sensitive traffic private, or analyze it inside your own infrastructure.

Analyze PCAP Free View Private Plans Explore OnPrem

Not ready to upload your own capture? Open one of 20 sample reports.