About PCAPNG Analyzer

PCAPNG Analyzer is a self-hosted packet-capture analysis application created and maintained by Stuart Mathieson.

A practical tool with a defined scope

The application turns PCAP and PCAPNG files into a plain-English diagnosis: network health for DNS, TCP and HTTP, plus browser-based protocol, endpoint, conversation and application reports. It decodes DNS, HTTP, TLS, QUIC, DHCP, SSH, Kerberos, LDAP, SMB and NTP, and includes packet filtering, stream following, batch analysis, two-file comparison and exports. Optional Pro features add 44 kinds of explained finding, matching against your own threat-intel (IOC) lists, trends and “first seen” context across your history, branded incident reports with an executive summary, sanitized capture sharing, history re-scans, watched-folder ingestion, local alerts, SIEM export, API tokens, multi-user proxy authentication, larger uploads and unlimited history.

It is intended to make repeatable first-pass analysis and review easier. It does not replace Wireshark for deep protocol dissection, live capture, TLS decryption or specialist graphs. The Wireshark comparison explains those differences directly.

Privacy: no usage telemetry

PCAPNG Analyzer does not send usage telemetry, analytics, capture files, decoded packets or analysis results to Stuart Mathieson or a hosted analysis service.

The application makes only two kinds of outbound HTTPS request. If a Pro license key is configured, a license-status check carries the key and a product/version identifier; with no licensing configuration, that check does not run. And once a day it asks GitHub for the latest release number, so it can tell you about updates; that request carries nothing about your installation, and you can turn it off. Neither contains capture or analysis data. See the full security and privacy explanation.

Support from the author

Questions about setup, licensing, billing or unexpected behaviour can be sent to [email protected]. Messages are handled directly by Stuart Mathieson.

Do not send packet captures, credentials or sensitive payloads in an initial support email. Describe the issue first so a safe diagnostic approach can be agreed.

Refund promise

Your first Pro payment is refunded in full if you ask within 14 days, with no questions asked. Email [email protected] with the license key so the purchase can be identified.

How the guides are written

The technical guides describe manual Wireshark and tshark methods as well as the relevant PCAPNG Analyzer workflow. They distinguish observed packet evidence from inference, mention capture artefacts and encryption limits, and identify Pro-only features. Articles carry an author and last-updated date so readers can judge their provenance and freshness.