Overview
PCAPNG Analyzer Free is a Windows desktop app for offline analysis of network packet capture files. Drop in a .pcapng or .pcap file and get an interactive breakdown of protocols, IP addresses, ports, DNS queries, HTTP hosts, TLS server names, TCP flags, traffic timelines, top talkers, conversations, packet size statistics, and a filterable packet list.
The app is built with Tauri and runs entirely on your local machine. No capture data or analysis results are ever sent to external servers.
Features
Analysis panels
| Panel | What it shows |
|---|---|
| Summary | Total packets, total bytes, capture start/end time, duration |
| Protocol Distribution | Bar chart + counts for every protocol seen (TCP, UDP, ICMP, ARP, …) |
| Traffic Over Time | Line chart of packets and bytes per second across the capture window |
| Top Talkers | Top 10 IPs ranked by packet count and by byte volume |
| Conversations | Top 20 IP pairs ranked by packet count |
| Source / Destination IPs | Top IPs with packet counts; full list in modal |
| Source / Destination Ports | Top ports with packet counts; full list in modal |
| MAC Addresses | Source and destination MAC address counts |
| TCP Flags | SYN, ACK, FIN, RST, PSH, URG counts |
| TTL Distribution | Counts of IP time-to-live values, with the full list one click away |
| Packet Size Stats | Min, max, average, std deviation |
| DNS Queries & RCODE breakdown | Domain names seen in DNS query packets; response code counts (NXDOMAIN and SERVFAIL highlighted) |
| HTTP Hosts & Methods | HTTP Host header values and methods (GET, POST, …) |
| TLS SNI & Version | Server Name Indication values from TLS ClientHello packets; TLS version breakdown |
| Packet List | Paginated, filterable table with per-packet layer detail |
Other features
- Analysis history — last 25 analyses stored locally and re-openable without re-uploading
- Re-analyze — reprocess a stored capture without uploading again
- Export — download full analysis as JSON or a ZIP of CSV files
- Dark mode — toggle between light and dark themes
Using the app
Uploading a file
On the New Analysis screen, click the upload area and select a .pcapng or .pcap file (max 1 GB), then click Analyze File. Processing happens in the background; a live packet count is shown as the file is read. When complete, click View Analysis to open the results.
Navigating results
The analysis dashboard is divided into sections. Panels with more rows than shown offer a See more button that opens the full list in a modal.
Filtering packets
In the Packet List panel, use the filter controls to narrow results by protocol, source IP, destination IP, source port, or destination port. Filters can be combined.
Analysis history
Click Analysis History in the top navigation to see the last 25 analyses. From there you can open, re-analyze, or delete any entry.
Exporting results
Inside an open analysis, click Export and choose JSON (full analysis object) or CSV ZIP (one CSV per data category).
Stopping an analysis
Click Stop during processing to cancel and discard the in-progress file.
Data & privacy
- All processing is local. No capture data or analysis results leave your machine.
- Uploaded files and analysis results are stored in the application's local data folder on your machine.
- When a 26th file is uploaded, the oldest file and all its associated data is deleted automatically.
- To remove all stored data, use Analysis History → delete all, or uninstall the application.
Free tier limits
| Limit | Value |
|---|---|
| Maximum file size | 1 GB |
| Analysis history | Last 25 files |
| File format | .pcapng and .pcap |
| Batch processing | Not available (one file at a time) |
| Threat detection | Not available (Pro only) |
Troubleshooting
App window is blank or shows a loading spinner indefinitely
The backend service may have failed to start. Check the application log file (available from the Help menu, or in your system's app data folder under PCAPNG Analyzer Free). Common causes: antivirus software blocking the application, or a previous instance still running — only one instance is allowed at a time.
"Invalid file type" or "Invalid file content" error
Both .pcapng and .pcap files are accepted. If Wireshark can open the file, use File → Save As and save in your preferred format, then try again.
"Processing timed out"
Very large files on slower machines may take longer than the default wait. Check Analysis History — if the file completed in the background it will appear there.
Older analyses are being deleted
The free tier keeps only the last 25 analyses. When a 26th file is uploaded, the oldest is removed automatically. Upgrade to Pro for unlimited history.