A native macOS packet analyzer.
PCAP capture, plugin-based protocol dissection, and macOS-native UI — fully rewritten in Swift.
Built for the way you analyze.
Capture
Capture Ethernet or Wi-Fi traffic in a document window — or start, watch and stop it from the menu bar.
pcapng
Read and write the modern pcapng format, with per-packet comments and embedded TLS decryption secrets.
Built for scale
A packet index and a one-pass background dissector keep multi-million-packet traces light in memory and instant to click through.
Protocol analyzers
A wide range of protocol analyzers dissect and filter your traces, down to the bytes of each field.
QUIC & HTTP/3
Full QUIC dissection with decryption at every level, HTTP/3 frames and QPACK headers readable and searchable.
Follow the conversation
Follow TCP Stream, Follow UDP Flow, and Follow QUIC Stream reassemble any conversation into one viewer with request ↔ reply pairing.
TLS / HTTPS
Dissect handshakes and certificates, decrypt TLS 1.2 / 1.3 with a key log, and see which sessions decrypt — and why the others do not.
MITM Proxy
A built-in man-in-the-middle multi-protocol proxy with a live monitor so decryption just works — no key-log file required.
HAR files
Export proxy flows as HAR, open HAR files saved by your browser’s developer tools, and copy any request as cURL.
Plugins
Write your own protocol analyzers in Swift with the CPA Plugin SDK.
QuickLook
Preview packet traces in Finder — a QuickLook extension is included just for it.
Bring your traces to paper.
Dark Mode
English, German & Japanese
Notarized by Apple- macOS 26 or later
From capture to conversation.
Start a capture
Pick an interface, set SnapLen, toggle promiscuous or Wi-Fi monitor mode, and drop in a tcpdump-compatible filter expression. The daemon compiles the BPF program before a single packet is copied to user space.
Capture to file or switch to live capturing from the same sheet — your default mode is remembered in Settings.
Live capturing
In live mode packets are dissected as they arrive. The toolbar shows a real-time traffic monitor with packet count and elapsed time while the packet list, protocol detail tree, and hex view all update continuously.
Menu bar capture
A menu bar extra for quick capture without opening a document. The popover hosts the interface picker, start/stop controls, and a live 48-bar activity histogram that keeps ticking even when the popover is closed.
Choose File mode to write a .pcap with Open / Reveal / Discard actions on stop, or Live mode to open a fresh document with capture already running — packets stream into both surfaces at once.
Pin the popover into a standalone window that survives app switches — or let it auto-detach while a capture is running so the histogram stays visible without stealing focus.
PCAP filter builder
A structured editor covering every category from the tcpdump manpage — hosts, networks, ports, VLAN, MPLS, 802.11, byte comparisons, and raw primitives. Each keystroke is validated against a dead pcap handle, so invalid filters never reach the capture daemon.
Wrap rows in NOT, combine them with AND/OR, and nest sub-groups with explicit parentheses.
Capture settings
Buffer and snaplen are dials rather than sliders, so the value you are about to capture with is readable at a glance instead of inferred from a knob position. Around them sit the interface picker, the file-or-live mode switch, monitor and promiscuous mode, the menu bar extra, and Decrypt HTTPS.
The capture filter lives at the bottom with its Build… button. Whatever you type is compiled before the daemon is asked to capture anything, so a malformed expression fails here rather than halfway through a session.
The document window
Four coordinated panes: a recents sidebar, a sortable packet list with analyzer-contributed columns, an outline view with the protocol dissection tree, and a hex view that highlights the bytes behind the selected header.
Protocol color coding in the packet list makes traffic patterns obvious at a glance.
Packet details, byte by byte
The packet-details outline has been rewritten in SwiftUI — roomier rows, center-aligned protocol icons, tooltips on long values, and ⌘C copies the selected row.
Click any leaf field and the hex view highlights only that field's bytes on the wire. Per-leaf byte ranges are wired across the full analyzer suite, down to individual flag bits in IPv4, IPv6, and TCP.
Filter and find
The toolbar search field is a single entry point for filtering: a token-style query builder, a sectioned autocomplete dropdown, rich-editor popovers for dates, protocols and grouped expressions, and a saved-query library — all without leaving the document window.
Toggle Open result in new document to route the filtered subset into its own window, ready to save as a standalone .pcap.
Built for large traces
Version 4 opens a document through a packet index instead of keeping every packet resident. A background pass dissects each packet once, and every later stream and statistics request is answered from that result. Reassembly runs off the main thread.
A file with millions of packets opens without a stall, uses a fraction of the memory it used to, and releases that memory when closed. Smaller traces benefit too: clicking through a live capture responds immediately, holding an arrow key costs nothing, and cancelling an analysis genuinely stops it.
Follow TCP stream
Reassemble any bidirectional TCP conversation and switch between four view modes: Conversation (speech bubbles with packet numbers and flags), ASCII transcript, side-by-side hex dump, and a parsed HTTP request/response view.
The HTTP view pairs each request with its reply, lists the headers, and reconstructs the message body straight from the segments — decoding chunked and gzip transfers and rendering image payloads inline. A header strip tracks the client, server, segment and byte counts, duration, and connection state, and every message links back to its packet in the trace.
The stream popup walks every conversation detected in the trace.
Follow UDP Flow
The whole conversation behind any UDP packet, datagram by datagram: four display modes, a search that also matches message bodies, an ASCII pane that narrows to the matches, detail rows taken from the dissector, and request ↔ reply pairing for the protocols that have one.
QUIC, dissected and decrypted
The QUIC analyzer follows RFC 9000 across coalesced datagrams — long and short headers, every frame type, connection identity per flow, and packet numbers per number space. Initial packets decrypt from the connection ID alone; Handshake and 1-RTT packets decrypt from key-log material, following key updates as they happen. When a packet cannot be decrypted, the tree states the reason and offers the key-log chooser in place.
HTTP/3 is recognised by ALPN and confirmed by the shape of the stream, and QPACK headers — static and dynamic tables, in both directions — are decoded so requests and responses read as plain text. Follow QUIC Stream reassembles any stream into the same viewer used for TCP.
Subscriber Session Inspector
Follow a broadband subscriber through the whole bring-up. The inspector stitches PPPoE, L2TP, PPP control, and RADIUS exchanges into a single session and draws them as a LAC ↔ LNS ladder — Setup, Link, Auth, Network, and Data phases laid out in order, each arrow pointing the way the message travelled.
A summary bar pulls out the essentials: user, session and tunnel IDs, authentication method, assigned IP, LNS, and call duration. The sidebar lists every session in the trace, and any rung expands to its full protocol detail.
Protocol statistics
Get a one-look summary of any trace: a bar chart of protocol distribution next to the file's metadata — link type, packet count, byte totals, and capture time span.
Open it from the Data Sources Manager or the document sidebar, and send it straight to the printer when you need a paper copy for a report.
Analyzer settings
Pick a protocol analyzer and its settings appear beside it — no nested sheet to open and dismiss. Each plugin declares what it offers, so the pane builds itself: name resolution, checksum verification, credential masking, HTTP/2 detection, and whatever else that protocol supports.
The Ports table decides which traffic reaches the analyzer at all, and the colour well beside Packet coloring sets the shade that protocol wears in the packet list. Reset restores one analyzer’s defaults without touching the rest.
TLS, dissected and decrypted
The TLS analyzer breaks down the record layer, handshake, and extensions with per-field byte highlighting in the hex view, parses the certificate chain (subject, issuer, validity, serial, SANs), and pairs each ClientHello with its ServerHello. TLS is detected by content, so it is recognised on any port.
Point Cocoa Packet Analyzer at an SSLKEYLOGFILE and Follow TCP Stream decrypts TLS 1.2 (AEAD) and TLS 1.3 application data, re-feeds the plaintext through the inner interpreters, and surfaces the decrypted HTTP request ↔ reply pairings — each mapped back to every contributing packet.
Know what decrypts
The TLS Keys window lists every TLS session in a trace beside the key material held for it, and says plainly which ones decrypt — and for the rest, why not: no keys were ever recorded, a secret is missing, the key belongs to another session, or the version is out of reach.
A coverage band sums up the whole capture at a glance. Export the secrets you need as a key-log file or a CSV report, or jump straight from a session to its first packet.
The key store remembers
Keys outlive the capture that produced them. The key store is an app-wide vault of every secret Cocoa Packet Analyzer has recorded, frozen per trace and stamped with a fingerprint and path so it knows which file a set belongs to.
Each entry carries its state plainly: Linked when the trace is still where it was and has not changed, Unattributed when secrets arrived with no trace to pin them to. Verify All re-checks every entry against disk, and the dated live keylog keeps collecting so a session recorded weeks ago still opens today.
Key material from wherever you keep it
The TLS Keys window's Sources pane lists everywhere key material comes from. Add as many key-log files as you like, or add a folder and every key log inside it is read. A trace with a .keys file beside it decrypts the moment it opens, a running capture's secrets are counted as they arrive, and open stream windows decrypt within seconds of a key arriving.
CPA MITM Proxy
A built-in man-in-the-middle multi-protocol proxy that makes decryption just work — no key-log file required (non–App Store builds). It generates its own root certificate authority, installs it into your login keychain on request, mints per-host leaf certificates on the fly, and toggles the system web proxy for you, restoring your previous settings when it stops.
It carries plain HTTP, HTTPS, HTTP/2 and WebSockets. The live monitor names what each flow is — REST, GraphQL with its operation, gRPC and gRPC-Web, server-sent events, forms, uploads, SOAP, pages and assets — and shows bodies decoded, WebSocket messages one by one, and gRPC messages field by field without a .proto file.
Save flows as a HAR file, open HAR files from your browser in the same monitor, or copy a request as cURL. Connect a Device walks an iPhone, iPad or another computer through using the proxy with a QR code. Turn on Decrypt HTTPS while capturing and the proxy's session keys are bridged straight into the trace, so captured HTTPS is decrypted end to end.
MITM Proxy settings
One switch routes your Mac’s HTTP and HTTPS through Cocoa Packet Analyzer, and one field sets the port it listens on. Turning it off puts your previous proxy configuration back the way it was.
Beside them, the root certificate reports its own SHA-256 fingerprint and whether macOS currently trusts it, with the trust, untrust and export actions in the gear menu. Decryption either works or tells you which of these two things is missing. Direct-download builds only.
General settings
Three tiles for appearance — Light, Dark, or Auto to follow macOS. Every window is drawn for both, so neither is the afterthought.
Packet traces carry no time zone of their own, so timestamps default to yours; pick a different one and the whole trace re-reads in it. Update checks are opt-in, and so is the anonymous system profile that comes with them.
Font settings
Six surfaces, six independent choices: the packet list, the hex and stream console, the protocol detail tree, the statistics chart, and both halves of the Data Sources list.
The console setting reaches everywhere raw bytes and reconstructed streams are shown, so Follow TCP Stream, Follow UDP Flow and the Subscriber Session Inspector all follow it.
Get CocoaPacketAnalyzer.
Version 4.0.3
The latest release. Universal binary.
Requires macOS 26 or later.
4.0.3 brings plain HTTP, WebSockets and HTTP/2 to the MITM proxy, shows gRPC calls and WebSocket messages in the Monitor, saves and opens HAR files, decodes OCSP and stapled certificate status, says when the capture helper needs attention, and is faster with less memory.
CPAPluginSDK 4.0.3
Single-import Swift SDK for writing .cpaplugin protocol analyzers, on a new, smaller API — plug-ins built with SDK 4.0.2 load unchanged; plug-ins built against earlier SDKs must be rebuilt. Analyzer settings are declarative: declare your packet coloring, options and ports, and the app renders the pane for you under Settings ▸ Analyzers, matching the built-in analyzers. Includes DocC documentation, an NTP analyzer sample (XCFramework workflow) and a TFTP sample whose dissector is written in Objective-C behind a small Swift shim. Requires CPA 4.0.3+.
Version 2.1.4
Previous release. Universal binary.
For Macs running macOS 10.14.6 – 15.7.4. Not compatible with macOS 26.
Frequently asked questions.
The ethernet and wifi interfaces that come with your Mac should just work fine!
Ethertypes: ARP, IP (v4/v6), PPP, PPPoED/S, 802.1Q VLAN, MPLS
Linktypes: Loopback, PPP, LinuxSLL, IEEE802.11-RadioTap
Analyzer plugIns for the following protocols are included:
Link & framing: Ethernet, ARP, 802.1Q VLAN, MPLS, PPP, PPPoE (Discovery & Session), LinuxSLL, IEEE 802.11 RadioTap, Loopback
Network: IP (v4/v6), ICMP (v4/v6), IGMP, OSPF, Mobility, ESP
Transport & tunneling: TCP, UDP, L2TP, MPLS-in-IP
PPP control: LCP, IPCP (v4/v6), CCP, PAP, CHAP
Application: HTTP, WebSocket, DNS, DHCP (v4/v6), FTP, SMTP, POP3, IMAP, NNTP, SSH, Telnet, SIP, IAX, SNMP, LDAP, BGP, RADIUS, SMB, SOAP, Hotline
Promiscuous mode can be enabled in the capture preferences. Most interfaces in Apple Computers should support it.
Monitor mode allows packets to be captured without having to associate with an access point or ad hoc network first. Monitor mode only applies to wireless networks. Not all wifi interfaces support it. It can be enabled in the capture preferences.
Monitor and promiscuous mode wont work if both are enabled.
Captured HTTPS is encrypted. From the packets alone you can see that your Mac talked to a host, when, and how much — but not a word of what was said. That is HTTPS working as intended, and no amount of analysis undoes it after the fact.
The proxy solves it by standing in the middle, with your permission. It runs locally, mints its own certificate authority, and asks macOS to route your web traffic through it. To your browser it looks like the far end; to the far end it looks like your browser. Because it terminates each connection itself, it holds the keys — so it can show you every request and response as plain text, and hand those keys to the analyzer so your captured packets decrypt too.
“MITM” is man-in-the-middle, normally the name of an attack. This is the same technique aimed at your own machine, and only while you switch it on: you have to trust its certificate, your previous proxy settings are restored when you stop, and nothing leaves your Mac. While it is running it can read the HTTPS of every app that uses the system proxy — so turn it off when you are done, and only inspect traffic you are entitled to.
Part of the direct-download build. The Mac App Store sandbox does not permit it.
A key log is a small text file that writes down the secret each encrypted connection used, so a capture can be read afterwards.
When a browser opens an HTTPS connection it negotiates a fresh secret with the server. Nobody watching the wire can work it out — that is the whole design. But both ends know it, and either end is free to write it down. A key log is exactly that: one line per session, linking a connection to its secret. Most browsers will produce one if you set the SSLKEYLOGFILE environment variable before launching them.
Point Cocoa Packet Analyzer at that file and the matching sessions decrypt — a capture you recorded weeks ago suddenly reads as ordinary requests and replies. The packets never change; you have simply supplied the missing piece.
Keys reach CPA three ways: the proxy records them automatically while it runs, you can choose a key log yourself in Settings › Analyzer › TLS Analyzer, and a pcapng file can carry its keys inside the trace — so a keyed capture stays readable when you archive it or send it to a colleague.
Keys are as sensitive as the traffic they open. CPA keeps them in a key store tied to the trace they belong to, and the TLS Keys window lists every session in a capture, which ones decrypt, and for the rest, plainly why not.
No. The proxy is the convenient route — switch it on, capture, and decryption just happens — but it is not the only one.
If you already have a key log, or a pcapng trace that carries its own keys, CPA decrypts from those alone. That matters for traffic the proxy could never sit in front of: a capture from another machine, a trace a colleague sent you, or an app that ignores the system proxy setting.
It also matters on the Mac App Store, where the sandbox rules the proxy out entirely. That edition still decrypts — from a key log you choose, or from a keyed pcapng.
Download the CPAPluginSDK above. The SamplePlugIn/CPAPluginSDK.docc/ catalog contains a step-by-step walkthrough (WritingYourFirstPlugin, ProtocolContract, ThreadingModel, DistributingYourPlugin), and the included NTPAnalyzer-XCF Xcode project shows a complete working analyzer you can build and ship as a .cpaplugin bundle; TFTPAnalyzer-ObjC shows the same with the dissector in Objective-C (UsingObjectiveC). Questions welcome — feel free to reach out.
Yes — CocoaPacketAnalyzer 2.5.0 requires macOS 26 or later. Earlier systems (macOS 10.14.6 – 15.7.4) can stay on 2.1.4.