Turn packet captures into visual insights
Upload PCAP files or paste hex data to see traffic flows, protocol breakdowns, and potential anomalies.
Load Your Capture
Filter Protocols
Traffic Flow Visualization
Upload a PCAP file to see traffic visualization
Analysis Results
Total Packets
0
Bandwidth
0 MB/s
Protocols
TCP, UDP
Anomalies
0
No analysis results yet. Load a capture file to begin.
Understanding the Results
Traffic Timeline
The visualization shows packet flow over time. Spikes indicate potential issues or active connections.
Protocol Breakdown
Color-coded segments show which protocols dominate your traffic. Mix of TCP and UDP is normal for most networks.
Anomaly Detection
The preset filter highlights unusual patterns like port scans, DNS tunneling, or unexpected protocol spikes.
Common Use Cases
Bandwidth Troubleshooting
Upload a capture during slow periods. Look for protocol spikes and identify what's consuming bandwidth.
Security Analysis
Use anomaly detection preset to spot potential reconnaissance activity or data exfiltration patterns.
Performance Baseline
Analyze normal traffic to establish baselines for future comparison.
Frequently Asked Questions
What PCAP formats are supported?
Standard libpcap format used by Wireshark, tcpdump, and most packet capture tools. Little-endian and big-endian byte orders are handled automatically.
Can I analyze encrypted traffic?
Yes. The visualizer shows packet sizes and timing, which can reveal traffic patterns even when payload is encrypted. TLS handshakes and certificate information are extracted when possible.
How accurate is the analysis?
Accuracy depends on capture quality. Ensure your capture includes complete packets and is taken at the right network point. Network taps and SPAN ports provide better data than host-based captures.
What about false positives?
Legitimate traffic can sometimes trigger anomaly detection. Always verify findings with additional context. Cloud services, CDNs, and automated systems may generate unusual patterns that are perfectly normal.
Important Assumptions
- Capture files contain valid packet headers and payloads
- Time synchronization reflects actual capture timing
- Network addresses are not anonymized or obfuscated
- Traffic volume patterns are meaningful for anomaly detection
Last updated: January 2026