TCP Viewer

A simple, native packet viewer for Mac.

Website · Download · Docs · Releases

TCP Viewer captures and reads network packets on macOS. It uses system libpcap for capture and Wireshark libraries for deep packet details.

Features

• Native macOS app, built with AppKit
• Built on top of Wireshark Lib, alternative to Wireshark
• Capture live traffic.
• Group packets by app, domain, or IP address.
• Filter TCP, UDP, DNS, HTTP, TLS, WebSocket, and more.
• Read protocol fields and raw bytes.
• Open PCAP and PCAPNG files.
• Follow a full TCP stream.
• Export packets as PCAP or PCAPNG.
• Ask an AI agent about your capture with TCP Viewer MCP.
• Review the full source code.

Easy packet capture

• Pick a network interface.
• Start or stop with one click.
• Keep busy captures easy to read.

Watch the live capture video

TCP Viewer MCP

• Connect TCP Viewer to Codex or another MCP client.
• Check the capture status.
• List network interfaces.
• Find packets with a simple prompt.
• Available with TCP Viewer PRO.

Open capture files

• Drag in a PCAP or PCAPNG file.
• Preview packets right away.
• Use the same view as a live capture.

Watch the file preview video

Follow TCP Stream

• Rebuild one full TCP conversation.
• Show both directions together.
• Show only client or server data.
• Switch between text and hex.
• Search the stream.
• Jump back to the source packet.

Watch the Follow TCP Stream video

Group traffic

• Group packets by app.
• Group packets by domain.
• Group packets by IP address.
• Jump to the traffic you need.

Watch the grouped traffic video

Protocol filters

• Use quick filters for common protocols.
• Combine filters with text search.
• Focus on useful packets fast.

Watch the protocol filter video

Export captures

• Export all, filtered, or selected packets.
• Save as PCAP or PCAPNG.
• Open the result in other packet tools.

Packet details

• Read Wireshark-grade protocol trees.
• Inspect field names and values.
• Match fields to raw bytes.
• Search packet details.

Watch the packet details video

Open source

• Licensed under GPL-2.0-or-later.
• Review the capture pipeline.
• Review packet decoding.
• Review the native macOS interface.
• Report issues or send a pull request.

Built by the Proxyman Team

• Made by the team behind Proxyman and Tiny Shield.
• Built for macOS.
• Focused on privacy and clear network debugging.

Requirements

To run TCP Viewer:

• Apple Silicon Mac.
• macOS 15 or later.

To build TCP Viewer:

• Xcode 16 or later.
• Git.
• CMake, Ninja, Meson, pkg-config, and autotools.

brew install cmake ninja meson pkg-config autoconf automake libtool

Setup

Clone with submodules. Then bootstrap the pinned Wireshark dependency.

git clone --recurse-submodules <repo-url>
cd TCPViewer
cp Config/TCPViewer.local.xcconfig.example Config/TCPViewer.local.xcconfig
./scripts/bootstrap-wireshark.sh

Already cloned without submodules?

git submodule update --init --recursive
./scripts/bootstrap-wireshark.sh

The bootstrap scripts:

• Run scripts/bootstrap-wireshark-deps.sh first.
• Build Wireshark's runtime libraries from source.
• Write them to Vendor/.install/wireshark-deps.
• Use macOS 15 as the deployment target.
• Use Homebrew only for build tools.
• Never copy Homebrew bottle dylibs into a release.

Keep local signing, appcast, Sparkle, Sentry, and release values out of Git. Use Config/TCPViewer.local.xcconfig, .env, environment variables, or Keychain-backed tools.

Run

In Xcode:

1. Open TCPViewer.xcodeproj.
2. Select the TCPViewer scheme.
3. Choose My Mac.
4. Press Run.

Command-line build:

xcodebuild -project TCPViewer.xcodeproj -scheme TCPViewer build

If Xcode asks for signing, select a development team for TCPViewer and PcapPlusPlusCore.

Test

xcodebuild test \
  -project TCPViewer.xcodeproj \
  -scheme TCPViewer \
  -destination 'platform=macOS'

Release

The release script can:

• Build and notarize the app.
• Sign the Sparkle update.
• Upload files to Cloudflare R2.
• Publish the release to the backend.

First-time setup:

npm install
bundle install
gh auth login

Create a local .env from .env.example. Add the required release values. Never commit real secrets.

Use # for comments in .env. sentry-cli does not accept // comments.

For a production release, add a matching entry to ReleaseNote.json. Then run:

npm run release

Choose beta or production when asked.

Production releases also:

• Create the Sparkle appcast.
• Push the v<version> tag.
• Publish the GitHub release.

Artifacts are written to:

~/Desktop/tcpviewer-production/

License

TCP Viewer is licensed under GPL-2.0-or-later. This matches its use of Wireshark libraries.

• See COPYING for the full GPL text.
• See THIRD_PARTY_NOTICES.md for third-party notices.
• See SOURCE_CODE_OFFER.md for binary release source terms.

Acknowledgements

• Wireshark provides packet dissection.
• HexFiend provides the embedded hex viewer.

Wireshark is a trademark of the Wireshark Foundation. TCP Viewer is not affiliated with or endorsed by the Wireshark Foundation.