Cocoa Packet Analyzer 4+

I use this software to view packets captured by tcpdump or tshark. You can custom aspects of a pacekt you wanna review.

However, so far, you packets were captured from more than one interfaces, the cocoa packets analyzer is not able to open the raw data record file.

Thanks for the author to provide this greatful packet analyzer.

Filtering is limited to a single field at a time, as far as I can tell. You can’t, for example, filter to see only packets "to and from" a particular IP. You can choose “source IP” or you can choose “destination IP”, but not both at the same time. That’s a massive limitation. You also can’t filter a negative, to remove content that you know is uninteresting, like background chatter from arp, mdns, etc. Those two things together are the vast majority of what you’d be doing with a packet capture in the first place — zeroing in on one series of “conversations” that you’re analyzing. It does produce the basic tcpdump/pcap output, and if you’re only looking for a very limited number of things, it’ll get the job done. But a ‘tcpdump -r’ from the command line will too, and of course supports all the filtering described above as well. Please add a much more robust filter system that will support and/or/not logic to combine many different fields.

It's nice to be able to look at some packet captures with a proper native Mac app.

Performance is quite solid; I was able to open a gigabyte-sized packet capture and the app performed admirably and I could smoothly scroll through it.