PCAP Summary

Load a packet capture (classic PCAP or PCAPNG) and this parses the real Ethernet/IP/TCP/UDP/ICMP headers locally to build a summary — protocol breakdown, top and largest conversations, and lightweight metadata (DNS query names, HTTP Host headers, TLS ClientHello SNI values). This does not reconstruct TCP sessions or decode application payloads beyond that lightweight metadata — it's a summary tool, not a protocol analyzer. Your file is not uploaded — everything is parsed from bytes in your browser, the same way a hex editor would read them.

What's supported

Both classic PCAP (any endianness, microsecond or nanosecond timestamps) and PCAPNG (Section Header, Interface Description, and Enhanced/legacy Packet Blocks) are parsed. Only Ethernet-linked captures are decoded past the link layer (the overwhelming majority of real captures) — other link types are counted but not decoded further, stated honestly rather than guessed at. DNS query names use real label-compression-pointer handling (not just the first question, and not misreading compressed names as garbage). TLS SNI extraction reads a single ClientHello record — a SNI split across multiple TCP segments won't be found, since that would require session reassembly, which this tool deliberately doesn't do.