Open a PCAP File Online Without Installing Wireshark
How to open a pcap or pcapng file online without installing anything: upload vs in-browser viewers, formats that fail, and what a browser tool can't do.
TL;DR. To open a pcap or pcapng file with nothing installed, you have two kinds of web tool: services that upload the capture to a server and analyse it there, and viewers that parse it inside your browser. The second kind keeps the traffic on your machine. PCAP Parser is one of those: drop the file, and conversations, DNS, HTTP, TLS metadata, extracted files and an indicator list appear in seconds. A browser viewer is a triage tool. It does not replace Wireshark's packet-level dissection, it does not decrypt TLS, and it cannot read compressed or non-pcap formats until you convert them.
Why open a capture without installing anything
Wireshark is the reference for reading captures, and it is free. There are still plenty of moments when installing it is not an option or not worth it:
- a locked-down analyst laptop or a customer machine where you cannot install software;
- a Chromebook, a tablet, or a borrowed computer;
- a CTF challenge or a training lab where you want an overview in seconds before digging in;
- a colleague who sends a capture and asks "anything obvious in there?".
In those cases the question is less "which packet is malformed" and more "who talked to whom, what was resolved, what was downloaded, where did the TLS sessions go". That is triage, and a browser can do it well.
Two kinds of online pcap viewer
Upload-based analyzers
The file is sent to a web service, parsed on its servers, and the results are shown in your browser. This works on any device and can use heavy back-end tooling. The trade-off is that the service now holds a full copy of the traffic: internal hostnames and addresses, DNS queries, URLs, user agents and any unencrypted content. Read the retention and sharing terms before using one, and never upload captures that contain customer or personal data without a legal basis. The privacy guide covers this in detail.
In-browser (local) viewers
The page loads a parser, and the parser reads the file from your disk through the browser's File API. Nothing is uploaded. Modern viewers use WebAssembly so that the parser runs at close to native speed, often in a Web Worker so the page stays responsive.
PCAP Parser works this way: its analyzer is written in Rust, compiled to WebAssembly, and fed the file in 8 MB slices, so even a large capture never has to be held in memory twice. You can verify the "nothing uploaded" claim yourself with the browser's developer tools, as explained in the privacy guide.
How to open a capture in the browser, step by step
- Open PCAP Parser in a recent desktop browser.
- Drag the
.pcapor.pcapngfile onto the drop zone, or use Choose files. A whole folder or a ZIP of captures works too. - Wait for the progress bar. The summary tiles then show packets, bytes, capture duration, conversations and flagged items.
- Switch between the tabs (Conversations, DNS, HTTP, TLS, Files, IOCs) and use the filter box to narrow any view.
- Export the current view as CSV or JSON if you need it in a report or a spreadsheet.
Want to see it before using your own data? The Try a sample button loads a synthetic capture of a fictional intrusion. The full tour of each view is in how to use PCAP Parser.
Formats: what opens and what does not
A capture file is identified by its first bytes, not by its extension. A file named .pcap is often a pcapng file, and a good viewer does not care. The differences between the two formats are explained in pcap vs pcapng.
What usually goes wrong:
| Symptom | Likely cause | Fix |
|---|---|---|
| "Compressed capture" | The file is .pcap.gz, .pcapng.zst or similar | Decompress it first (gunzip, zstd -d) |
| File starts with zeros | It was copied while the capture was still being written | Stop the capture cleanly and copy again |
| "Not a pcap/pcapng capture" | It is a Windows ETL trace, a text export or something else | Convert ETL to pcapng (for example pktmon etl2pcap) or re-export from the capture tool |
| Unsupported format named | Solaris snoop, Microsoft Network Monitor, modified pcap | Convert it with Wireshark's editcap to pcapng |
| Few or no decoded packets | The link-layer type is not decoded (for example 802.11 with radiotap) | Use Wireshark for that capture |
PCAP Parser decodes Ethernet (with VLAN and QinQ tags), Linux cooked capture SLL and SLL2, raw IPv4 and IPv6, and BSD loopback. Packets on other link types are counted and reported in the parser warnings rather than silently dropped.
What an in-browser viewer can do
For triage, a lot:
- list every conversation by 5-tuple, with bytes in each direction and duration;
- show DNS queries with their answers and response codes;
- rebuild HTTP requests and responses after TCP reassembly, and extract the transferred files with their SHA-256;
- read the unencrypted part of TLS: the ClientHello, its SNI, ALPN and the JA3 and JA4 fingerprints;
- build a de-duplicated IOC list of IPs, domains, URLs and file hashes you can paste into a threat-intelligence platform.
What it cannot do
Be clear about the limits, so you know when to switch tools:
- No decryption. TLS, SSH, QUIC and encrypted SMB3 payloads stay encrypted. Only metadata visible in the clear is reported. PCAP Parser notices when a pcapng embeds TLS secrets but does not use them yet.
- No full dissection. Wireshark decodes thousands of protocols field by field. A triage viewer decodes the handful that answer most first questions.
- No live capture. A web page cannot sniff your network interface. Capture with tcpdump, dumpcap or Wireshark, then open the file.
- Missing bytes stay missing. If the capture was taken with a small snaplen, or dropped packets, reassembled streams have gaps. PCAP Parser reports the number of truncated packets and gap bytes instead of hiding them.
- Not decoded yet: QUIC and HTTP/3 beyond the UDP header, IP fragment reassembly, and file carving from SMB.
- Browser memory. Parsing is streamed, but results still live in the tab. Per-list caps protect the page, and the tool tells you when a cap is hit so you can split the capture.
For a fair look at when Wireshark, tshark, NetworkMiner, Zeek or Zui fit better, read the tools comparison.
FAQ
Can I open a .pcap file without Wireshark?
Yes. Command-line tools such as tshark and tcpdump read captures, and in-browser viewers can open a pcap or pcapng file with nothing installed. For packet-by-packet dissection of hundreds of protocols, Wireshark remains the reference.
Why does my capture not open in an online viewer?
The most common causes are a compressed file (.gz or .zst), a Windows ETL trace that was never converted, a file still being written when it was copied, or a format such as snoop or Network Monitor that the viewer does not read.
Is it safe to open a capture on a website?
It depends on where the parsing happens. An upload-based analyzer receives a full copy of your traffic. A viewer that parses locally in the browser, with WebAssembly for example, never sends the file anywhere, which you can check in the browser's network panel.