Nan vs Framehound

Why You Need This: - Capture on TCP/IP layer, NOT system proxy. Avoid some applications not going through the proxy - Detect TLS connection and ALPN - Only capture and decrypt HTTPS the address you specify, to prevent certain applications from malfunctioning due to addresses that cannot be captured by packet capture. - Also support decrypt WebSocket How it works: - This app captures all IP packets (IP layer) - Next assemble into TCP stream (TCP layer) - Probe TLS connections and ALPN information to help you determine if there's any possibility of packet capture. - Next assemble into HTTPS/WebSocket packet (Application layer) if you MITM it

Framehound opens .pcap and .pcapng captures and analyses them on your device. You're in a wiring closet or on a customer site, something is broken, you have a capture, and your laptop is somewhere else. Framehound is for that moment: built for touch, and built on the assumption that you want an answer before a packet list. ANALYSIS, NOT JUST A PACKET LIST Open a capture and it has already been analysed. Nobody presses "analyse." • Overview — a health score with ranked, tappable issues, headline metrics, protocol mix and top talkers • Conversations — every exchange, named from what it actually is: TLS SNI, HTTP Host or Bonjour service. TCP flows carry handshake RTT, retransmissions, duplicate ACKs, zero-window events and how the connection closed • Hosts and VLANs — inventory with vendor resolution and drill-downs • Expert findings — severity-ranked results from the rule engine, each traceable to the packets behind it • Packets — the full list with a layer tree and hex dump TYPE THE FILTER YOU ALREADY KNOW Display filters work the way your muscle memory expects: ip.addr == 192.168.1.1 && tcp.flags.reset == 1. Every chart mark, table row, ladder arrow and finding carries the filter that produced it — tap it and that expression lands on an editable breadcrumb you can peel back one term at a time. MARK IT WHILE YOU'RE LOOKING AT IT Mark a packet, colour it, write on it. Note a conversation, a host or a finding. Annotations export back out as pcapng comments, so a capture annotated on an iPad opens in a desktop tool with the notes attached. FRAMEHOUND PRO An optional upgrade adding the specialist analysis: • Wireless analysis — frame-type mix, band and channel utilisation, retry rate, RSSI and SNR distribution, PHY generation mix • APs & Clients — beacon and AP inventory with information-element inspection, client capabilities inferred from probe requests, association sessions • Roaming analysis — 802.11r, k and v exchanges, roam events with their timing, and sticky-client verdicts • VoIP analysis — call setup and media quality end to end, MOS, jitter and loss per leg, and a timeline showing when audio broke • Protocol-aware ladders — SIP, TLS, DHCP, DNS, TCP and Wi-Fi association ladders with labelled messages, status codes and round-trip times • Guided investigations — pick a symptom and Framehound runs the checks in order, shows pass or fail with evidence, and names the next thing to look at • Apple Intelligence briefs — a plain-language read of the capture, what the findings mean together, and questions answered, entirely on device (requires an Apple Intelligence device) • Capture comparison — diff two captures to see what changed between a working state and a broken one • Report export — Markdown, PDF, annotated PCAPNG and filter lists, so what you found leaves as something a ticket can hold • Cloud import — pull captures straight from Cisco Meraki, Juniper Mist and Link-Live, with no laptop in the middle Pro is available monthly, annually with a 7-day free trial, or as a one-time purchase including all 1.x updates. PRIVACY Analysis is always on device. No account, no telemetry, no background sync. Networking exists in exactly two places, both off until you turn them on and user-initiated every time: pulling a capture from an integration you configured, and an opt-in local upload server that accepts one paired file push from another device. Apple Intelligence runs on-device on a few hundred tokens of payload-free summary statistics. Packet payloads never reach the model. WHAT IT IS NOT It does not capture traffic — iOS cannot. It reads capture files you already have. It does not decrypt: pcapng Decryption Secrets Blocks are surfaced, never used. GETTING CAPTURES IN Import from Files, the share sheet, drag and drop on iPad and Mac, or On My iPhone → Framehound. Three sample captures are built in, so you can see it work first.