NetBuddy ForensicChef vs PCAP Analyzer · File Reader

ForensicChef — mobile forensics and data transformation toolkit Quickly import, inspect, transform and export forensic captures and text data on your iPhone or iPad. Build repeatable "recipes" of operations to automate parsing, decoding, filtering and formatting so you can reproduce results reliably and share findings with colleagues. Key features: Import from files or clipboard: accept raw capture files and text (PCAP, base64/hex dumps, CSV, JSON and plain text) via the Share sheet or clipboard. Reusable recipes: chain operations (parse, filter, decode, extract, format) into named recipes that you can save, run and modify. Lightweight operations: common forensic helpers such as hex/base64 decode, timestamp conversion, field extraction, regex search/replace, and CSV/JSON formatting. Secure local exports: export results to local files for secure sharing or archival; temporary-file export ensures reliable access for the system share sheet. Reproducibility: save, export and version recipes so analyses can be repeated and audited. Privacy-first: all processing occurs locally on-device; nothing is uploaded without your explicit action. Who it’s for? Mobile forensics practitioners who need a portable tool for quick parsing and triage. Security analysts and incident responders who want reproducible, shareable transformations of capture or text artifacts. Developers and researchers who need a compact playground for testing parsing and data-extraction logic. Getting started Paste or import a capture/text into the Input. Add operations from the picker and arrange them into a recipe. Run the recipe to produce transformed Output. Export or share results securely when needed. Download ForensicChef to speed up mobile forensic triage, keep analyses reproducible, and share results securely — all from your device.

PCAP Analyzer opens and analyzes .pcap and .pcapng network captures right on your iPhone, iPad, and Mac, with no desktop required. Troubleshoot a flaky connection, investigate a security incident, or learn how networks really work, with a fast, deep, and clear packet analyzer in your pocket. Open captures created by tcpdump, tshark, and any standard pcap or pcapng tool, and read the wire like a page. DEEP PROTOCOL DECODING Every frame is dissected down to the field: Ethernet and VLAN, IPv4, IPv6, TCP, UDP, ICMP, ICMPv6, IGMP, ARP, DNS, mDNS, LLMNR, DHCP, HTTP, HTTP/2, TLS, DTLS, QUIC, SMB2, SNMP, NTP, RADIUS, TFTP, MQTT, SCTP, GRE, ESP, and NetFlow/IPFIX. A clean, tappable detail tree and a full hex view show every byte. TLS FINGERPRINTING, JA3 AND JA4 PCAP Analyzer computes JA3 and JA4 client fingerprints natively, and even decrypts QUIC Initial packets to recover the SNI and fingerprints, analysis that usually needs desktop plugins. FIND THE PROBLEM FAST • Color coded packets, so retransmissions, resets, errors, and stalls stand out • Expert diagnostics: TCP retransmissions, duplicate ACKs, zero window stalls, connection resets, HTTP errors, and DNS failures • Threat detection: port and host scans, suspicious C2 and backdoor ports, possible DNS tunneling, and cleartext credentials POWERFUL DISPLAY FILTER A real, field aware filter language with autocomplete and saved filters: tcp.port == 443, tls.sni contains "example", tcp.analysis.zero_window, dns or http. Tap any field in a packet to filter by it instantly. STATISTICS AND VISUALS Conversations, Endpoints, Protocol Hierarchy, a network topology map, an I/O graph, Follow Stream with a TCP sequence and time graph, and automatic name resolution, so you see hostnames instead of raw IP addresses. ON-DEVICE AI On supported iPhones with Apple Intelligence, an on device model summarizes a capture in plain language and turns plain English requests into filters, like "show failed connections". It runs entirely on your device, and your capture never leaves your phone. BUILT FOR BIG CAPTURES A native streaming engine opens very large captures without running out of memory, files that crash other mobile viewers. PRIVATE BY DESIGN Everything happens on your device. PCAP Analyzer reads saved files only, captures no live traffic, needs no special permissions, and never uploads your data. Privacy Policy: https://rush.tools/privacy Terms of Use: https://rush.tools/terms