Kestrel LITE vs PCAP Analyzer · File Reader

Kestrel Lite is a network packet analyzer for iPhone and iPad — open a PCAP or PCAPNG file, see what's inside, and triage it from your phone or tablet. CORE FEATURES Dashboard with tappable widgets — jump from any metric to the relevant tab Packets list with hex+ASCII inspector and filter syntax (port, host, protocol, length) TCP stream reassembly with full payload view (captures under 1 GB) Flow records with bidirectional byte/packet counts Host inventory with hostname resolution from DNS observed in the capture DNS queries with full A/AAAA/CNAME/MX/TXT response data Protocol classification: TCP, UDP, ICMP, HTTP, HTTPS, DNS, SSH, FTP, SMTP, TLS, ARP, SMB, mDNS, DHCP, NTP, SNMP, SSDP, QUIC Timeline view of capture activity Chain-of-custody log with SHA-256 file integrity hash PRIVACY GUARANTEE 100% offline — no network access 100% on-device — your captures never leave your device No account required, no sign-in Free with no ads IDEAL FOR Network engineers triaging captures on the go Security analysts doing first-pass review Students learning packet analysis and networking Anyone curious about what's actually in their PCAP files LIMITATIONS PCAP files are processed up to 50,000 packets per capture Raw payload search is not included TCP reassembly disables automatically above 1 GB to protect device memory Upgrade to Kestrel Sight to get: Unlimited packet capacity — no 50,000-packet cap Analyst Bookmarks — flag any packet, flow, host, DNS query, or stream with a note. Bookmarks are included in the PDF export Enhanced IPv6 support — addresses displayed in canonical RFC 5952 form, search matches any textual representation of the same address Refined PDF reports — human-readable durations, complete Top Talkers, paginated bookmarks Refined CSV exports SUPPORT Questions, issues, or feature requests? Email support@tracivex.com — we read every message and use your feedback to guide development.

PCAP Analyzer opens and analyzes .pcap and .pcapng network captures right on your iPhone, iPad, and Mac, with no desktop required. Troubleshoot a flaky connection, investigate a security incident, or learn how networks really work, with a fast, deep, and clear packet analyzer in your pocket. Open captures created by tcpdump, tshark, and any standard pcap or pcapng tool, and read the wire like a page. DEEP PROTOCOL DECODING Every frame is dissected down to the field: Ethernet and VLAN, IPv4, IPv6, TCP, UDP, ICMP, ICMPv6, IGMP, ARP, DNS, mDNS, LLMNR, DHCP, HTTP, HTTP/2, TLS, DTLS, QUIC, SMB2, SNMP, NTP, RADIUS, TFTP, MQTT, SCTP, GRE, ESP, and NetFlow/IPFIX. A clean, tappable detail tree and a full hex view show every byte. TLS FINGERPRINTING, JA3 AND JA4 PCAP Analyzer computes JA3 and JA4 client fingerprints natively, and even decrypts QUIC Initial packets to recover the SNI and fingerprints, analysis that usually needs desktop plugins. FIND THE PROBLEM FAST • Color coded packets, so retransmissions, resets, errors, and stalls stand out • Expert diagnostics: TCP retransmissions, duplicate ACKs, zero window stalls, connection resets, HTTP errors, and DNS failures • Threat detection: port and host scans, suspicious C2 and backdoor ports, possible DNS tunneling, and cleartext credentials POWERFUL DISPLAY FILTER A real, field aware filter language with autocomplete and saved filters: tcp.port == 443, tls.sni contains "example", tcp.analysis.zero_window, dns or http. Tap any field in a packet to filter by it instantly. STATISTICS AND VISUALS Conversations, Endpoints, Protocol Hierarchy, a network topology map, an I/O graph, Follow Stream with a TCP sequence and time graph, and automatic name resolution, so you see hostnames instead of raw IP addresses. ON-DEVICE AI On supported iPhones with Apple Intelligence, an on device model summarizes a capture in plain language and turns plain English requests into filters, like "show failed connections". It runs entirely on your device, and your capture never leaves your phone. BUILT FOR BIG CAPTURES A native streaming engine opens very large captures without running out of memory, files that crash other mobile viewers. PRIVATE BY DESIGN Everything happens on your device. PCAP Analyzer reads saved files only, captures no live traffic, needs no special permissions, and never uploads your data. Privacy Policy: https://rush.tools/privacy Terms of Use: https://rush.tools/terms