Kestrel Sight vs PCAP Analyzer · File Reader

Kestrel Sight brings professional packet capture analysis to iPhone and iPad. Every byte is processed on-device — Kestrel makes no network connections, and collects no analytics. WHAT'S NEW CSV Export — Three profiles: Summary (Excel-ready, 9 columns), Detailed (every protocol layer, ~24 columns), Flow (one row per conversation). Export everything or just bookmarked packets, with bookmark notes preserved as columns. Filenames indicate scope at a glance. Smart Bookmarks — Bookmarking a flow, host, DNS query, or stream now resolves to all related packets in CSV exports. Tap "View" on any bookmark to jump straight to that data with the right filter applied. Expanded Protocol Detection — Added classification for SMB, mDNS, DHCP, NTP, SNMP, SSDP, and QUIC. Dashboard Navigation — Every dashboard widget is now interactive. Tap Total Packets to open Packets, tap a Top Talker to filter Hosts to that IP, tap "TCP" in Protocol Distribution to filter the Packets list, and so on. Subtle chevrons indicate what's tappable. Haptic Feedback — Bike-spoke clicker feedback when scrolling lists. Crisp tap feedback on buttons. Adjustable row density. New filter-bar toggle cycles between Classic, Compact, and Comfortable layouts in the Packets browser. Compact fits ~22 rows per phone screen; Comfortable mirrors iOS Mail's two-line look. On iPad, Classic uses a denser style single-line row. App Switcher privacy. Sight now hides the analysis surface behind the Kestrel logo whenever the app leaves the foreground, so the iOS App Switcher thumbnail and AirPlay mirroring. Faster first-tap haptic response and internal robustness improvements. CORE FEATURES Dashboard — Protocol distribution, encryption stats, top talkers, session summary Packets — Browse and filter with detailed per-layer inspection Raw Data Search — Query any byte sequence in its original form Flows — Bidirectional reconstruction with byte counts, packet counts, timing Hosts — Per-IP profile with traffic stats, port activity, connection mapping DNS — Extract and search all DNS queries and responses Streams — TCP stream reassembly with full-content viewer (auto-runs under 1 GB) Timeline — Visual event timeline with filtering Audit Log — SHA-256 file hashing and session audit log included in PDF exports CAPACITY Up to 1 GB — Full feature set with automatic TCP reassembly Over 1 GB — TCP reassembly disabled; packets, flows, hosts, DNS, and timeline remain fully functional Over 2 GB — Application performance may degrade SUPPORTED FORMATS PCAP, PCAPNG IDEAL FOR SOC analysts reviewing captures away from the workstation Network administrators troubleshooting connectivity Incident responders triaging captures in the field Penetration testers reviewing engagement data Educators and students learning protocol behavior PRIVACY AND SECURITY Zero network access — no outbound connections No analytics, tracking, or advertising Kestrel is designed as an analytical and educational starting point. Always verify findings independently before acting on them. No software can guarantee absolute security; follow your organization's evidence-handling procedures when working with sensitive captures. IMPORTANT NOTES Kestrel analyzes pre-captured PCAP files only — live capture is not permitted within iOS by the platform itself. Screenshots may combine demo and real data. Large captures may extend load times. Devices with 8 GB RAM or more are recommended for multi-gigabyte files. The demo uses fabricated sample packets.

PCAP Analyzer opens and analyzes .pcap and .pcapng network captures right on your iPhone, iPad, and Mac, with no desktop required. Troubleshoot a flaky connection, investigate a security incident, or learn how networks really work, with a fast, deep, and clear packet analyzer in your pocket. Open captures created by tcpdump, tshark, and any standard pcap or pcapng tool, and read the wire like a page. DEEP PROTOCOL DECODING Every frame is dissected down to the field: Ethernet and VLAN, IPv4, IPv6, TCP, UDP, ICMP, ICMPv6, IGMP, ARP, DNS, mDNS, LLMNR, DHCP, HTTP, HTTP/2, TLS, DTLS, QUIC, SMB2, SNMP, NTP, RADIUS, TFTP, MQTT, SCTP, GRE, ESP, and NetFlow/IPFIX. A clean, tappable detail tree and a full hex view show every byte. TLS FINGERPRINTING, JA3 AND JA4 PCAP Analyzer computes JA3 and JA4 client fingerprints natively, and even decrypts QUIC Initial packets to recover the SNI and fingerprints, analysis that usually needs desktop plugins. FIND THE PROBLEM FAST • Color coded packets, so retransmissions, resets, errors, and stalls stand out • Expert diagnostics: TCP retransmissions, duplicate ACKs, zero window stalls, connection resets, HTTP errors, and DNS failures • Threat detection: port and host scans, suspicious C2 and backdoor ports, possible DNS tunneling, and cleartext credentials POWERFUL DISPLAY FILTER A real, field aware filter language with autocomplete and saved filters: tcp.port == 443, tls.sni contains "example", tcp.analysis.zero_window, dns or http. Tap any field in a packet to filter by it instantly. STATISTICS AND VISUALS Conversations, Endpoints, Protocol Hierarchy, a network topology map, an I/O graph, Follow Stream with a TCP sequence and time graph, and automatic name resolution, so you see hostnames instead of raw IP addresses. ON-DEVICE AI On supported iPhones with Apple Intelligence, an on device model summarizes a capture in plain language and turns plain English requests into filters, like "show failed connections". It runs entirely on your device, and your capture never leaves your phone. BUILT FOR BIG CAPTURES A native streaming engine opens very large captures without running out of memory, files that crash other mobile viewers. PRIVATE BY DESIGN Everything happens on your device. PCAP Analyzer reads saved files only, captures no live traffic, needs no special permissions, and never uploads your data. Privacy Policy: https://rush.tools/privacy Terms of Use: https://rush.tools/terms