Cocoa Packet Analyzer4.0.3

Capture, inspect, and filter network traffic with Cocoa Packet Analyzer, using its packet-sniffing views to turn raw traffic into protocol-level evidence for troubleshooting or development. Choose Ethernet or Wi-Fi, set SnapLen, enable promiscuous or Wi-Fi monitor mode, and enter a tcpdump-compatible filter; its daemon compiles the BPF program before copying packets to user space. A menu-bar extra starts, watches, and stops captures without a document window, while one sheet handles capture-to-file or live mode and Settings remembers the default.

During live capture, packet count, elapsed time, the packet list, protocol tree, and hex view update continuously as traffic arrives, while a packet index and one-pass background dissector keep multi-million-packet traces light in memory and quick to navigate. It captures PCAP and reads and writes modern pcapng files with per-packet comments and embedded TLS secrets, includes protocol analyzers, and supports Cocoa-bundle analyzer plugins. QUIC is dissected and decrypted at every level, including searchable HTTP/3 frames and QPACK headers; Follow TCP Stream, UDP Flow, or QUIC Stream reconstructs conversations with request-and-reply pairing. TLS handshakes and certificates can be examined, TLS 1.2 and 1.3 decrypted through SSLKEYLOGFILE, and every session checked for decryption status and failure reasons, while the built-in HTTPS proxy inspects live flows without a key-log file.

Finder QuickLook previews traces, and the native interface supports Dark Mode and all appearance modes, with English, German, and basic Japanese localizations. Version 4.0.3 is a notarized universal binary for Intel and Apple Silicon Macs running macOS 26 Tahoe or later. It is freeware in the Developer Tools category, suits developers analyzing saved traces or live traffic, and beta builds may not be notarized.