{"slug": "show-hn-i-made-an-alternative-wireshark-macos-app", "title": "Show HN: I made an alternative Wireshark macOS app", "summary": "A developer released TCP Viewer, a native macOS packet-capture app built on Wireshark's dissectors and distributed under GPL v2 or later, as a Show HN submission. TCP Viewer adds a command-line tool (tcpviewer-cli) for starting captures, listing packets and exporting PCAP files without a PRO license, plus a PRO-tier MCP integration that lets clients such as Codex query captures in plain language. The app also offers packet diffing, grouped traffic by domain or client, TLS decryption of PCAPNG files carrying keys, and Wireshark display-filter support.", "body_md": "## Easy packet capture\n\nSimple, but powerful. Choose an interface, start recording, and keep packet capture calm even when the network is busy.\n\nTCP Viewer\n\nNative Packet Viewer for Mac\n\nPowered by Wireshark\n\nTCP Viewer is built on Wireshark's packet analysis engine. Explore decoded protocols, field values, and raw bytes in a native Mac interface.\n\nTCP Viewer is distributed under [GPL v2 or later](https://tcpviewer.proxyman.com/gpl-v2-license), in line with Wireshark's license. See the [open-source acknowledgements](https://tcpviewer.proxyman.com/acknowledgements).\n\nSupported protocols\n\nTCP Viewer runs Wireshark's own dissectors. Every row in the packet details reads the way it does in Wireshark, from Ethernet bit fields to decrypted HTTP/3 headers.\n\nDecryption\n\nOpen a PCAPNG file that carries its TLS keys and TCP Viewer decrypts it the way Wireshark does: requests, headers, and bodies instead of \"Application Data\". Add keys to a capture with Wireshark's `editcap --inject-secrets`.\n\nTCP Viewer MCP\n\nConnect TCP Viewer to Codex or another MCP client. Check capture status, explore interfaces, and find the packets that matter with a plain-language prompt.\n\nAvailable with TCP Viewer PRO.\n\nSaved captures\n\nBring an existing capture into TCP Viewer and preview the packets right away, with no fresh recording session required.\n\nDrag in a trace\n\nDrop PCAP or PCAPNG files straight onto TCP Viewer.\n\nPreview immediately\n\nOpen the packet list and decoded detail view without a live capture.\n\nKeep the workflow native\n\nReview saved evidence in the same Mac-first packet interface.\n\nDrop capture.pcapng to preview\n\nFollow TCP Stream\n\nGet the familiar Wireshark Follow TCP workflow in a focused, Mac-native window—reassembled, direction-aware, and easy to trace back to the source packets.\n\nWhatever you capture, TCP Viewer keeps the important traffic readable. Filter noise, open decoded fields, and save evidence for the next debug session.\n\nGrouped traffic\n\nCollapse busy captures into readable conversations by domain or client, then jump straight to the traffic that matters.\n\nProtocol filters\n\nTap protocol chips to focus the packet list without rebuilding a complex filter every time the capture changes.\n\nExport captures\n\nPackage the exact packets you need into standard capture files for Wireshark, teammates, or the next debug session.\n\nExport selected packets\n\nCapture range\n\nFile format\n\nFilename\n\nfiltered-capture.pcapng\n\nPacket detail\n\nOpen decoded fields, protocol trees, byte ranges, and field values with Wireshark-grade depth in a focused Mac interface.\n\nPacket Diff\n\nSee what changed. Compare TCP or UDP packets from the same capture or different flows. Highlight changes in decoded details, or switch to hex and ASCII for the exact bytes.\n\nFree: 2 items in the Diff pool. PRO and Team: unlimited items. Compare any two pool items at a time.\n\nOverview\n\nKnow what happened before you open a packet. See packets and throughput over time, the protocols in use, and the busiest apps, domains, and ports. TCP Analysis flags lost segments, retransmissions, and resets.\n\nWorks with live captures and opened PCAP and PCAPNG files. Select a row to open its packets.\n\nTCP Viewer command line\n\nStart a capture, query matching traffic, follow TCP streams, and export PCAP files from a shell script.\n\nIncluded with TCP Viewer. Normal CLI commands do not require PRO.\n\ntcpviewer-cli / Terminal\n\n``` bash\n$ CLI=\"/Applications/TCP Viewer.app/Contents/MacOS/tcpviewer-cli\"$ \"$CLI\" capture start --interface en0 --bpf 'tcp port 443'{\n  \"schema_version\": 1,\n  \"request_id\": \"7f3e2b1c-45a6-4789-b012-3456789abcde\",\n  \"ok\": true,\n  \"command\": \"capture.start\",\n  \"data\": {\n    \"action\": \"start_capture\",\n    \"bpf_capture_filter_action\": \"set\",\n    \"completed\": true,\n    \"previous_packets_cleared\": true\n  }\n}$ \"$CLI\" packets list --protocol TLS --client Safari --limit 3 --pretty\n```\n\nWireshark display filters\n\nPaste a Wireshark display filter into TCP Viewer. It shows the packets that match and does not change your capture.\n\nTry this filter\n\n`tcp.port == 443 and ip.addr == 192.168.1.10`\nShows port 443 traffic for one IP address.\n\nWireshark display filter demo\n\nWireshark filter\n\n3 matching packets\n\nOpen source\n\nRead, build, modify, and share TCP Viewer under GPL v2 or later. Paid plans activate PRO features in our signed Mac builds and include device seats, update coverage, and email support without limiting your GPL rights.\n\nA native packet viewer from the team behind Proxyman.\n\n6+ years\n\nThe Proxyman Team has spent more than six years building network debugging tools.\n\n900,000+\n\nDevelopers worldwide use Proxyman, built by the same team as TCP Viewer.\n\nGPL v2+\n\nRead the source, build the app, or contribute on [GitHub](https://github.com/ProxymanApp/TCPViewer).\n\nNative\n\nMade for Apple Silicon Macs running macOS 15 or later.\n\n4\n\n[Proxyman](https://proxyman.com), [Tiny Shield](https://tinyshield.proxyman.com), TCP Viewer, and [Device MCP](https://devicemcp.ai) come from the same team.\n\nGet started\n\nDownload the app and see if it fits your packet workflow.", "url": "https://wpnews.pro/news/show-hn-i-made-an-alternative-wireshark-macos-app", "canonical_source": "https://tcpviewer.proxyman.com", "published_at": "2026-11-14 14:40:47+00:00", "updated_at": "2026-11-14 14:52:19.655126+00:00", "lang": "en", "topics": ["developer-tools", "agent-protocols"], "entities": ["TCP Viewer", "Wireshark", "Codex", "macOS", "tcpviewer-cli"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/show-hn-i-made-an-alternative-wireshark-macos-app", "markdown": "https://wpnews.pro/news/show-hn-i-made-an-alternative-wireshark-macos-app.md", "text": "https://wpnews.pro/news/show-hn-i-made-an-alternative-wireshark-macos-app.txt", "jsonld": "https://wpnews.pro/news/show-hn-i-made-an-alternative-wireshark-macos-app.jsonld"}}