Show HN: I made an alternative Wireshark macOS app

A developer released TCP Viewer, a native macOS packet-capture app built on Wireshark's dissectors and distributed under GPL v2 or later, as a Show HN submission. TCP Viewer adds a command-line tool (tcpviewer-cli) for starting captures, listing packets and exporting PCAP files without a PRO license, plus a PRO-tier MCP integration that lets clients such as Codex query captures in plain language. The app also offers packet diffing, grouped traffic by domain or client, TLS decryption of PCAPNG files carrying keys, and Wireshark display-filter support.

Easy packet capture Simple, but powerful. Choose an interface, start recording, and keep packet capture calm even when the network is busy. TCP Viewer Native Packet Viewer for Mac Powered by Wireshark TCP Viewer is built on Wireshark's packet analysis engine. Explore decoded protocols, field values, and raw bytes in a native Mac interface. TCP Viewer is distributed under GPL v2 or later https://tcpviewer.proxyman.com/gpl-v2-license , in line with Wireshark's license. See the open-source acknowledgements https://tcpviewer.proxyman.com/acknowledgements . Supported protocols TCP Viewer runs Wireshark's own dissectors. Every row in the packet details reads the way it does in Wireshark, from Ethernet bit fields to decrypted HTTP/3 headers. Decryption Open a PCAPNG file that carries its TLS keys and TCP Viewer decrypts it the way Wireshark does: requests, headers, and bodies instead of "Application Data". Add keys to a capture with Wireshark's editcap --inject-secrets . TCP Viewer MCP Connect TCP Viewer to Codex or another MCP client. Check capture status, explore interfaces, and find the packets that matter with a plain-language prompt. Available with TCP Viewer PRO. Saved captures Bring an existing capture into TCP Viewer and preview the packets right away, with no fresh recording session required. Drag in a trace Drop PCAP or PCAPNG files straight onto TCP Viewer. Preview immediately Open the packet list and decoded detail view without a live capture. Keep the workflow native Review saved evidence in the same Mac-first packet interface. Drop capture.pcapng to preview Follow TCP Stream Get the familiar Wireshark Follow TCP workflow in a focused, Mac-native window—reassembled, direction-aware, and easy to trace back to the source packets. Whatever you capture, TCP Viewer keeps the important traffic readable. Filter noise, open decoded fields, and save evidence for the next debug session. Grouped traffic Collapse busy captures into readable conversations by domain or client, then jump straight to the traffic that matters. Protocol filters Tap protocol chips to focus the packet list without rebuilding a complex filter every time the capture changes. Export captures Package the exact packets you need into standard capture files for Wireshark, teammates, or the next debug session. Export selected packets Capture range File format Filename filtered-capture.pcapng Packet detail Open decoded fields, protocol trees, byte ranges, and field values with Wireshark-grade depth in a focused Mac interface. Packet Diff See what changed. Compare TCP or UDP packets from the same capture or different flows. Highlight changes in decoded details, or switch to hex and ASCII for the exact bytes. Free: 2 items in the Diff pool. PRO and Team: unlimited items. Compare any two pool items at a time. Overview Know what happened before you open a packet. See packets and throughput over time, the protocols in use, and the busiest apps, domains, and ports. TCP Analysis flags lost segments, retransmissions, and resets. Works with live captures and opened PCAP and PCAPNG files. Select a row to open its packets. TCP Viewer command line Start a capture, query matching traffic, follow TCP streams, and export PCAP files from a shell script. Included with TCP Viewer. Normal CLI commands do not require PRO. tcpviewer-cli / Terminal bash $ CLI="/Applications/TCP Viewer.app/Contents/MacOS/tcpviewer-cli"$ "$CLI" capture start --interface en0 --bpf 'tcp port 443'{ "schema version": 1, "request id": "7f3e2b1c-45a6-4789-b012-3456789abcde", "ok": true, "command": "capture.start", "data": { "action": "start capture", "bpf capture filter action": "set", "completed": true, "previous packets cleared": true } }$ "$CLI" packets list --protocol TLS --client Safari --limit 3 --pretty Wireshark display filters Paste a Wireshark display filter into TCP Viewer. It shows the packets that match and does not change your capture. Try this filter tcp.port == 443 and ip.addr == 192.168.1.10 Shows port 443 traffic for one IP address. Wireshark display filter demo Wireshark filter 3 matching packets Open source Read, build, modify, and share TCP Viewer under GPL v2 or later. Paid plans activate PRO features in our signed Mac builds and include device seats, update coverage, and email support without limiting your GPL rights. A native packet viewer from the team behind Proxyman. 6+ years The Proxyman Team has spent more than six years building network debugging tools. 900,000+ Developers worldwide use Proxyman, built by the same team as TCP Viewer. GPL v2+ Read the source, build the app, or contribute on GitHub https://github.com/ProxymanApp/TCPViewer . Native Made for Apple Silicon Macs running macOS 15 or later. 4 Proxyman https://proxyman.com , Tiny Shield https://tinyshield.proxyman.com , TCP Viewer, and Device MCP https://devicemcp.ai come from the same team. Get started Download the app and see if it fits your packet workflow.