b2KIT

PCAP Summary Viewer

Upload PCAP files and view packet summaries: protocol distribution, top talkers, connection pairs, and flow statistics.

Tested tool guide Tested browser tools Checked August 16, 2026

What PCAP Summary Viewer does and how it behaves

This tool reads an uploaded .pcap file directly in your browser and walks its packet records to build four summaries: protocol distribution, top talkers by traffic volume, connection pairs grouped by source and destination, and basic flow statistics. It only decodes header fields - Ethernet, IP, TCP/UDP - so it does not reconstruct sessions or reveal payload content. The most common surprise: if the capture was recorded with a reduced snap length, the captured-length bytes it sums can be smaller than the true on-wire size, so traffic volumes can under-report actual bandwidth.

How the result is produced

1

Header-only parsing

The tool walks the file's per-packet records - each carrying a captured length and an original length - and decodes just enough of the Ethernet/IP/TCP/UDP headers to identify protocol, source and destination addresses, and ports. Bytes past the transport header are not interpreted, so contents of HTTP requests, TLS records, or other application data are never extracted or displayed.

2

Aggregation into tables

As packets are parsed, running totals are kept per host for the top-talkers view and per source/destination/port/protocol tuple for connection pairs. Protocol distribution counts are tallied from the identified transport or application protocol on each packet, and flow statistics summarize packet counts, byte totals, and capture duration from the first and last packet timestamps.

Good uses

  • Getting a quick protocol and top-talker breakdown of a capture pulled from a suspicious host, without installing Wireshark or tshark
  • Triaging a pcap handed to you during incident response to see which hosts exchanged the most traffic before drilling into packet detail elsewhere
  • Checking which endpoints and ports a capture from a pentest or lab exercise actually touched, without sending the file to a third-party analysis service

Limits and checks

  • Byte and traffic totals reflect each packet's captured length, not necessarily its original on-wire length - a capture taken with a small snap length will under-report volume
  • Only unencrypted header fields are visible; TLS, IPsec, or other encrypted traffic shows up as protocol and endpoint metadata only, never payload content
  • A truncated, corrupted, or non-Ethernet link-layer capture can cause packets to be misparsed or skipped, which may skew the summary without an obvious warning

Common questions

Does this tool decrypt or decode TLS/HTTPS traffic in my capture?

No. It only reads packet headers to identify protocols and endpoints; encrypted application data stays opaque. Decoding TLS content would require the session keys and a full protocol decoder, which this tool does not attempt.

Is my pcap file uploaded anywhere?

No - it runs entirely in your browser and the file is parsed locally, so nothing is sent to a server. Closing or refreshing the tab discards the loaded capture and its summary.

References and verification

The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools