Netvis

Visual packet analysis for macOS

Open a PCAP or PCAPNG file and watch hosts, conversations, packets, and suspicious events unfold on an interactive timeline. No terminal required.

PCAP / PCAPNG Timeline playback Deep packet inspector macOS 26+

Coming Soon Explore Features

7-day free trial - $9.99 lifetime license - built for saved capture files

From capture to clarity

Understand a packet capture without living in a packet list

Netvis keeps the raw details available, but starts with the mental model people actually need: who is talking, when traffic happens, what protocol is involved, and which moments deserve attention.

Open a capture

Load .pcap or .pcapng files from the Welcome window, Finder, or the standard macOS Open flow. Netvis parses Ethernet IPv4 traffic locally and builds the first topology automatically.

Watch the network move

Hosts appear as draggable nodes, connections become edges, and packets animate through the graph as the timeline plays. Scrub, pause, jump, and inspect the capture as a sequence of events.

Inspect what matters

Select hosts, packets, conversations, or detected events to reveal protocol layers, endpoint details, payload hex, host activity, and the surrounding network context.

Netvis showing a PCAP network graph, packet playback timeline, and packet log.

Netvis network traffic graph with animated packet playback controls.

Netvis packet inspector showing protocol hierarchy details.

Core capabilities

The fastest way to explain what happened in a capture

Netvis is designed for students, beginners, and network practitioners who need to move from raw packets to a clear story without giving up detail.

Auto-generated topology graph

Hosts are discovered from capture data, grouped into conversations, and arranged around the most connected node. Rename devices, tag their type, drag them into place, and search by IP, MAC, name, or manufacturer.

Timeline playback

Scrub across the capture, step backward or forward, change speed, and show only hosts active around the current moment. Packet motion gives timing and direction an immediate visual shape.

Deep packet inspection

Inspect frame metadata, Ethernet, IPv4, TCP, UDP, ICMP, ARP, DNS, DHCP, HTTP, TLS, endpoints, and payload hex in a readable hierarchy.

Host intelligence

Netvis enriches hosts with DHCP names, mDNS .local names, MAC OUI hints, byte totals, top peers, protocol summaries, and an activity sparkline.

Search and focus

Filter hosts, focus active traffic, jump from events to involved nodes, and highlight conversations so the important path stays visible.

Security-relevant events

Spot the moments worth investigating

After import, Netvis scans the full capture and builds a chronological event list. Click an event to pause playback, jump to that timestamp, highlight the involved hosts, and center the graph on the relevant traffic.

Port scans

Detect one host connecting to many ports on a single peer.

DNS bursts

Surface dense bursts of DNS queries from one source.

Large downloads

Flag high inbound byte volume within a short window.

TLS activity

Extract TLS Client Hello and SNI details where available.

Native and local

A graphical packet lab that stays on your Mac

Netvis is a document-based macOS app built for local capture files. It reads user-selected files and does not require elevated permissions or shell workflows.

Secure by design. Netvis uses read-only access to user-selected capture files and keeps license state in local storage.

Native macOS interface. Floating panels, resizable inspectors, timeline controls, and host drawers are built around a focused graphical workflow.

Made for saved captures. Netvis analyzes PCAP and PCAPNG files. It is not a live packet capture tool.

Netvis events view with flagged activity from a packet capture.

Netvis conversations view listing network endpoints and traffic volume.

Questions

Clear expectations before you open a capture

Which files does Netvis support?

Netvis supports classic .pcap files and .pcapng files. It focuses on Ethernet IPv4 traffic with TCP and UDP parsing, plus selected application-layer enrichment.

Is this a Wireshark replacement?

It is a different kind of tool. Netvis is built for visual explanation, teaching, replay, topology, and guided inspection. Raw protocol detail is still available when you need to drill down.

Does Netvis capture live traffic?

No. Netvis analyzes saved capture files. This avoids requiring elevated permissions or packet capture extensions.

How will licensing work?

Netvis includes a 7-day free trial with a one-time $9.99 lifetime license for continued use.

Turn your next packet capture into a map

Use Netvis when a packet list is too dense, a diagram would explain the capture faster, or you need to teach what actually moved across a network.

Coming Soon Explore Features