A new engine. Version 4 changes how a trace is held in memory, so the app stays fast as captures grow. A document now opens through a packet index instead of keeping every packet resident. A background pass dissects each packet once, and every later stream and statistics request is answered from that result. Stream reassembly runs off the main thread. The difference is greatest on large traces: a file with millions of packets opens without a stall, uses a fraction of the memory it used to, and releases that memory when you close it. Smaller traces benefit too — clicking a packet during a live capture responds immediately, holding an arrow key no longer allocates gigabytes, selecting every packet is free, and the app's idle CPU during a capture stays low.

QUIC, dissected and decrypted. The QUIC transport (RFC 9000) is fully dissected: long and short headers across coalesced datagrams, every frame type including DATAGRAM (RFC 9221), connection identity resolved per flow, and packet numbers decoded per number space. Decryption works at every encryption level — Initial packets decrypt from the connection ID alone, and Handshake and 1-RTT packets from key-log material, following key updates as they happen. When a packet cannot be decrypted, the packet tree states the reason and offers the key-log chooser in place. Secrets from a QUIC capture are counted in the key badge and saved into pcapng, exactly like TCP secrets.

HTTP/3 and QPACK, end to end. HTTP/3 is recognised by ALPN and confirmed by the shape of the stream; its frames appear beneath the QUIC stream in the packet tree and in the stream viewer. QPACK header decoding covers the static table and the per-direction dynamic tables — encoder instructions, Required Insert Count and Base, and decoder acknowledgements — so request and response headers are readable and searchable. A new Info column describes what each packet carries, and a Stream column links packets to their streams.

New Follow QUIC Stream reassembles each stream's bytes in order, marking any gaps, and shows them in a viewer window with the same display modes and menus as Follow TCP Stream.

New Follow UDP Flow shows the whole conversation behind any UDP packet: four display modes, a search that also matches message bodies, an ASCII pane that narrows to the matches, per-datagram detail rows taken from the dissector, and request/response pairing.

The details of a TLS packet show the decrypted content it carries — live, per packet, with no reanalysis. Decrypted content appears as an HTTPS layer of its own, an HTTPS segment in the middle of a stream shows the HTTP inside it, and a decrypted stream's tab is named for its content (HTTPS, SMTPS, IMAPS, POP3S). Labels are accurate elsewhere too: an encrypted segment is labelled as encrypted, and a bare ACK on a secured port is shown as TCP.

Open stream windows pick up keys as they arrive and decrypt within seconds — no reload, no reopening.

The TLS Keys window gains a Sources pane listing everywhere key material comes from. Add as many key-log files as you like, or add a folder and every key log inside it is read. A trace with a .keys file beside it decrypts the moment it opens, and ⇧⌘K opens the TLS Key Store.

The capture daemon runs only while it is needed. It starts on demand and quits after a few idle minutes, so it no longer sits in the background holding memory between captures. The key badge counts a running capture's secrets as they arrive, and saving a capture as pcapng reuses the secrets it has already derived. A capture recording directly to a file no longer shows a key count stuck at zero.

Cancel means stop. Long analyses stop when you cancel them or close their window, Cancel in Statistics genuinely cancels (and a cancelled run is reported as cancelled, not failed), and closed stream windows release their memory.

Memory is returned when you are done with it. Selecting every packet in a trace of millions no longer costs gigabytes — the selection is counted, and packets are fetched only when an action needs them — and closing a trace releases its memory immediately rather than holding it until the app quits.

Printing large traces is far lighter. Printing a trace of a quarter million packets used to require tens of gigabytes of memory and could freeze the app while paginating. Pages are now generated and paginated incrementally, so memory use stays modest regardless of trace size, the page count appears quickly, and the app stays responsive. The print panel also appears reliably — including on Macs with no printer configured, where the preview and PDF export work as usual.

Missing bytes are shown as missing. One model covers the four ways data can be absent — cut off at the end of the capture, cut by the snapshot length, a gap in the stream, or bytes that no parser claims — and the viewers draw the gap where it occurs. Traffic truncated by the snapshot length no longer crashes dissectors, and frames larger than 64 KB are handled.

Every field row highlights exactly its own bytes. A precision pass over some 25 dissectors (DNS, BGP, OSPF, ICMP and ICMPv6, DHCP and DHCPv6, HTTP/2, RadioTap, L2TP, RADIUS, the PPP family, VLAN, MPLS and more) brought the packet details into line with the hex view. Clicking the hex view now gives it focus, so Edit ▸ Copy copies bytes.

Plug-in SDK 4.0.0. Analyzer plug-ins build against a new, smaller API. Plug-ins built with earlier SDKs must be rebuilt.

The recents lists follow the system setting. The Open Recent menu, the welcome window and the sidebar respect the “Recent documents” limit in System Settings as soon as you return to the app — and setting it to None no longer erases the list permanently: Cocoa Packet Analyzer keeps its own copy and restores your recents when the limit is raised again.

Protocol colors are legible in both appearances. Packet colors are adjusted for the current appearance — a bright pick is darkened on a light background and a deep one lightened on a dark background, while the hue and saturation you chose are kept. Analyzer settings gain a Randomize color button for each analyzer and a Randomize all colors button for the whole set, and a color change repaints the packet list immediately for every analyzer.

In the stream and flow viewers, clicking a message's header row now shows or hides its detail rows — there is no need to aim for the small disclosure control.

Expanded German and Japanese localization across the new windows and panes.

Live capture is sturdier under load. The capture helper no longer accumulates hundreds of megabytes while recording, high packet rates no longer risk dropping packets in the kernel's capture buffer, the selected packet survives background refreshes of the list, and several causes of interface stutter during heavy captures have been removed.

A saved query now loads as the same editable pills you saved — click a value to edit it, or a predicate to change it — instead of a single opaque pill. Choosing a query in Manage Saved Queries updates the filter bar immediately.

Various bug fixes and stability improvements.

Capturing stops asking for your password. Starting a capture with Decrypt HTTPS used to ask three times — once to connect to the capture daemon, once to set the system proxy, and once more to restore it on stop. A plain capture now asks nothing at all, and decrypting asks once, for exactly what that capture needs. Stopping never asks. If a capture is interrupted and the system proxy is left pointing at Cocoa Packet Analyzer, the capture daemon puts it back the next time it starts. (non–App Store builds)

New TLS Keys window — one window for everything the app knows about TLS key material, opened from Inspect ▸ Trace TLS Keys… for the capture in front of you or Inspect ▸ TLS Key Store… for what is held app-wide; a sidebar switches between the Key Store, the Live Keylog, and a row for every open capture. For a capture it lists every TLS session with its host, server address, first packet, and key material, and the Status column reports whether the session actually decrypted — and when it did not, why: no key material, an incomplete secret set (naming the missing secret), a key that does not match the session, or a TLS version that cannot be decrypted. A coverage band summarises the whole trace at a glance, an Only problems filter narrows to what needs attention, and problems sort to the top by default. Selected sessions can be exported as a keylog file or a CSV report, and any session can jump to its first packet or open its stream.

The Key Store holds every TLS key the app has, not just the open trace's. Each frozen key set records which trace it came from — along with the sessions and host names it covers, since that is only knowable while the trace is open — and whether that trace is still where it was: Linked, Moved, Superseded by a later save, or with no record at all. Entries can be verified against their trace, re-linked after a move, exported as a keylog, or deleted — deletions are recoverable for 30 days, and keys whose trace is still present are refused outright, because deleting them is almost certainly a mistake. A session that only decrypts because another capture froze its key jumps straight to that entry, and back again.

The live keylog is dated as it is written and can be pruned by date. Secrets logged before dating existed are never pruned, and the whole log is copied aside before any prune.

Saving now writes the format you asked for. Opening a .pcapng and saving it previously wrote pcap bytes into the file — and autosave did the same with nobody pressing anything, discarding any TLS keys stored in it. The save panel gained a format picker that preselects pcapng for traces known to carry key material; saving in place never changes a file's format, and turning an existing pcapng into pcap asks first, because it destroys the keys inside.

Fixed several save faults, including one that could leave an empty file behind while reporting success, a redundant write after every save, and a race in how saves were serialised. Cancelling a save now genuinely aborts the write.

Rebuilt the toolbar's progress strip on a single source of truth, so reading, saving, exporting, filtering, statistics, printing, capturing, and reanalysing all report through the same path. pcapng export and open now show progress instead of appearing frozen, statistics report continuously rather than only at the end, and Cancel behaves consistently.

New View ▸ Scroll to Incoming Packet keeps the packet list following new packets during a live capture.

The filter bar now restores an active filter's pills when it is revealed again, saved-query pills keep their own name instead of generic prose, and the completion dropdown no longer flickers as it appears.

Live capture fixes — Cocoa Packet Analyzer now offers to save an unsaved capture when you quit, the file-capture window closes when its capture stops and hides the path bar while recording, a stale menu-bar capture no longer blocks starting a new one, and the Inspect menu stays usable in the capture window.

Export TLS Keys no longer blocks the interface while it derives key material.

The capture daemon's authorization prompts are now localized, along with gaps closed by a full audit of every strings table.

Plug-in SDK 3.0.0 — analyzer settings are now declarative: a plug-in declares its packet coloring, options and ports, and the app renders the pane under Settings ▸ Analyzers alongside the built-in analyzers. The SDK version now tracks the app's.

Various bug fixes and stability improvements.

Redesigned analyzer settings — each analyzer's options now appear inline in Settings ▸ Analyzers instead of a separate sheet, with consistent icons and switches and packet coloring pinned first. Port-based analyzers get an aligned Ports grid (name, ports, source) with live validation that flags and auto-corrects out-of-range, duplicate, or already-assigned ports; analyzers that are not port-based now say so plainly instead of showing an empty area.

Redesigned capture settings — the Capture settings tab and the capture-setup sheet now share one cockpit layout, with rotary-dial gauges for buffer size and snap length (drag, or click to type a value), a central switch console for the capture options, and a Decrypt HTTPS toggle.

Modernized the General and Fonts settings in the same style, including a three-way Appearance selector (Light / Dark / System) and click-anywhere-on-a-row to toggle its switch.

The CPA MITM Proxy configuration — system-wide proxy, listen port, and root-CA trust — is now also available in Settings ▸ MITM Proxy, sharing the same controls as the Flow Inspector setup drawer. Starting and stopping the proxy and the live flow list stay in the Proxy Flows window. (non–App Store builds)

New Regenerate Root CA action in the proxy's Certificate menu (available while the proxy is stopped) discards the current root CA and creates a fresh one, removing trust for the old certificate. Already-captured traces stay decryptable — decryption uses the recorded session keys, not the CA. (non–App Store builds)

Fixed several Packet Details glitches — flicker when switching packets, same-named fields double-opening, and stray rows lingering in the outline.

Expanded German and Japanese localization for the new capture and analyzer settings.

Fixed the live-capture window's status toolbar showing another window's activity (and its capture indicator continuing to blink) when you switched windows — each window's toolbar now reflects only its own capture and analysis progress.

Various bug fixes and stability improvements.

New reveal filter bar — a filter / search bar that toggles into view with ⌥⌘F above the packet list, with an autocomplete query field, a file path bar, and rich query helpers. Its shown / hidden state is now remembered per document.

The packet-detail header now mirrors the packet list: an always-available row of query helpers (rich editors, saved queries, logical operators) and a compact file-info block (size, format, embedded TLS-key count, and created / modified dates), both shown whether or not a packet is selected. The search field's clear button now keeps keyboard focus so you can keep typing.

New View ▸ Hide Path Bar command (⌥⌘B) hides the file path bar and the file-info block together with a smooth slide, freeing space for the packet list and detail. The setting is per window and resets on relaunch.

New top-level Inspect menu — Follow TCP Stream, Follow UDP Flow, and Inspect Subscriber Session alongside the packet context menu. The items track the current selection live and enable per protocol across a multi-packet selection.

New Reanalyze command re-runs analysis on the open trace.

Reworked packet-list column header, with its bottom separator now visible on 1× (non-Retina) displays.

Large HTTP bodies in the Flow Inspector are now formatted off the main thread and rendered in a virtualized text view, so big responses stay responsive.

Fixed a filter predicate error affecting some captures (including IGMP).

The live-capture window now draws its sidebar at full height up under the title bar, matching document windows. While capturing to a file, the Capturing… / Waiting for capture status and the stop-capture button now update live instead of staying stuck.

Clearing File ▸ Open Recent now also clears the recent files shown in the sidebar.

Various bug fixes and stability improvements.

New TLS / HTTPS analyzer — dissects the TLS record layer, handshake, and extensions with per-field byte highlighting in the hex view, parses the full certificate chain (subject, issuer, validity, serial, SANs), and correlates each ClientHello ↔ ServerHello. TLS is detected by content, so it is recognised on any port. In Follow TCP Stream the handshake, alerts, and application-data records are shown as an ordered, readable conversation.

TLS decryption in Follow TCP Stream — point Cocoa Packet Analyzer at an SSLKEYLOGFILE (Settings ▸ TLS) and it decrypts TLS 1.2 (AEAD) and TLS 1.3 application data, re-feeds the plaintext through the inner interpreters, and surfaces the decrypted HTTP request ↔ reply pairings. Decrypted records map back to every contributing packet, including records split across multiple TCP segments.

New CPA MITM Proxy — a built-in man-in-the-middle HTTPS proxy that makes TLS decryption just work, with no key-log file required (non–App Store builds). It generates its own root certificate authority, installs it into your login keychain on request, mints per-host leaf certificates on the fly, and toggles the system web proxy for you — restoring your previous settings when it stops. A live Flow Inspector window lists HTTP(S) transactions as they happen, with full request and response detail (headers, body, hex / JSON formatting) plus drag and copy. Turning on Decrypt HTTPS while capturing bridges the proxy's session keys straight into the trace, so captured HTTPS is decrypted end to end.

New pcapng support — Cocoa Packet Analyzer now reads and writes the pcapng (.pcapng / .ntar) format, preserving per-packet and section comments. File ▸ Export as pcapng saves the trace, and any TLS session keys derived for it travel inside the file as a Decryption Secrets Block — so a decrypted capture stays decryptable in other packet analyzers, and pcapng files carrying such keys open already decrypted here. pcapng files also get QuickLook previews in Finder, and their capture metadata — the writing application and OS, interface details, per-packet flags, and embedded TLS-key count — is surfaced in the packet inspector and the File Info panel.

Follow TCP Stream and Follow UDP Flow windows now put the source capture's filename in the window title, with the connection endpoints shown in the subtitle.

Redesigned Welcome window — an Xcode-style borderless window with a two-tone layout, a multi-select Recents list (open, reveal in Finder, clear), and quick actions for Capture, the MITM Proxy, Analyze, Settings, and Help. Esc or ⌘W dismisses it.

TCP reassembly now strips link-layer padding before reassembling, so short frames no longer corrupt the reconstructed stream.

Expanded German and Japanese localization covering the new TLS settings, the MITM Proxy, and the Welcome window.

Various bug fixes and stability improvements.

Follow TCP Stream now reconstructs the conversation as readable, protocol-aware messages instead of raw bytes — HTTP and Hotline exchanges are shown as ordered, colour-coded messages with a request ↔ reply pairing rail and jump-to-packet (reveal a message's packet back in the main window). Opening a stream now runs off the main thread, so large streams no longer beach-ball, and any message body — text, image, or attachment — can be dragged straight to the Finder.

New e-mail stream interpreters for SMTP, POP3, and IMAP — show the command / response transcript and extract message MIME parts (text, HTML, and attachments), each draggable to the Finder with the correct type and filename.

New Follow UDP Flow — reconstructs a UDP conversation by its four-tuple and presents it as an ordered, colour-coded exchange of datagrams with request / response pairing, protocol-aware summaries, and click-to-reveal back to the packet in the main window.

New Subscriber Session Inspector — reconstructs a dial-in subscriber session across PPPoE, L2TP, and RADIUS as a sequence ladder between the client and the access concentrator / LNS, with a summary strip (user, session, assigned IP, tunnel, duration), per-step protocol detail, expand / collapse all, and copy of a single step, value, or the whole session.

Full-fidelity printing for Follow TCP Stream, Follow UDP Flow, and the Subscriber Session Inspector — paginated graphical output that matches what is on screen.

Smoother packet-list scrolling — rows are now pre-analyzed as you scroll, so protocol detail and colour are ready by the time a row scrolls into view instead of being computed on paint.

Reworked window handling at startup — live capture now opens in its own window, documents are reserved purely for opening saved traces, and the brief empty placeholder window that used to flash at launch and when opening a .pcap is gone. Closing a capture window with unsaved packets now prompts you to save them.

New Welcome window at launch with Capture, Open, Recents, and Help, plus a Close All command (⌘⌥W).

The Follow TCP / UDP and Subscriber Session viewers now honour your Console font (Settings ▸ Fonts) for message bodies, hex dumps, and detail fields, instead of a fixed monospaced font.

Faster protocol statistics — analysis now runs off the main thread in parallel.

Plug-in SDK 1.1.0 — documented the CPAStreamInterpreting protocol so third-party analyzers can supply their own follow-stream conversation view.

Corrected the Hotline transaction-name table (validated against the Heidrun reference); the inspector now decodes the user privileges bitmap.

The Columns menu now lists the analyzer-provided columns again and no longer shows a duplicate Packet entry, and File ▸ Open Recent reliably lists your recent captures.

Expanded German and Japanese localization — Settings, the application menus, the Welcome window, and the capture filter builder are now fully translated.

Various bug fixes and stability improvements.

New Hotline protocol analyzer — dissects the Hotline / Heidrun TCP protocol. Each stream is presented as a single Hotline root with its transactions as children: transaction types and field names are rebuilt from the canonical protocol definition, long text fields are rendered as readable text, and user emoji are decoded. Non-Hotline TCP payloads are rejected rather than mis-parsed.

Packet-detail rows now each carry their own byte range, so selecting a field highlights exactly the right bytes in the hex view — including sibling fields that share a name, which are now disambiguated instead of collapsing onto one another.

The packet-details outline is anchored to the selected packet, so switching packets no longer leaves a stale selection pointing at the previous packet's fields.

Refreshed, notarized installer disk image with an updated background and layout.

New Menu Bar Capture pin / window mode — a pin button in the popover header opens the capture UI as a standalone window that survives app switches. If a capture is running and you click another app without first pinning, the popover automatically reopens as a window without stealing focus, so the activity histogram, packet counter, and stop button stay visible. The window floats above other apps while the capture is active and drops to a normal level when the capture stops. Close the window to return to ordinary popover behaviour.

Menu bar activity histogram now clears when a capture stops instead of freezing on the last byte-rate sample.

New document icon with proper light- and dark-mode appearance.

Capture setup's BPF filter expression is now seeded from UserDefaults on view appearance, so pcap_compile receives the actual current expression instead of an empty default.

Fixed a crash during document autosave while a live capture was running — a background snapshot reader was racing MainActor packet appends in PacketsProvider; the array is now guarded by an unfair lock across reads and writes.

Help book updated with the new menu-bar window behaviour.

Rewrote the Packet Details outline in SwiftUI — roomier rows, center-aligned protocol icons, rounded selection, tooltips on long values, and ⌘C copies the selected outline row.

Hex view selection: clicking a leaf field in the packet-details outline now highlights only that field's bytes on the wire; supports single-byte and range selection.

Per-leaf byte ranges wired across the full analyzer suite — Ethernet, ARP, IPv4 (incl. Frag / DS / ECN flag bits), IPv6, TCP flags, DNS, DHCP, ICMPv6 NDP options, IPCP / IPv6CP, L2TP / RADIUS AVPs, IAX, SIP, Telnet IAC, SNMP VarBinds, BGP, LDAP — clicks resolve to the exact bytes on the wire.

New Menu Bar Capture extra — quick capture from the menu bar with a live activity histogram, pre-flight gating, post-stop Open / Reveal / Discard actions, and automatic recovery of unfinished captures on relaunch.

Menu bar Live mode acts as a remote control for the document window: starting capture from the menu bar opens a fresh document with capture already running; packets stream into both the document table and the menu bar histogram.

BPF Filter Builder window can now be toggled visible / invisible from the same menu item.

Confirm-before-quit prompt when a capture is in progress.

Rewrote the live-capture pipeline for lower CPU: daemon batches packets, dropped the per-packet XPC ack, UI updates are coalesced at 30 Hz, and per-row analyzer work is deferred off the main thread.

Fixed a crash in the hex view when selecting packets immediately after opening a file.

Fixed capture-to-file silently failing on macOS 26 due to a wrong link type passed to the libpcap dump in the capture daemon.

Fixed capture setup sheet being dismissed when the document scene re-rendered.

Memory leak fixes.

Various bug fixes and stability improvements.

Fixed third-party plug-ins failing to load on release builds due to library validation.

New Quick Look preview for .pcap files — shows file summary (link type, packet count, time range), top protocols and talkers, a packet rate sparkline, and a packet table, without opening the app.

Added Spotlight indexing for .pcap files via a new Quick Look Spotlight importer — capture metadata is now searchable from Finder and Spotlight.

Welcome window: improved button hit area and live refresh of the recents column.

Fixed toolbar filter item resizing behavior.

Plug-in SDK: added a redistributable XCFramework release bundle (zip + SHA-256) for third-party plug-in developers.

Help book updates and small UI polish.

Various bug fixes.

Requires macOS 26 or later.

All analyzers ported to pure Swift.

Added OSPF protocol analyzer (RFC 2328).

Added HTTP/2 frame dissection (RFC 9113) with detection toggle.

Added protocol analyzers: SSH, IAX, SIP, WebSocket, SOAP, BGP, LDAP, SMB, SNMP, Telnet, DNS, IMAP, POP3, SMTP, FTP.

Added TCP stream reassembly (Follow TCP Stream) with Conversation, ASCII, Hex, and HTTP views.

Added protocol statistics view with printable charts.

Added printing support with progress indication.

Added Open Selection in New Window context menu on the packet table — opens 1..N selected packets in a standalone document window with full detail, hex, and toolbar-filter UI.

The toolbar filter footer's Open result in new document toggle is now fully wired: committing a filter with it enabled routes the subset into a new window and leaves the current document unchanged.

Save As… / Export… on selection windows writes a standalone .pcap file and reopens it as a proper document, inheriting the source's link type and snap length.

Added the PCAP Filter Builder to Capture Setup — a structured SwiftUI editor that covers the full pcap-filter(7) grammar (host / net / port / portrange / proto / ether / broadcast / multicast / vlan / mpls / pppoe / geneve / vxlan / wlan / byte accessors / len / inbound-outbound) with nested AND/OR/NOT groups, a live pcap_compile validator, one-click copy of the generated expression, and a raw-text escape hatch for obscure primitives.

Modernised the capture setup's filter expression card and the builder sheet with material backgrounds, rounded-rect text wells, and SF Symbol labels.

Refactored the toolbar filtering package: removed the legacy CPACompletionWindowController backup path, split the completion text view + coordinator + row view into focused extension files, and renamed the autocomplete protocols file.

Improved hex view selection and display.

Improved analyzer port customization and reload/clear notifications.

Improved capture daemon stability (non-blocking dispatch, race condition fixes).

Various bug fixes and performance improvements.