Everything Frame Bench does
One frame table underneath. Edit a byte and every view updates.
Editing and integrity
Every edit is undoable and checked.
Byte-level hex editing
Type into any offset, or cut, copy and paste ranges as hex, text or a C array.
Health check auto-fix
Recomputes lengths and checksums after every edit, padding included.
Undo, redo, revert
Undo a whole batch in one step, or revert every changed frame at once.
Notes and comments
Annotate a byte range or a frame. Exports keep them.
Crafting frames
From a guided form to a batch run across a whole capture.
Guided builders
TCP, UDP, DNS, ICMP, ARP and HTTP from real fields, with checksums done for you. Point a step or an HTTP body at a file and it is streamed from disk in chunks you size, as TCP segments or UDP datagrams, so a large file never has to be loaded. A dice button next to every MAC and IP address field fills in a random one of the kind you pick.
Craft lab
Expressions, series with a library of ready-made snippets, mutation and fuzzing, and multi-frame scenarios, including whole TCP and UDP streams you type as a conversation (multi-line HTTP messages, TCP options with SACK and timestamps, lost, duplicated or reordered segments, fast retransmit, a zero window, IPv4 fragments, ICMP fragmentation needed, a wrong checksum) and ready-made SMTP, FTP, WebSocket, HTTP/2, TLS 1.2, page-load and DNS-over-TCP exchanges with real timing. A preview table lists the frames before you generate them, a captured stream can be filled in as a conversation to edit and replay, and a Series can read its values from a table. A whole connection is also one expression, Stream(client=..., server=..., messages=...), which a Series can vary (100 streams on 100 ports, one per table row), Mutate can fuzz one message of, and the form view edits. Attach a file and use Raw(file="name") or HTTPRequest(bodyfile="name"); it is read in blocks while the frames are built. Every tab has a live Result pane under its settings, and any card, the Result included, can be detached into its own floating window to keep in view: the frames with their times and flags, a timeline of who sent what, and the totals, before anything is added. The window floats beside the main one, stays open when you add a frame, and resizes from every edge. One frame at a time is in every tier; series, mutate/fuzz and Stream expressions are in Crafting and Complete; the ready-made scenarios and shareable packs are in Complete.
Batch apply
XOR, add a template, rewrite addresses or recalculate seq/ack across many frames.
Templates and library
Save custom layouts and crafted frames. Reuse them in any capture.
Analysis and decryption
The views you expect, next to the frame table.
Expert findings
Reads the decoded frames like an analyst and ranks what is wrong: retransmissions, resets, refused or unanswered connections, slow responses, DNS and HTTP failures, TLS alerts, duplicate IPs. It also spots port scans and floods, clear-text logins, weak TLS and bad certificates, DNS tunnelling, SMB, Kerberos, NTP, SIP and voice problems, and captures that are damaged or merged badly. Each finding says why it matters and what to check, filters the table to its frames, and can be muted, folded away by kind, compared with a baseline, or saved as a report, ticket, JSON or SARIF file. The thresholds are yours to change. With the Complete bundle you can also write your own rules, share them as files or read them from a shared folder, and open any built-in rule to see in plain words how it decides.
TLS and QUIC decrypt
From a keylog or PcapNG secrets, with certificate extraction and search.
Conversations and hosts
Protocol hierarchy, hosts and ports, and a host graph you can drag, pan and zoom, in circle, force or radial layouts, with details for the host you click and its frames one click away.
RTP streams
Loss, reordering and jitter per stream.
Filter language
Autocomplete, presets and fields like http.status and frame.cap_len, with contains, matches, starts_with and ends_with, each with a case-insensitive twin. Test membership with tcp.dstport in {80, 443, 8000..8100}, and spot encrypted or packed payloads with entropy fields for frames, TCP and UDP payloads and HTTP bodies. The full reference (PDF).
Extract field values
Every distinct value of a field, counted and traced to its frames.
Signature search
Find byte patterns across the whole capture.
Workspace
Pick up where you left off.
Sessions
Save frames, templates, rules and filters as one gzip-compressed file. Choose what it carries, down to a small file with no frame data that restores onto the same capture. Restore it later from the recent list.
Views, filters, coloring
Saved table views and rules, with a live preview as you tune a color.
Compare frames
Byte diff of up to five frames. Export as HTML, Markdown or unified diff.
Windows that float
The Craft lab, Compare, Findings report, DNS names, Trash and Frame library stay open beside the main window. Collapse one to its title bar or a narrow strip, resize it from any edge, and click any window to bring it forward.
Move frames
Right-click a frame, or a set you checked, and move it to any position, with the numbering following if you like. One undo puts them back.
Payload viewer
Right-click a TCP or UDP frame to open its payload on its own, only when you ask for it. HTTP, HTTP/2, SIP and RTSP messages are laid out in full (start line, headers, query, cookies, indented JSON, decoded gzip) and can be put back together from every frame they span, or read decrypted once a TLS stream is decrypted; SMTP and FTP show each command and reply in plain words. Find in the text, save the body, or switch the raw view between hexdump and text.
Built for big captures
Multi-gigabyte files without a frozen window.
Large-capture mode
Indexes the file and loads only the range or filter you pick. Expert findings read an 860,000-frame capture in about half a minute.
Streaming export
Writes filtered output straight to disk in chunks.
Live re-indexing
Watches a growing capture and offers its new frames.
Scans in the background
Expert findings and the Health check read the frames in one pass behind a progress counter, so the window stays usable and a big capture is read once, not twice.
Low memory setting
In the desktop app, one Preferences choice trades some speed for far less memory on very large captures, with the renderer peaking at under half of what it otherwise would.
Export what changed
The whole capture, only your edits, or a filtered slice.
.pcap and PcapNG
Every section and interface kept, nanosecond times, packet comments and flags, host names, TLS and WireGuard secrets, gzip or Zstandard, and split into several files.
HTML reports
Frame lists, findings reports, summaries and comparisons share one clean layout with a filter bar, expand and collapse, and print. The findings report covers every frame you annotated, and can add the Expert findings.
Raw-frames JSON
Lossless, diffable, with notes and comments.
Settings file
Templates, presets and rules in one portable file.
Transform and import
Change what a frame is, or bring in what was never a pcap.
TCP and UDP conversion
Convert a stream either way. Seq/ack and checksums are rebuilt.
IPv4 and IPv6 conversion
Stateless NAT64 translation through a configurable /96 prefix.
Fiddler SAZ and HAR import
Sessions arrive as real, editable TCP and HTTP frames.
Rewrite addresses
A saved MAC, IP and port preset, applied to every frame in scope.
Edit timestamps
Set a time exactly or shift by an offset, per frame or for the whole capture.
Send to a network
Put what you crafted onto a real interface through Npcap. Off until you turn it on, a low starting rate, hard limits, broadcast and multicast refused unless you allow them, and a system confirmation before anything goes out. In the Crafting and Complete tiers.
See these capabilities strung into a real workflow
See nine scenarios, start to finish.
Read the scenarios
All Rights Reserved © Netomize