CapAnalysis
CapAnalysis is free, open-source software for viewing and analyzing captured network traffic through a web interface.
What CapAnalysis is
CapAnalysis is free, open-source software for viewing and analyzing captured network traffic through a web interface. It indexes PCAP files and sets of files, then presents TCP, UDP, and ESP streams or flows with geographic connection views. TCP analysis reports bytes lost in each direction and total exchanged bytes without counting retransmitted packets. Deep Packet Inspection identifies more than 140 protocols, allowing protocol-based filtering. Other filters cover IP address or port, destination country, data size, and date and time. Destination countries are identified through an included MaxMind database for IPv4 and IPv6. A publicly available PCAP can be imported by URL, including one inside a ZIP archive. Linux installation packages are listed for Debian and Ubuntu in 32-bit and 64-bit versions. After installation, users open the application in a browser at localhost:9877 or the server IP on port 9877. The demo accepts PCAP files up to 20 MB and deletes dataset data at 00:00 UTC the following day.
Good
- Free GPLv2 software
- Handles individual or multiple PCAP files
- Recognizes over 140 protocols
- Detailed traffic and geographic filtering
- Available for Debian and Ubuntu
Watch out
- Demo limits uploads to 20 MB
- Demo data is deleted the next day
- Linux installation is listed for Debian and Ubuntu
Who it suits
It is aimed at information-security specialists and system administrators, and may also suit students, researchers, hackers, engineers, and developers working with PCAP data.
Verdict
CapAnalysis provides protocol inspection, flow details, geographic views, and extensive filters for PCAP collections. Its browser access and Linux packages make it a focused option for network-traffic analysis.
Plans and prices
From CapAnalysis's own pricing page, checked 8 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| CapAnalysis | Free | Open-source software under GNU General Public License version 2 |
The facts
Each one read from CapAnalysis's own pages, with the date it was checked.
What it does
- Audience
- The maker lists students, researchers, hackers, engineers, and developers as potential users.checked 8 Oct 2026
- Demo limit
- A maker post says the demo accepts PCAP files up to 20 MB and automatically deletes dataset data at 00:00 UTC on the day after creation.checked 8 Oct 2026
- Filtering
- Filters include IP or port, country, data size, protocol, and date and time.checked 8 Oct 2026
- GeoIP
- It identifies the destination country for connections using an included MaxMind database for IPv4 and IPv6.checked 8 Oct 2026
- Import from URL
- A 2016 maker post says users can import a publicly available PCAP by URL, including a PCAP inside a ZIP archive.checked 8 Oct 2026
- Multiple files
- The web PCAP viewer can manage sets of PCAP files as well as individual files.checked 8 Oct 2026
- PCAP indexing
- It indexes PCAP datasets and presents TCP, UDP, and ESP streams or flows, including geographic representations of connections.checked 8 Oct 2026
- Protocol inspection
- Deep Packet Inspection identifies more than 140 protocols, enabling flows to be filtered by protocol.checked 8 Oct 2026
- Purpose
- CapAnalysis is a web visual tool for analyzing large amounts of captured network traffic, aimed at information security specialists and system administrators.checked 8 Oct 2026
- Support
- The maker invites users to contact them by form with project questions or other inquiries.checked 8 Oct 2026
- TCP reassembly
- For TCP flows, it can report bytes lost in each direction and total bytes exchanged while excluding retransmitted packets.checked 8 Oct 2026
Where it runs
- Browser access
- After installation, the guide says to access the application in a browser at localhost:9877 or the server's IP address on port 9877.checked 8 Oct 2026
- Linux distributions
- The maker's installation guide lists Debian and Ubuntu in 32-bit and 64-bit packages.checked 8 Oct 2026
Alternatives to CapAnalysis
- 1
NETCAP
Free planOpen sourceWebAPILinuxmacOS8.1From €49 a month - 2
PacketSafari
Free planOpen sourceWebAPILinuxmacOS7.6Free plan - 3
A-Packets
Free planWebAPILinuxSelf-hosted7.5From $99 a year - 4
Wireshark
Free planOpen sourceAPILinuxmacOSSelf-hosted7.5Free plan - 5
Colasoft Capsa
Free planWindows7.4$295 one-time - 6
PcapAI
Open sourceWebAPILinuxmacOS7.4From $114 a year