Cocoa Packet Analyzer for MAC
Free, native Mac packet analyzer: capture network traffic, see which app sent each packet, and read HTTPS, HTTP/2 and HTTP/3 in plain text.
Cocoa Packet Analyzer Overview
Cocoa Packet Analyzer is a native Mac network protocol analyzer and packet sniffer. It captures traffic on Ethernet and Wi-Fi, dissects each packet as it arrives and shows it field by field, with more than 50 protocol analyzers. It can record which app sent or received each packet, so you see Safari or your own app rather than an anonymous connection, and an Applications window adds up packets and bytes per app while the capture runs. It reads and writes pcap and pcapng files, so you can also open traces made with other tools.
Encrypted traffic can be read too: point the app at a TLS key log, or switch on its built-in MITM proxy, and HTTPS, HTTP/2 and HTTP/3 rows turn into readable requests and responses. The proxy runs on your own Mac only while you switch it on, needs you to trust its certificate and restores your proxy settings when you stop; only inspect traffic you are entitled to. Cocoa Packet Analyzer is made by Daubit & Francke GmbH and is free, with no trial, tiers or account. Version 4.1.0 adds traffic by app, captures side by side and filtering on any field. It needs macOS 26 or later, is a universal app and is notarized by Apple. A free Mac App Store version does everything except capturing.
Key Features
Cocoa Packet Analyzer shows what your Mac sends over the network.
- Live capture: Ethernet and Wi-Fi, in a window or from the menu bar, with several captures side by side.
- Traffic by app: record the app behind each packet and count packets and bytes per app.
- HTTPS in plain text: TLS 1.2 and 1.3 decryption from a key log or keys stored in a pcapng.
- Built-in proxy: decrypt HTTPS from this Mac or another device, with a live request monitor.
- QUIC and HTTP/3: decrypted, with frames and headers you can filter on.
- Filters: filter on any field in the packet details, with saved queries and recent filters.
- Follow streams: turn a TCP, UDP or QUIC conversation back into readable text.
- Plugin SDK: write analyzers for your own protocols in Swift.
What’s New in Version 4.1.0
Cocoa Packet Analyzer 4.1.0 shows which app sent or received each packet.
- Record the process, interface and direction of each packet, also from pktap traces
- New Applications window with packets, bytes and share per app during a capture
- Captures run side by side, one per window, beside the menu bar capture
- Filter on any field of the packet details, much faster on large traces
- Decrypted HTTP/2 shows as HTTPS, with gRPC messages and their fields
- New LLDP analyzer, and malformed packets no longer crash the app
Cocoa Packet Analyzer FAQ
Is Cocoa Packet Analyzer free?
Yes. The download has every feature for free, with no trial, no tiers and no account.
Which macOS version does Cocoa Packet Analyzer need?
Version 4.1.0 needs macOS 26 or later. Macs on macOS 10.14.6 to 15.7.4 can use the older version 2.1.4 from the developer’s website.
Does Cocoa Packet Analyzer run on Apple Silicon?
Yes. It is a universal app that runs natively on Apple Silicon and Intel Macs, and it is notarized by Apple.
What is the difference between the download and the Mac App Store version?
Both are free. The Mac App Store version can open, analyze and decrypt traces and includes the proxy, but it cannot capture traffic, so it has no capture window, no menu bar capture and no process recording.
Can it show which app sent a packet?
Yes. Turn on Record processes during a live capture and each packet carries the app that sent or received it. It can also read pktap traces made with tcpdump.
Can Cocoa Packet Analyzer read HTTPS traffic?
Yes, with the keys. It decrypts TLS 1.2 and 1.3 from a key log or a pcapng that carries its keys, or you can use the built-in proxy.
What is the MITM proxy?
A local proxy that you switch on yourself. It creates its own certificate authority, which you have to trust, so it can show HTTPS requests and responses in plain text. Your previous proxy settings are restored when you stop it.
Which file formats does it open?
pcap and pcapng, for reading and writing, plus HAR files from the proxy monitor or browsers.
Can I install Cocoa Packet Analyzer with Homebrew?
Yes. Run brew install --cask cocoapacketanalyzer.
Where does the Cocoa Packet Analyzer download on cocoa-packet-analyzer.FULLMAC.app come from?
The download button leads to the official Cocoa Packet Analyzer website at https://www.tastycocoabytes.com/. cocoa-packet-analyzer.FULLMAC.app does not change or repackage the app.
Similar Apps
OrbStackOrbStack is a fast, light and simple way to run Docker containers and Linux machines on your Mac. It is a drop-in replacement for Docker Desktop: your docker and docker compose commands keep working, and on first start OrbStack offers to copy over your existing Docker Desktop containers, images and volumes. It starts in seconds, uses less than 0.1% background CPU on Apple Silicon and returns unused memory to macOS. Besides containers it runs full Linux machines from 16 distributions, and a lightweight Kubernetes cluster for local development. OrbStack is made by Orbital Labs.Developer Tools
QuotaBarIf you use OpenAI Codex with a ChatGPT account, the usage limits reset on a 5-hour and a weekly window, and checking how much is left means opening Codex or ChatGPT. QuotaBar puts the remaining percentage in the Mac menu bar and refreshes it every 60 seconds. Click the icon for a detailed panel with every limit window and its reset countdown, or turn on a small floating HUD that stays on top of other windows.Developer Tools
Stargazer BarStargazer Bar is a small native menu bar app for Mac that keeps an eye on GitHub repositories for you. It puts a live star count in the menu bar, so you can see how a project is doing without keeping a browser tab open, and a click opens a dropdown with the details: star and fork trend charts, release download totals and a maintainer radar. Public repositories are measured by their stars. Private repositories, which have no stars, are measured by what needs your attention: a failing build, an unanswered issue or a new pull request.Developer Tools
Notch So GoodNotch So Good turns the notch of your MacBook into a small status display for AI coding agents. While Claude Code or the OpenAI Codex CLI works, a black pill extends the notch: a 3D character called Peek sits on the left, and a ring on the right shows how much of your 5-hour usage window is left. The more a session needs you, the further Peek climbs out. When a task finishes, fails or runs into a usage limit, the notch opens into a card that says what happened and in which project, and a click jumps to the exact terminal tab, tmux pane included.Developer Tools
Claude UsageClaude Usage is a small native app for people who use Claude Code. In the menu bar it shows your current five-hour session, your weekly usage for all models and for Sonnet, and your pay-as-you-go credits, each with a usage bar and its reset time, without opening Claude Code. It also adds a one-line readout under your Claude Code prompt with the model, how full the context window is and the tokens used, so you can compact a session before it runs out of room. Each terminal pane shows its own readout, also across tmux.Developer Tools
TintpadTintpad is a free, open-source launcher for developers who work with command-line coding agents such as Claude Code and Codex. Press Option-Command-Space anywhere and a black drop falls out of your Mac's notch, or hangs below the menu bar on Macs without one, with your repositories inside. Type a few letters, press Return, and your own terminal opens at that repository with the agent already running, in the mode you used there last.Developer Tools
FULLMAC.app does not host this app. Download buttons lead to the developer’s own pages.