Tracebastion: PCAP Lab

About Tracebastion: PCAP Lab

Tracebastion is a packet-capture analyzer for iPhone and iPad. Open .pcap and .pcapng files from Files, Mail, or AirDrop and inspect them entirely on device — a pocket workbench for reviewing captures you already have.

OPEN ANY CAPTURE
- Classic PCAP in both byte orders, with microsecond or nanosecond timestamps
- PCAPNG with multiple sections and interfaces, enhanced and simple packet blocks
- Ethernet with 802.1Q/QinQ VLAN tags, raw IP, BSD loopback, and Linux cooked captures

DECODE EVERY LAYER
- ARP, IPv4, IPv6 (with extension headers), TCP, UDP, ICMP, and ICMPv6
- DNS and mDNS queries and answers, including compressed names
- TLS ClientHello server name (SNI) and ALPN, HTTP/1.x request and status lines
- Packet detail with every decoded field linked to a highlighted hex dump

FILTER LIKE A PRO
- Wireshark-style display filters: ip.addr == 10.0.0.0/8 && tcp.port == 443, dns.qry.name contains "example", tcp.analysis.retransmission, proto == udp, frame.len > 1000
- and / or / not, parentheses, contains, regular expressions, and over 60 fields
- Clear error messages, examples, and recent filters

UNDERSTAND THE TRAFFIC
- Conversations with per-direction packets and bytes, duration, TCP state, and handshake RTT
- Endpoints with names learned from DNS answers in the capture (no lookups are made)
- DNS transactions with response times and error codes
- Protocol hierarchy, traffic-over-time chart, TLS server names, and HTTP hosts
- Follow TCP and UDP streams as text or hex, with retransmitted bytes removed

FINDINGS
- TCP retransmissions, zero windows, resets, and unanswered connection attempts
- DNS errors, ICMP unreachable messages, checksum and truncation notes
- Cleartext exposure: unencrypted HTTP, Authorization headers sent without TLS, Telnet, FTP, POP3, IMAP, and SMTP
- Tap any finding to filter the packets behind it

EXPORT
- Save filtered packets as a new .pcap (or .pcapng when link types are mixed)
- CSV tables of packets, conversations, endpoints, and protocol hierarchy
- PDF or text capture report with the file's SHA-256 fingerprint

ONE PURCHASE, EVERYTHING INCLUDED
- No subscription, in-app purchase, account, ads, analytics, or tracking
- Captures are copied into the app and decoded on device; nothing is uploaded
- A generated sample capture (documentation addresses only) lets you explore every screen before importing your own

Tracebastion reads capture files; it does not capture live traffic or decrypt TLS. Analyze only captures you own or are authorized to inspect. Findings are header-based heuristics, not proof of compromise.