Tracebastion: PCAP Lab

Version 2.0 rebuilds the analyzer: real PCAP/PCAPNG decoding, Wireshark-style filters, follow stream, findings, and pcap/CSV/PDF export. One purchase.

Tracebastion is a packet-capture analyzer for iPhone and iPad. Open .pcap and .pcapng files from Files, Mail, or AirDrop and inspect them entirely on device — a pocket workbench for reviewing captures you already have.

OPEN ANY CAPTURE

• Classic PCAP in both byte orders, with microsecond or nanosecond timestamps
• PCAPNG with multiple sections and interfaces, enhanced and simple packet blocks
• Ethernet with 802.1Q/QinQ VLAN tags, raw IP, BSD loopback, and Linux cooked captures

DECODE EVERY LAYER

• ARP, IPv4, IPv6 (with extension headers), TCP, UDP, ICMP, and ICMPv6
• DNS and mDNS queries and answers, including compressed names
• TLS ClientHello server name (SNI) and ALPN, HTTP/1.x request and status lines
• Packet detail with every decoded field linked to a highlighted hex dump

FILTER LIKE A PRO

• Wireshark-style display filters: ip.addr == 10.0.0.0/8 && tcp.port == 443, dns.qry.name contains "example", tcp.analysis.retransmission, proto == udp, frame.len > 1000
• and / or / not, parentheses, contains, regular expressions, and over 60 fields
• Clear error messages, examples, and recent filters

UNDERSTAND THE TRAFFIC

• Conversations with per-direction packets and bytes, duration, TCP state, and handshake RTT
• Endpoints with names learned from DNS answers in the capture (no lookups are made)
• DNS transactions with response times and error codes
• Protocol hierarchy, traffic-over-time chart, TLS server names, and HTTP hosts
• Follow TCP and UDP streams as text or hex, with retransmitted bytes removed

FINDINGS

• TCP retransmissions, zero windows, resets, and unanswered connection attempts
• DNS errors, ICMP unreachable messages, checksum and truncation notes
• Cleartext exposure: unencrypted HTTP, Authorization headers sent without TLS, Telnet, FTP, POP3, IMAP, and SMTP
• Tap any finding to filter the packets behind it

EXPORT

• Save filtered packets as a new .pcap (or .pcapng when link types are mixed)
• CSV tables of packets, conversations, endpoints, and protocol hierarchy
• PDF or text capture report with the file's SHA-256 fingerprint

ONE PURCHASE, EVERYTHING INCLUDED

• No subscription, in-app purchase, account, ads, analytics, or tracking
• Captures are copied into the app and decoded on device; nothing is uploaded
• A generated sample capture (documentation addresses only) lets you explore every screen before importing your own

Tracebastion reads capture files; it does not capture live traffic or decrypt TLS. Analyze only captures you own or are authorized to inspect. Findings are header-based heuristics, not proof of compromise.