The network · tapped for a minute
A minute of the wire,
read in your browser.
Everything you see below is computed here, on this page, from a
capture file you make. Drop a .pcap or
.pcapng and TAP counts the bytes — who talked, to whom,
over which protocols, second by second. It reads headers and sizes,
not the contents of anything.
A browser cannot sniff the wire itself — no page, in any browser, on any OS, is allowed to. So the capture is made once, outside the browser, by one command already built into your machine. Nothing is uploaded: the file never leaves your computer, and TAP works with the network unplugged.
The engine
Fetch the analyser once.
The parser is one JavaScript file with no dependencies. It is not loaded until you ask for it — or until you drop your first capture, which fetches it for you. Once here it runs entirely client-side and reads only the file you hand it.
The file
One
No framework, no dependency, no build step. Plain JavaScript.
Formats
2
pcap and pcapng — both byte orders, and both nanosecond variants.
Requests it makes
0
Once loaded it never touches the network again. Not one lookup.
Your capture leaves
Never
Read with the File API in your own tab. There is nowhere for it to go.
tap-engine
Not loaded
What it decodes
- LinkEthernet II, 802.1Q and QinQ tags, RAW IP, NULL/LOOP, Linux SLL and SLL2
- NetworkIPv4 including header options and fragments, IPv6
- TransportTCP with its real data offset, UDP, ICMP; everything else counted as other
- NamesDNS and mDNS answers, TLS server names, DHCP host names, NetBIOS registrations
- NeverPayloads. The aggregator has no branch that stores one.
Prove it
The engine is one file of vanilla JavaScript — no framework, no network, no upload. It parses the capture in your tab and hands the dashboard one set of figures to draw. Fetching it makes exactly one request, to this site, for that one file.
The reading
Drop a capture.
Capture in
Waiting for a file
Drop a capture (.pcap / .pcapng) —
or make one below in one command.
It is read here in your browser; nothing is uploaded.
Window
Top talkers
Protocol mix
Top conversations
Names looked up
Read straight from the DNS question sections in the capture — what was asked for, how many times, and by which address. A name here is a name something on this network wanted; it is not a judgement about the name.
Top ports
Timeline
Local & external
Notes
Capture
Double-click. The reading appears.
The launcher finds your network card (and lets you pick, if there is more than one), records about thirty seconds, and opens this page with the reading already on screen — no file to choose. It asks for your password once, because capturing packets needs administrator rights on every operating system; that is the OS protecting the wire. Nothing is uploaded, and the capture never leaves this machine.
4The launcher
macOS & Linux
Double-click tap-capture.command.
First time, macOS may say it is from an unidentified developer —
right-click it and choose Open once. It uses the built-in
tcpdump.
Windows 10 / 11
Double-click tap-capture.bat
(it runs tap-capture.ps1 as Administrator).
It uses pktmon, built into Windows — no Npcap, no
install, no driver.
The launcher serves the capture to this page over a web server that
listens only on 127.0.0.1 and only while its window is
open. To change the length or size ceiling, pass them as arguments
(tap-capture.command 60 250) or edit the two lines at the
top of the file.
Prefer to run it yourself? Pick a length and a size ceiling and copy the command for your system. Run it, then drop the file it writes into the panel above (or re-open it with the launcher for the hands-off path).
By hand
Runs in the foreground and stops itself after the length you
chose (-G … -W 1), so
sudo can ask for your password normally. Writes
~/tap-…s.pcap in your home folder. (The launcher
above also enforces the size ceiling.)
Administrator PowerShell — not Command Prompt.
This block uses $env: and Start-Sleep,
which Command Prompt does not understand; there is a
cmd version below. pktmon ships with
Windows 10/11, so nothing needs installing. The last line
converts the capture to .pcapng for the panel above.
Administrator Command Prompt — press Start, type
cmd, right-click and choose Run as administrator.
Same capture, spelled for cmd:
%USERPROFILE% for your home folder and
timeout for the wait.
Method
Where the numbers come from, and what they can't see.
The vantage point
A capture only holds the traffic that reaches the interface you run it on. On a switched network that is your own host plus broadcast and multicast — not the whole LAN. To see more than one machine you have to capture somewhere the traffic converges: the gateway itself, a switch's mirror/SPAN port, or a Wi-Fi access point. TAP reports exactly what is in the file and never guesses at what is not.
Authorization & privacy
Capture only on a network you own or are permitted to monitor. A capture contains IP addresses, port numbers and the hostnames seen in DNS, mDNS, TLS server names, DHCP and NetBIOS — identifying, but not the contents: the launchers keep only the first 512 bytes of each packet, which is the headers and no more. Byte figures stay exact because the capture tool records each packet's true on-wire length regardless. TAP reads headers and sizes only; it never opens, stores or shows a payload, and the file is never sent anywhere.
The engine is local
The analyser is vanilla JavaScript that runs in your tab. It is fetched once from this site and then makes no network request at all — you can pull the plug and it still works. Names come only from what is in your own capture — DNS and mDNS answers, the TLS server name in a ClientHello, DHCP host names and NetBIOS registrations. There is no lookup service behind it, no request leaves the page, and a host with no observed name is shown by its address, never a guess.
The figures
Every byte figure is the on-wire length of the packet, summed. Throughput is those bytes over the capture's own span; per-service and per-port shares are of the same total. Nothing here is sampled or extrapolated: it is the file, counted. If a packet uses a link or protocol the engine does not decode, it is left out and said so in the notes rather than folded in as a guess.
Where it sits
The network shelf.
TAP is the one property here with a native half: everything else on this shelf observes from inside a browser, and TAP reads a real capture made outside it. It sits beside Network Labs, which probes and times the connection you are on, and near Sensor, Grid and Hanta, which watch the world rather than the wire.