ByteSniffer

Description

ByteSniffer brings professional-grade network packet capture and analysis to iOS. Powered by a local VPN tunnel and a custom protocol parser, ByteSniffer gives you complete visibility into your device's network traffic without sending a single byte to the cloud.

Whether you're debugging an API, auditing app behavior, studying network protocols, or testing security, ByteSniffer delivers the raw data you need in a fast, readable interface that will feel immediately familiar to Wireshark users.

---

Capture Everything. Inspect Anything.

ByteSniffer captures live IP traffic at the transport layer and decodes it in real time:

TCP & UDP: Full header parsing with flags, ports, and session tracking

DNS: Query and response decoding, QTYPE detection, pointer-compressed name resolution

HTTP: Method, URI, headers, and status codes with color-coded request types

TLS/SSL: SNI extraction from ClientHello, handshake state tracking

QUIC: Long-header packet detection on UDP/443

ICMP / ICMPv6: Echo, Unreachable, Neighbor Discovery, and more

Everything runs on-device. No proxy required by default. No data leaves your device unless you explicitly export it.

---

An Interface Built for Technical Work

ByteSniffer's interface is compact, dense, and optimized for scanning large captures fast. If you've used Wireshark, the layout will feel natural from the first launch.

Packet List: Live-updating table with timestamp, source, destination, protocol, length, and parsed info. Sort by any column. Auto-scroll during capture or lock the view to inspect.

Connection View: Session-grouped view that aggregates packets into flows. See packet count, byte totals, and duration per connection at a glance.

Packet Detail: Four-tab deep-dive per packet: Overview, Protocol Tree, Hex Dump, and Payload preview. Inspect raw bytes alongside parsed fields.

Stats: Protocol distribution, packet rate over time, top destinations, and top conversations, all computed from your live capture.

---

Filter Like a Pro

ByteSniffer's display filter system uses a field-based expression syntax inspired by Wireshark. Write expressions using protocol fields, boolean logic, and operators to get to exactly the packets that matter:

app_proto == "dns" and ip_dst contains "8.8.8"

tcp_flags_syn == true and not tcp_flags_ack == true

http_method == "POST"

Save named filter presets for repeated workflows. Real-time validation shows match count as you type.

---

Export and Share

Export your capture in JSON or JSONL format to any destination on your device: Files, Mail, AirDrop, or any app on the share sheet. Export all packets or only the ones matching a filter. Filenames are timestamped automatically.

---

Built for:

Mobile app developers debugging network calls

Network engineers diagnosing connectivity issues

Security researchers inspecting TLS handshakes and DNS behavior

Developers auditing what data their apps actually send

Students and professionals learning networking protocols firsthand

---

Privacy by Design

All packet data is stored exclusively in a local, sandboxed container on your device. Nothing is uploaded automatically. Nothing is shared with third parties. Captures are cleared when the app closes unless you enable session persistence in Settings.

ByteSniffer is intended for authorized testing, debugging, and educational use on your own device or networks you have permission to monitor.