PCAP WORKBENCH ·

Edit any capture. Keep every layer consistent.

Open PCAP or PCAPNG, change fields, payloads, timing, or entire conversations, and save a structurally valid capture — without sending data to the cloud.

DOWNLOAD COMMUNITY → WATCH OVERVIEW ▶ PACKET EDITOR DEEP DIVE ▶ COMPARE WITH COMPETITORS →

Windows · Linux build available upon request · Community Edition available · Full Edition $59 one time

PCAPPCAPNGOFFLINECLI

01 / PACKET-AWARE EDITING

Change the data. Let the capture follow.

Work with web, DNS, SIP/VoIP, VPN and tunnel traffic, TLS, QUIC and HTTP/2, SCTP with NGAP and S1AP, as well as industrial, enterprise, and carrier captures. Edit any field in the protocol tree or work directly with bytes. Lengths and checksums are recalculated across nested layers, including VXLAN, GRE, IP-in-IP, GTP-U, MPLS, GENEVE, IPv6 extension headers, and fragmented datagrams.

EDIT & REPAIR

Work at the level the problem demands.

Add or remove TCP and IPv4 options, IPv6 extension headers, IEs, and attributes
Edit TCP payloads while later sequence and acknowledgment numbers follow
Delete, duplicate, and reorder packets with undo
Detect truncation, invalid lengths, and bad checksums
Repair every length and checksum with Fix All
Copy and paste packets as hex, C arrays, or Python bytes
Inspect and edit TLS ClientHello, QUIC Initial (decrypt, edit, re-encrypt), and HTTP/2 headers; JA3/JA4 shown
Edit NGAP / S1AP with APER re-encoding, SCTP chunks with CRC32c, and DHCPv6 options
Change a SIP Call-ID, URI, or tag, or a GTP TEID, once and apply it to the whole call or tunnel

FOLLOW SIP CALL

From the first message to the media streams.

See calls grouped by Call-ID across UDP and TCP, through proxies and retransmissions. Inspect the ladder diagram, follow SDP changes through re-INVITE and UPDATE, and locate associated RTP and RTCP streams.

CALL STATEFrom, to, duration, forks, and retransmissions

MEDIARTP/RTCP streams with SSRC and payload type

QUALITYPacket count, loss, and jitter per stream

EDITINGSIP Content-Length and lower-layer values follow

COMPARE & TRANSFORM

Find the meaningful difference.

Compare captures byte by byte, follow TCP or UDP streams as text, search exact offsets, filter with Wireshark-style expressions, shift timestamps, preserve PCAPNG comments, apply NAT and session scaling, merge files, save reusable recipes, export only the packets that matter, and replay a capture to a lab interface — loopback by default, real networks only when explicitly allowed. An optional MCP server lets your own AI assistant run matching and TCP analysis locally.

SAFE SHARING

Anonymize consistently, not destructively.

Replace IP addresses with prefix-preserving mappings and consistently anonymize MAC addresses, ports, DNS names, HTTP hosts, cookies, credentials, SIP URIs, and email addresses.

No cloud account. No license server. No forced updates. Full Edition activation works offline with a license file. PCAP Workbench runs on an isolated lab PC as comfortably as it runs on a laptop.

COMMUNITY VS FULL

All features can be evaluated. Full removes the write limit.

Community can open and analyze captures of any size. Its limit applies when an operation writes a new capture or performs a batch edit. Full Edition is a $59 one-time license.

Feature / aspect	Community Edition	Full Edition
Core policy	All features available; operations that write a new capture see no more than the first 10 packets of each input	No packet-count limit
Package	One download: `LooshaPcapWorkbench.exe` without a license file	The same installation with a valid `license.lic`
License file	`LICENSE_COMMUNITY.txt`	`LICENSE_FULL.txt`
Window title	Shows “Community Edition”	Shows “Full Edition”
Licensed use	Personal, educational, and non-commercial; organizations may evaluate, but not use it for regular commercial work	Any lawful use, including commercial development, testing, and paid services
CLI batch: several `--input` files, `--fail-on-issues`	Full Edition feature (exit code 6); one input per run works	Available
Packet viewing and decoding	Unlimited	Unlimited
Compare	Unlimited; read-only	Unlimited
Statistics	Unlimited	Unlimited
Protocol hierarchy / Top talkers	Unlimited	Unlimited
Search and match report	Unlimited	Unlimited
Export matched packets	Only matches among the first 10 input packets	All matching packets
Edit one packet	Unlimited: fields, hex, and structure	Unlimited
Save capture as	Unlimited; saves the complete open capture	Unlimited
Batch field / raw-offset edit	Maximum 10 packets per batch; larger batches are rejected	Unlimited
Batch time edit	Same 10-packet batch limit	Unlimited
Delete, duplicate, move, comments, checks, streams, hex copy/paste	Unlimited	Unlimited
Export packets	Only selected/filtered packets numbered 1–10 in the source capture	All selected or displayed packets
SIP calls and RTP analysis	Unlimited: list, ladder, RTP stats, filtering, and single-message editing	Unlimited
Export SIP call	Only call packets among capture packets 1–10	All call packets
PCAP tools that write files	Operate on a copy of the first 10 input packets	Operate on the complete input
Merge	Each input is capped to its first 10 packets before merging	All packets from all inputs
Recipes	Input is capped once, at the beginning of the chain	Complete input
Scale / Session Multiplier	Preview of at most 10 sessions from the first 10 sample packets; Increment, TBCD, and Fixed hex only	Unlimited, streamed; Random and List values
Timestamp / Profile	First 10 input packets	Complete input
CLI recipes	`--run-recipe` and `--list-recipes` are available; writes use the 10-packet limit and report truncation	Complete input
TLS / QUIC / HTTP/2, SCTP, NGAP / S1AP, DHCPv6 editors	Available; writes follow the 10-packet limit	Unlimited
Send to network	Available	Available
AI assistant (MCP)	Recipe list and analysis tools	Also recipe runs and report export with confirmation
Warranty and support	As-is, without product warranty	30-day limited warranty; updates/support according to the order term
tshark / Wireshark	Optional and not bundled	Same

Community Edition

Free for personal, educational, and non-commercial use; organizations may use it for evaluation.

DOWNLOAD OPTIONS →

Full Edition · $59

Unlimited write and batch operations for lawful commercial and non-commercial use.

BUY / CONTACT SALES →

DOWNLOAD DETAILS

System requirements and file integrity.

PCAP Workbench runs on Windows and includes its Python runtime; no system Python installation is required. A Linux build is available upon request.

Requirements

Windows: Windows 10/11 64-bit; unzip and run; no administrator rights required to start
Linux: Linux build available upon request — undefinable@yandex.com
Memory: 512 MB or more recommended; large captures may require more
Display: 1280×800 or larger recommended
Optional: tshark / Wireshark for full protocol trees; Npcap for Send to network

Packages and SHA-256

Package	Approx. size	SHA-256
Windows zip (LooshaPcapWorkbench_1.8.7_Windows.zip)	—	`3b7ba79238f2de1edc2a49431ca2ee9a2ddad36e710c114b5ff7567b4afc83c5`
Linux build	—	Available upon request

License summary only. The complete license text supplied with each package governs use. Release notes and the User Guide are included in the package; NGAP / S1AP support uses pycrate (LGPL), shipped as a separate library folder.