PCAP WORKBENCH ·
Edit any capture. Keep every layer consistent.
Open PCAP or PCAPNG, change fields, payloads, timing, or entire conversations, and save a structurally valid capture — without sending data to the cloud.
Windows and Linux · Community Edition available · Full Edition $59 one time
01 / PACKET-AWARE EDITING
Change the data. Let the capture follow.
Work with web, DNS, SIP/VoIP, VPN and tunnel traffic, as well as industrial, enterprise, and carrier captures. Edit any field in the protocol tree or work directly with bytes. Lengths and checksums are recalculated across nested layers, including VXLAN, GRE, IP-in-IP, GTP-U, IPv6 extension headers, and fragmented datagrams.
EDIT & REPAIR
Work at the level the problem demands.
- Add or remove TCP and IPv4 options, IPv6 extension headers, IEs, and attributes
- Edit TCP payloads while later sequence and acknowledgment numbers follow
- Delete, duplicate, and reorder packets with undo
- Detect truncation, invalid lengths, and bad checksums
- Repair every length and checksum with Fix All
- Copy and paste packets as hex, C arrays, or Python bytes
FOLLOW SIP CALL
From the first message to the media streams.
See calls grouped by Call-ID across UDP and TCP, through proxies and retransmissions. Inspect the ladder diagram, follow SDP changes through re-INVITE and UPDATE, and locate associated RTP and RTCP streams.
COMPARE & TRANSFORM
Find the meaningful difference.
Compare captures byte by byte, follow TCP or UDP streams as text, search exact offsets, filter with Wireshark-style expressions, shift timestamps, preserve PCAPNG comments, apply NAT and session scaling, merge files, save reusable recipes, and export only the packets that matter.
SAFE SHARING
Anonymize consistently, not destructively.
Replace IP addresses with prefix-preserving mappings and consistently anonymize MAC addresses, ports, DNS names, HTTP hosts, cookies, credentials, SIP URIs, and email addresses.
No cloud account. No license server. No forced updates. PCAP Workbench runs on an isolated lab PC as comfortably as it runs on a laptop.
COMMUNITY VS FULL
All features can be evaluated. Full removes the write limit.
Community can open and analyze captures of any size. Its limit applies when an operation writes a new capture or performs a batch edit. Full Edition is a $59 one-time license.
| Feature / aspect | Community Edition | Full Edition |
|---|---|---|
| Core policy | All features available; operations that write a new capture see no more than the first 10 packets of each input | No packet-count limit |
| Windows executable | LooshaPcapWorkbenchCommunity.exe | LooshaPcapWorkbench.exe |
| License file | LICENSE_COMMUNITY.txt | LICENSE_FULL.txt |
| Window title | Shows “Community Edition” | Shows “Full Edition” |
| Licensed use | Personal, educational, and non-commercial; organizations may evaluate, but not use it for regular commercial work | Any lawful use, including commercial development, testing, and paid services |
| Edition switch in GUI | No; the Community build is locked | Yes; Community behavior can be enabled temporarily for testing |
CLI --edition full | Rejected in the locked Community build | Available; Full is the default |
| Packet viewing and decoding | Unlimited | Unlimited |
| Compare | Unlimited; read-only | Unlimited |
| Statistics | Unlimited | Unlimited |
| Protocol hierarchy / Top talkers | Unlimited | Unlimited |
| Search and match report | Unlimited | Unlimited |
| Export matched packets | Only matches among the first 10 input packets | All matching packets |
| Edit one packet | Unlimited: fields, hex, and structure | Unlimited |
| Save capture as | Unlimited; saves the complete open capture | Unlimited |
| Batch field / raw-offset edit | Maximum 10 packets per batch; larger batches are rejected | Unlimited |
| Batch time edit | Same 10-packet batch limit | Unlimited |
| Delete, duplicate, move, comments, checks, streams, hex copy/paste | Unlimited | Unlimited |
| Export packets | Only selected/filtered packets numbered 1–10 in the source capture | All selected or displayed packets |
| SIP calls and RTP analysis | Unlimited: list, ladder, RTP stats, filtering, and single-message editing | Unlimited |
| Export SIP call | Only call packets among capture packets 1–10 | All call packets |
| PCAP tools that write files | Operate on a copy of the first 10 input packets | Operate on the complete input |
| Merge | Each input is capped to its first 10 packets before merging | All packets from all inputs |
| Recipes | Input is capped once, at the beginning of the chain | Complete input |
| Scale / Session Multiplier | The sample is capped to its first 10 packets; multiplier and session count are not capped | Sample is not capped |
| Timestamp / Profile | First 10 input packets | Complete input |
| CLI recipes | --run-recipe and --list-recipes are available; writes use the 10-packet limit and report truncation | Complete input |
| Warranty and support | As-is, without product warranty | 30-day limited warranty; updates/support according to the order term |
| tshark / Wireshark | Optional and not bundled | Same |
Community Edition
Free for personal, educational, and non-commercial use; organizations may use it for evaluation.
DOWNLOAD OPTIONS →Full Edition · $59
Unlimited write and batch operations for lawful commercial and non-commercial use.
BUY / CONTACT SALES →DOWNLOAD DETAILS
System requirements and file integrity.
PCAP Workbench runs on Windows and Linux. Both releases include their Python runtime; no system Python installation is required.
Requirements
- Windows
- Windows 10/11 64-bit; unzip and run; no administrator rights required to start
- Linux
- x86-64; Debian/Ubuntu/Mint, Fedora/RHEL/Rocky, or tar.gz; packaged PyInstaller runtime, no system Python
- Memory
- 512 MB or more recommended; large captures may require more
- Display
- 1280×800 or larger recommended
- Optional
- tshark / Wireshark for full protocol trees
Packages and SHA-256
| Package | Approx. size | SHA-256 |
|---|---|---|
| Full Windows zip | 26.2 MB | 1e043d7921868cfa9855017ce99535c4b88d5ac8b51f150c0966e3a2e36e53a8 |
| Community Debian / Ubuntu .deb | 11.2 MB | b867ef0408b33face553a462ab06f3b916921d2b8b9de9e2d8b79a373940991e |
| Community Fedora / RHEL .rpm | 13.8 MB | b5c47278657b97a85ef38621a795e7a336245250eb5278d703269fd12b4238f2 |
| Community Linux tar.gz | 13.8 MB | c503f241174d491b2196968d7011815f872c4e15d3e5a7d66e0da84bc419a285 |
License summary only. The complete license text supplied with each package governs use. Separate release notes were not supplied for this page.