Tracexy

A native, session-first Wireshark alternative for macOS.

Native macOS network intelligence, organized around sessions—not packet noise.
Capture live traffic or open a saved capture, then investigate hosts, processes, protocols, timing, and raw packet evidence in one local-first workspace.

_{The AGPL-licensed public source edition of Tracexy for macOS.}

---

Latest Tagged Release

v0.7.0 — 2026-09-08

Added

• Organize investigations into isolated Projects, each with its own workspaces, saved captures, History, and capture and privacy settings.
• Import PCAP and PCAPNG captures into a chosen Project, including gzip-compressed files, TCP Viewer session archives, and Linux cooked captures.
• Query whole sessions with bounded Session Expressions, return from host, client, IP, or Findings drill-downs with filters intact, and import named BPF capture filters.
• Export and import configuration-only .tracexyproject files without packets, payloads, capture paths, findings, or History.

Changed

• Keep Project transitions safe by waiting for accepted capture and save work, preserving the current investigation when a transition cannot complete.
• Reorganize the native toolbar so Project selection, capture source, and Start/Stop controls remain distinct and easier to follow.

See CHANGELOG.md for the full release history.

Tracexy is an open-source network intelligence app built specifically for macOS. It captures traffic passively and turns frames into explainable sessions and correlated activities: which process contacted which host, which protocols appeared, how much data moved, and what evidence supports the grouping.

The main experience is session-first. Raw protocol fields and hex remain one click away when the bytes are the answer, but they do not dominate the workspace.

Important

This repository contains Tracexy's public source edition under AGPL-3.0-or-later. Builds made solely from this repository are AGPL builds. Rockxy LLC may also offer official binaries, support, enterprise rights, hosted services, or downstream distributions under separate commercial terms. Those terms apply only to the copy, service, or distribution that presents them; they do not remove the AGPL rights granted for this public source edition. Third-party components remain under their own licenses; see Licensing below.

Part of the Rockxy Ecosystem

Tracexy is part of the Rockxy ecosystem, a family of native, local-first tools for understanding and controlling software and network behavior. The products have distinct jobs and separate repositories, while sharing a focus on transparent evidence, explicit data boundaries, and native platform experiences:

• Rockxy — intercept, inspect, and modify HTTP, HTTPS, WebSocket, GraphQL, and other application traffic.
• Tracexy — passively capture network traffic and organize it into explainable sessions, protocol observations, and evidence-linked investigation workflows.
• Shieldxy — application-aware network security, connection control, and policy-oriented visibility.

Tracexy complements the ecosystem rather than replacing any one tool: the application-level debugger focuses on traffic control, while Tracexy focuses on passive network intelligence across interfaces, processes, protocols, and session relationships.

See Tracexy in action

From live capture to explainable sessions and packet-level evidence.

Choose the interface and start from the traffic surface that matters.

Control capture scope, filters, packet detail, and retention before traffic leaves the wire.

Inspect decoded protocol fields alongside the raw bytes that support them.

Why Tracexy

• Sessions before packets. Bidirectional traffic is grouped by canonical five-tuple so one conversation stays together.
• Explainable correlation. Related DNS, TCP, TLS, and HTTP observations can be grouped into an activity with visible confidence and contested-attribution states.
• Native investigation workflow. The app uses SwiftUI and AppKit for a real macOS sidebar, table, toolbar, split views, inspectors, menus, keyboard behavior, and SF Symbols.
• Isolated Projects. Keep separate investigations with their own workspaces, saved captures, History, filters, and capture and privacy settings.
• Evidence stays available. Summaries lead to decoded layers, field ranges, and raw hex without leaving the selected session.
• Honest unknowns. Missing process, hostname, protocol, or timing evidence is shown as unknown; Tracexy does not manufacture telemetry.
• Local-first by design. Captured frames and derived session data stay on the Mac unless the user explicitly exports a capture.

What works today

Area	Available now
Capture	Live libpcap capture through a privileged helper; interface discovery; bounded frame buffering; PCAP/PCAPNG read/write; managed gzip, TCP Viewer archive, and Linux cooked capture import
Decode	Ethernet, loopback and tunnel framing; ARP; IPv4/IPv6; ICMP/ICMPv6; TCP/UDP; DNS, TLS, HTTP/1, STUN, and QUIC summaries
Sessions	Direction-normalized five-tuple grouping, byte/timing summaries, bounded TCP lifecycle and sequence evidence, and higher-level activity correlation
Investigation	Overview, session table, flow map, scoped search, typed queries, evidence-linked findings, bounded Follow Stream, decoded fields, and hex evidence
History	Local SQLite terminal capture/session summaries with bounded reads, explicit refresh, confirmed clear, and no packet-payload persistence
Automation core	Read-only one-page History projections with minimum disclosure, deterministic JSON, and spreadsheet-safe RFC-4180 CSV; no executable or network transport
Workspace	Native sidebar, independent workspace tabs, vertical or bottom inspector layouts, status/footer surfaces, Focus Sets, and Noise Control
Projects	Isolated investigations with separate workspaces, saved-capture Library, History, capture/privacy settings, and configuration-only import/export
Attribution	Best-effort process ownership from pktap metadata with a local socket-to-process fallback

Comparison at a glance

Tracexy is not a Wireshark clone or a TLS interception proxy. It is strongest when a Mac investigation needs app-aware sessions, local packet evidence, and a support-ready handoff without claiming decrypted HTTPS visibility. The full maintained matrix is in docs/comparison.md.

Decision point	Tracexy	Wireshark	tcpdump	TShark	Packet	Cocoa Packet Analyzer
Primary workflow	Native macOS, session-first packet evidence with app/process context	Deep protocol dissection and broad packet-analysis workflow	Small command-line capture primitive	Wireshark dissection and field output in a terminal	Friendly native Mac traffic view	Native Mac packet/trace analyzer
Source/license posture	AGPL-3.0-or-later public source; separate commercial terms may exist for official distributions	Public open-source project	Public open-source command-line tool	Public open-source Wireshark command-line tool	closed source or no public information	closed source or no public information
Live capture	Live libpcap capture through a narrow privileged helper	Live interface capture	Live interface capture from terminal	Live capture from terminal	Native Mac live traffic workflow, depth requires vendor verification	Capture workflow requires vendor verification
App/process attribution	Core workflow when macOS context is available; unknown stays unknown	Possible through capture context, not the central workflow	Depends on capture context and surrounding tools	Available only if fields/capture context expose it	Per-app usage is publicly positioned, implementation depth requires vendor verification	Not a central verified claim
TLS and HTTPS payloads	TLS metadata only; no TLS interception, no decryption, no encrypted HTTP body visibility	Packet visibility depends on keys, capture point, and protocol conditions	Captures bytes; no HTTP interception workflow	Same packet-analysis boundary as Wireshark	Not positioned as an HTTPS interception proxy	Packet-analyzer boundary; no verified HTTPS interception claim
Best aligned user	Mac developer/support/security workflow that needs app-aware packet evidence without decrypting traffic	Protocol engineer or analyst needing maximum dissector depth	Operator collecting traffic quickly on a terminal or remote system	Analyst automating Wireshark-style dissection	Mac user wanting a friendly traffic view	Mac user wanting a native packet/trace analyzer

Protocol coverage

Application-layer decoding is intentionally metadata-focused in the current implementation. The always-on fold recovers only bounded initial TLS/HTTP/DNS metadata; an explicit Follow Stream action can rescan a stable saved or stopped source without turning the capture path into an unbounded stream store.

Layer	Coverage	Important limits
Link / network	Ethernet II, BSD loopback/null, raw/tunnel IP, ARP, IPv4 options, IPv6 extension headers, ICMP/ICMPv6	Partial decode is returned for malformed or truncated input
Transport	TCP flags/options, lifecycle and bounded sequence evidence; UDP endpoints	No general always-on TCP stream/record analyzer
DNS	Questions, compression pointers, and common answer records including A, AAAA, CNAME, MX, TXT, SRV, and SOA	No DNSSEC analysis
TLS	Record and handshake metadata, offered/chosen versions, cipher information, SNI, and ALPN	No decryption, certificates, or application data
HTTP/1	Request-line recognition and the Host header	No full headers, response parsing, bodies, chunking, or decompression
QUIC	Long-header identification on UDP/443	No frame or payload decode

See the source-grounded protocol matrix for exact field coverage.

Current boundaries

These are deliberate statements of present capability, not hidden roadmap promises:

• No TLS or QUIC decryption.
• No general always-on TCP reassembly or typed record-analyzer framework; connection evidence and explicit bounded Follow Stream are narrower mechanisms.
• No deep HTTP/2, HTTP/3, or WebSocket decoder.
• History persists terminal capture/session summaries, not a raw-packet capture database.
• Findings are selected evidence-linked local observations, not a comprehensive durable security engine.
• A transport-neutral read-only History automation core exists, but there is no CLI target, MCP server, listener, provider, or AI data path.
• Protected .tracexysession export enforces payload/metadata protections; raw pcap/pcapng stays byte-preserving. Automatic retention cleanup is not implemented.

Privacy and security

Network captures can contain credentials, private hostnames, personal messages, and application payloads. Tracexy treats them as sensitive by default.

• Captured traffic and derived sessions remain local; Tracexy does not upload capture payloads.
• Live capture starts when the user presses Start. If the user explicitly enables Auto-start capture on launch, that preference starts capture when the app opens.
• Opening .pcap or .pcapng files does not require the privileged helper or administrator access.
• Raw pcap/pcapng export preserves captured bytes and requires acknowledgement while protections are enabled. Protected .tracexysession export omits raw frames and sensitive decoded metadata according to the selected Privacy settings.
• Live capture crosses a narrow, typed XPC boundary with code-signing checks around the privileged helper.
• Signed update checks are separate from capture data and never include captured traffic.

Read Privacy & security for the full trust model. Report vulnerabilities privately through SECURITY.md, not a public issue.

Quick start

Requirements

• macOS 14 or later
• Xcode 16 or later
• An Apple Developer Team for code-signing the app and helper

SwiftLint and SwiftFormat are optional for building, but required for contribution checks.

Get the source

git clone https://github.com/RockxyApp/Tracexy.git
cd Tracexy
cp Configuration/Developer.xcconfig.template Configuration/Developer.xcconfig
open Tracexy.xcodeproj

Set your own Team ID in Configuration/Developer.xcconfig:

TRACEXY_TEAM_ID = YOUR_TEAM_ID_HERE
CODE_SIGN_IDENTITY = Apple Development
DEVELOPMENT_TEAM = $(TRACEXY_TEAM_ID)

Developer.xcconfig is gitignored. Never commit your signing identity, certificates, provisioning profiles, packet captures, or exported sessions.

Opening a saved capture is the quickest zero-helper path through the decode and session pipeline. Live capture additionally requires one-time approval for the privileged helper in System Settings.

Build and validate

# Build
xcodebuild -project Tracexy.xcodeproj -scheme Tracexy -destination 'platform=macOS' build

# Full app and UI test suite
xcodebuild -project Tracexy.xcodeproj -scheme Tracexy -destination 'platform=macOS' test

# Non-mutating style checks
swiftformat --lint .
swiftlint lint --strict

Changes to TracexyCaptureHelper/ or the shared XPC protocol require uninstalling, rebuilding, and reinstalling the helper; rebuilding the app alone does not hot-reload the privileged service.

Detailed setup and troubleshooting live in Getting started.

Architecture

Capture  →  Protocol  →  Session  →  Workspace

Layer	Source	Responsibility
Capture	Tracexy/Core/Capture, TracexyCaptureHelper	Live acquisition, capture-file IO, interface discovery, and capture statistics
Protocol	Tracexy/Core/Protocol	Bounds-checked packet access and stateless per-frame decoding
Session	Tracexy/Core/Session	Canonical conversation grouping, summaries, and activity correlation
Workspace	Tracexy/Models, Tracexy/ViewModels, Tracexy/Views	App policy, workspace state, orchestration, and native presentation

The privileged helper exposes typed capture operations rather than arbitrary shell or file access. Capture files and packet bytes are untrusted input: decoders return partial results or controlled errors instead of reading beyond available data.

See Architecture for the repository map, current seams, and known transitional debt.

Documentation

Guide	Contents
Documentation index	Current implementation status and navigation
Getting started	Build, signing, helper approval, and validation
Usage	Capture, sessions, correlation, filtering, and inspectors
Architecture	Data flow, module boundaries, and repository map
Protocol support	Exact decode coverage and limitations
Privacy & security	Local-first posture and privileged trust boundary
Competitor comparison	Source-backed positioning against packet-analysis alternatives
Changelog	Unreleased work and future tagged releases

Contributing

Bug reports, tests, documentation fixes, protocol fixtures, and focused pull requests are welcome. Please read CONTRIBUTING.md before submitting a change.

For decoder work, include normal, truncated, and malformed-input coverage. Captures attached to an issue must be reviewed and redacted first.

Licensing

Tracexy source

The source in this repository is licensed under the GNU Affero General Public License, version 3 or later (AGPL-3.0-or-later). AGPL is a strong copyleft license: you may run, study, modify, and redistribute Tracexy, including commercially, as long as you follow its conditions.

In practical terms, redistributed modified versions must keep the license and required notices, identify meaningful changes, and provide the corresponding source under AGPL terms. If a modified version offers network interaction, AGPL section 13 also requires users who interact with it over the network to be offered access to the corresponding source. The full legal terms, including the no-warranty provisions, are in LICENSE.

A build made solely from this repository is therefore an AGPL build. AGPL does not grant rights to the Tracexy name, logo, or other trademarks.

Commercial licensing and official binaries

Rockxy LLC may offer Tracexy, official binaries, support, enterprise rights, hosted services, private distribution rights, or downstream distributions under separate commercial terms. See the Commercial Licensing Policy and the draft Binary EULA.

A commercial license applies only when Rockxy LLC grants it in writing or when an official distribution presents the applicable agreement. Owning or using a commercially licensed copy does not cancel the AGPL rights you have for a separate copy of the public source edition.

External contributions are accepted under the Tracexy Individual Contributor License Agreement so accepted changes can remain available in the public AGPL edition and also be used in separately licensed Tracexy distributions. Organization-owned contributions require the Corporate Contributor License Agreement.

AGPL does not grant rights to use the Tracexy or Rockxy LLC names, logos, icons, domains, trade dress, or other trademarks to identify a modified or redistributed product, except for truthful nominative reference permitted by law.

Third-party and platform components

Tracexy may link to third-party libraries and Apple system components, including the Sparkle update framework. Those components are not relicensed by this repository and remain subject to their own license terms and notices. Before distributing a build, review the licenses bundled by Xcode and the dependency metadata in Package.resolved.