All notable changes to Tracexy will be documented in this file.
The format is based on Keep a Changelog.
- When live capture has no sessions, show guidance for specialized Wi-Fi interfaces and active capture filters.
- Open several named workspace tabs in one Project. Each keeps its own scope, filters, grouping and panels, and the Project restores them on reopen.
- Investigate sessions with richer expressions, reusable filter buttons and macros, imported display filters, address names, session tags and evidence-linked notes.
- Browse every retained frame, search its text or bytes, inspect decoded fields and packet bytes, validate checksums, add frame comments, and jump between a finding, session and cited frame.
- Follow TCP and UDP conversations with frame citations and visible capture gaps. Read HTTP/1 exchanges, cleartext HTTP/2 including h2c upgrades, and WebSocket messages; save supported streams and HTTP response bodies.
- See response-time measurements, TCP health charts, traffic and field plots, a session ladder, and a flow graph drawn from captured frames.
- Use new Statistics views for conversations, endpoints, protocol hierarchy, DNS, HTTP, IP, packet lengths, service response times, SIP calls and RTP streams, with scoped export where available.
- Find evidence-linked TCP, DNS, TLS and ICMP problems, including unanswered handshakes, flow-control issues and cleartext credentials, with explicit unknown states when evidence is incomplete.
- Decode fragmented IPv4 and IPv6 datagrams, GRE and VXLAN tunnels, and more local, enterprise and media protocols including mDNS, DHCP, NTP, SIP/RTP, SMB, LDAP, Kerberos and TFTP.
- Add a local MaxMind-format GeoIP database to a Project for optional endpoint and session location context; private and special addresses are not looked up.
- Manage capture interfaces, validate and save BPF filters, choose per-interface optimization, stop automatically by time or packet count, and rotate long live captures into bounded files.
- Merge or split capture files, open LZ4-compressed captures and named-pipe input, inspect file structure, and export selected frames with optional address masking, notes and comments.
- Export bounded HTTP, SMB, email, FTP and certificate objects, packet dissections and application PDUs from captured evidence.
- Use the command line to inspect captures, sessions, frames, statistics and supported objects, and let an explicitly granted read-only MCP client list findings from History.
- Use the native interface in Vietnamese.
- RTP Stream Analysis handles out-of-range timestamps without crashing, computes off the main thread, and keeps both directions on one graph time axis.
- SMB Export Objects finds files across real share and handle lifecycles. Save All continues past individual failures and gives colliding file names unique destinations.
- Switching Projects refreshes capture-backed report windows, and early-opened Endpoints and Inspector views load their location context.
- Large Project catalogs and captures no longer stall routine saves or investigation views; over-limit saved data stays readable and editable while new additions remain gated.
- Project imports, tab actions, filter buttons and macros enforce capacity at the final write and preserve stored values this version cannot read.
- Cleartext HTTP/2 and WebSocket filters match their sessions; HTTP/1 requests with binary bodies and HTTP/2 prefaces sharing a segment remain readable.
- Auxiliary window controls, narrow inspector layouts, session selection and cited-frame navigation remain usable across window and accessibility transitions.
- PCAPNG TLS key-log blocks and equal-count statistics rows display correctly.
- Export Objects and Export PDUs scan many connections in grouped passes, reducing repeated reads of large captures.
- Quitting during live capture now stops capture cleanly and retains session History; captured packets still require an explicit save.
- Session, finding, inspector and status text uses clearer plain-language descriptions and keeps unknown or missing evidence explicit.
- Preserve approved helper updates
- Restore idle exit timer delivery
- Ask about a selected session with the local Assistant, review the exact data before sending, and open cited frames in the evidence inspector.
- Grant an MCP client bounded, read-only capture history for one Project, and revoke access in Settings.
- Explore capture activity, protocols, sessions, findings, hosts and apps from the Overview.
- Open captures in place from File, Finder or drag and drop; preview them before opening, keep recent files, and locate or reload moved and changed references. Import into Library remains available when a managed copy is wanted.
- Inspect capture format, time span, interfaces and recorded metadata in File → Get Info; browse the exact frames of a session in the bottom inspector.
- Export whole captures or selected frames, sessions and time ranges as PCAPNG or compatible PCAP, with optional gzip compression.
- Preview PCAP and PCAPNG files in Quick Look and find them with Spotlight.
- Browse rotated capture file sets, decode VLAN-tagged traffic, and sort the Sessions table by column.
- Keep Assistant review and disclosure in sync, reject stale approval, and label incomplete answers clearly.
- Enable MCP access once the active Project finishes loading, even if Settings was opened first.
- Keep local capture paths out of default Library, recovery and Get Info text; Reveal and Copy Path remain explicit actions.
- Avoid a bottom-inspector layout crash and unwanted extra windows after relaunch.
- Correct false TCP retransmission findings from packet padding, fragments and keep-alive probes; retain reset evidence when it follows an orderly close.
- Open classic PCAP files that declare an FCS hint, and calculate DNS response time even when the answer contains no records.
- Stop live capture with a clear reason when its source disappears, and ask before quitting during capture.
- Improve VoiceOver navigation, honor byte-unit and workspace-restoration settings, and stream large exports without loading the entire capture into memory.
- Replace placeholder MCP and Assistant settings with scoped access and local connection controls.
- Overview Protocols shows session-byte share by innermost protocol so its bars sum to the scope.
- Orient sessions captured mid-stream toward the service port when no connection start was captured.
- Organize investigations into isolated Projects, each with its own workspaces, saved captures, History, and capture and privacy settings.
- Import PCAP and PCAPNG captures into a chosen Project, including gzip-compressed files, TCP Viewer session archives, and Linux cooked captures.
- Query whole sessions with bounded Session Expressions, return from host, client, IP, or Findings drill-downs with filters intact, and import named BPF capture filters.
- Export and import configuration-only
.tracexyprojectfiles without packets, payloads, capture paths, findings, or History.
- Keep Project transitions safe by waiting for accepted capture and save work, preserving the current investigation when a transition cannot complete.
- Reorganize the native toolbar so Project selection, capture source, and Start/Stop controls remain distinct and easier to follow.
- Navigate retained connection and TLS evidence to the exact cited local frame.
- Open the selected session in an auxiliary Inspector window that follows the workspace selection.
- Enforce the selected automatic History retention at launch, after a capture is stored, and when the setting changes.
- Remove duplicated workspace chrome and correct session-control and footer alignment.
- Refine session controls, status, and inspector layout for a clearer native Liquid Glass workspace.
- Add local History for completed live and saved captures, with bounded session summaries stored without packet payloads.
- Add typed Investigation queries, evidence-linked findings, and bounded Follow Stream for stopped or saved TCP captures.
- Add Capture Readiness details for the active interface, capture settings, buffering, and observed frame loss.
- Stream large saved captures off the main UI path and keep complete live-capture session summaries through disk-backed spooling.
- Refresh the native workspace and Settings with adaptive macOS materials, accessible opaque data surfaces, and responsive window chrome.
- Expand Protocols, Apps, and Domains when the first decoded session arrives while respecting later manual collapse.
- Continue to the save panel after the user explicitly confirms an unprotected raw pcap/pcapng export.
- Protect native session exports with Privacy settings, omitting raw packet bytes and sensitive decoded metadata by default; raw pcap/pcapng exports now require explicit confirmation while a protection is enabled.
- Strengthen privileged capture-helper authentication against process-identity races.
- Remove temporary capture files left by interrupted sessions without touching active captures or unrelated data.
- Add a capture summary dashboard with traffic activity, protocol mix, top talkers, and evidence-based findings.
- Add native session search, decoded-evidence copy actions, source management, and reversible session removal.
- Add deeper STUN, TLS-record, and QUIC long-header inspection, plus segmented TCP/DNS/TLS/HTTP recovery.
- Preserve packet timestamps, lengths, link types, and capture-loss accounting across live capture and export, with configurable snap length, promiscuous mode, and BPF filters.
- Keep sustained captures responsive with bounded disk spooling and incremental session updates.
- Add Tracexy demo captures
- Add update badge and inspector detail tables
- Add session export actions
- Harden live frame ingestion
- Refine session search and assistant dock
- Streamline security investigation
- Make force reset authorization-safe
- Recover service registration after app updates
- Stabilize live session table updates
- Harden lifecycle recovery
- Capture → protocol → session foundation: privileged capture helper, PCAP/PCAPNG IO, direct packet decoding, batch session summaries, and native UI.
- App-level capacity limits are resolved from an injected
AppPolicyat launch rather than hardcoded: workspace tabs, saved focus sets, and pinned hosts. Reaching a limit now explains itself instead of doing nothing. - Settings now uses native toolbar tabs, consistent grouped cards, semantic Light/Dark surfaces, and tighter field and status layouts across every pane.
- Sparkle 2 provides signed Community updates through the public appcast, with one app-owned updater shared by the app menu and Settings, automatic-check/download preferences backed directly by Sparkle, and local builds kept manual-only.
- Improved the description shown for unencrypted HTTP traffic.
- Helper compatibility now reads the bundled helper version, build, and protocol from the shared release version configuration instead of assuming they match the app version.