Packet Analyzer
Paste a raw packet as hexadecimal (spaces and colons are fine) and it is decoded into an expandable protocol tree (Ethernet II, IPv4, and TCP or UDP) with the key header fields. Unencrypted payload bytes can hold credentials in clear, so the analyzer is gated behind a short acknowledgement.
This is generated in browser and is not sent to pah.moi servers.
About this tool3 paragraphs
The decode runs Ethernet II with its VLAN and QinQ tags, ARP, IPv4 down to its options and fragment fields, IPv6 through the extension-header chain, ICMP and ICMPv6 by name, TCP with its options and flags, UDP, and a first look at DNS, DHCP and NTP payloads, with a checksum verdict wherever the header carries one. Clicking a field lights the exact bytes it was read from, and clicking a byte names the field that covers it; from the keyboard the same pairing is an Inspect next field control and a spoken status line rather than a cursor wandering a grid.
A .pcap or .pcapng capture can be opened as well as pasted: both byte orders, microsecond and nanosecond stamps, and a frame picker listing each frame's time, addresses, protocol and length. A structured filter builder turns rows for host, port, protocol, TCP flags and VLAN into a tcpdump BPF expression and a Wireshark display filter at the same time, showing which row produced which clause, so the two syntaxes can be compared rather than memorised.
It reads bytes and stops there. A short or malformed packet returns the layers that did decode plus a note and never a crash, which also means a partial tree describes what you supplied rather than what was on the wire. Payload above those first few application protocols is left as bytes; nothing here decrypts anything, follows a stream across frames, or reassembles a fragment. Everything is parsed in this tab and no capture is uploaded.
packet-cli from the site's source with:
cargo build --release --bin packet-cliSource and licence terms