Kestrel LITE

Kestrel Lite is a network packet analyzer for iPhone and iPad — open a PCAP or PCAPNG file, see what's inside, and triage it from your phone or tablet.

CORE FEATURES

Dashboard with tappable widgets — jump from any metric to the relevant tab
Packets list with hex+ASCII inspector and filter syntax (port, host, protocol, length)
TCP stream reassembly with full payload view (captures under 1 GB)
Flow records with bidirectional byte/packet counts
Host inventory with hostname resolution from DNS observed in the capture
DNS queries with full A/AAAA/CNAME/MX/TXT response data
Protocol classification: TCP, UDP, ICMP, HTTP, HTTPS, DNS, SSH, FTP, SMTP, TLS, ARP, SMB, mDNS, DHCP, NTP, SNMP, SSDP, QUIC
Timeline view of capture activity
Chain-of-custody log with SHA-256 file integrity hash

PRIVACY GUARANTEE

100% offline — no network access
100% on-device — your captures never leave your device
No account required, no sign-in
Free with no ads

IDEAL FOR

Network engineers triaging captures on the go
Security analysts doing first-pass review
Students learning packet analysis and networking
Anyone curious about what's actually in their PCAP files

LIMITATIONS

PCAP files are processed up to 50,000 packets per capture
Raw payload search is not included
TCP reassembly disables automatically above 1 GB to protect device memory

Upgrade to Kestrel Sight to get:

Unlimited packet capacity — no 50,000-packet cap
Analyst Bookmarks — flag any packet, flow, host, DNS query, or stream with a note. Bookmarks are included in the PDF export
Enhanced IPv6 support — addresses displayed in canonical RFC 5952 form, search matches any textual representation of the same address
Refined PDF reports — human-readable durations, complete Top Talkers, paginated bookmarks
Refined CSV exports

SUPPORT

Questions, issues, or feature requests? Email support@tracivex.com — we read every message and use your feedback to guide development.