Parse and analyze hex dumps of network packets to display Ethernet, IP, TCP/UDP headers and payload data.
Network Packet Analyzer translates a packet's hexadecimal octets into the nested fields of an Ethernet frame, its IP packet, and a TCP or UDP segment or datagram, then exposes the remaining payload bytes. It follows type, protocol, header-length, and packet-length values to determine where each layer begins and ends. The easy mistake is starting at the wrong layer: an IP-only dump has no destination MAC, source MAC, or EtherType, so interpreting its first 14 bytes as Ethernet produces a misleading decode.
A concrete input and expected output from the current implementation.
Input
00 11 22 33 44 55 66 77 88 99 aa bb 08 00 45 00 00 2e 12 34 40 00 40 11 a5 37 c0 a8 01 01 c0 a8 01 02 1f 90 23 28 00 1a 00 00 68 65 6c 6c 6f 20 70 61 63 6b 65 74 20 74 65 73 74 21
Expected output
Ethernet II: destination 00:11:22:33:44:55, source 66:77:88:99:aa:bb, EtherType 0x0800 (IPv4) IPv4: header length 20 bytes, total length 46 bytes, identification 0x1234, Don't Fragment set, TTL 64, protocol 17 (UDP), header checksum 0xa537, source 192.168.1.1, destination 192.168.1.2 UDP: source port 8080, destination port 9000, length 26 bytes, checksum 0x0000 Payload: 18 bytes, ASCII "hello packet test!"
EtherType 0x0800 selects IPv4. The IPv4 length of 46 bytes contains a 20-byte IP header and a 26-byte UDP datagram, which consists of an 8-byte UDP header and 18 payload bytes; the IPv4 header checksum recomputes to 0xa537.
The Ethernet header supplies destination and source MAC addresses followed by an EtherType. In the untagged sample, it occupies 14 bytes, and EtherType 0x0800 identifies IPv4. In the IPv4 header, the low nibble of the first byte is the IHL in 32-bit words; 5 means 20 bytes. These declarations, not pasted line breaks, establish field boundaries.
For IPv4, protocol number 6 selects TCP and 17 selects UDP. A UDP header is 8 bytes and includes its datagram length. A TCP header uses its data-offset field because options can make it longer than 20 bytes. After the transport header, bytes remaining within the declared packet lengths constitute the transport payload.
Not reliably from Ethernet, IP, TCP, or UDP headers alone. Port 53 may suggest DNS and port 443 may suggest TLS, but applications can use nonstandard ports or arbitrary payloads. Use the result to locate the transport payload and verify its boundaries; identifying the application requires enough payload data and the rules of that protocol.
In an IPv4 UDP packet, 0x0000 means the sender did not generate a UDP checksum. Validating a nonzero TCP or UDP checksum also requires the IP addresses, protocol, and transport length because the calculation includes an IP pseudo-header. Capture truncation or checksum offload can make captured checksum values appear inconsistent with the supplied bytes.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Format, validate, and beautify JSON with syntax highlighting and error detection.
Encode text or files to Base64 and decode Base64 strings back to their original form.
Format and indent SQL queries for better readability across all major dialects.
Convert HTML markup into clean Markdown syntax with support for tables and lists.
Write Markdown and see the rendered HTML output in real time with live preview.
Visualize unified diffs and patch files with color-coded additions and deletions.