TCP Viewer

TCP Viewer is a macOS packet viewer for live captures and capture files. It uses AppKit for the main app, system libpcap for capture, and vendored Wireshark libraries for deep packet details.

Requirements

• macOS 15+
• Xcode 16+
• Git
• CMake, Ninja, Meson, pkg-config, and autotools

brew install cmake ninja meson pkg-config autoconf automake libtool

Setup

Clone with submodules and bootstrap the pinned Wireshark dependency:

git clone --recurse-submodules <repo-url>
cd TCPViewer
cp Config/TCPViewer.local.xcconfig.example Config/TCPViewer.local.xcconfig
./scripts/bootstrap-wireshark.sh

If you already cloned without submodules:

git submodule update --init --recursive
./scripts/bootstrap-wireshark.sh

scripts/bootstrap-wireshark.sh first runs scripts/bootstrap-wireshark-deps.sh, which builds Wireshark's bundled runtime libraries from source into Vendor/.install/wireshark-deps with macOS 15.0 as the deployment target. Homebrew is used only for build tools; release bundles must not copy Homebrew bottle dylibs from /opt/homebrew or /usr/local.

Keep local signing, appcast, Sparkle, Sentry, and release values out of Git. Use ignored local files such as Config/TCPViewer.local.xcconfig, .env, shell environment variables, or Keychain-backed tools.

Run

In Xcode:

1. Open TCPViewer.xcodeproj.
2. Select the TCPViewer scheme.
3. Choose My Mac.
4. Press Run.

Command-line build:

xcodebuild -project TCPViewer.xcodeproj -scheme TCPViewer build

If Xcode asks for signing, select a development team for TCPViewer and PcapPlusPlusCore.

Test

xcodebuild test \
  -project TCPViewer.xcodeproj \
  -scheme TCPViewer \
  -destination 'platform=macOS'

Deploy

TCP Viewer releases are built, notarized, signed for Sparkle, uploaded to Cloudflare R2, and optionally published to the release backend by the release script.

First-time release setup:

npm install
bundle install
gh auth login

Create a local .env from .env.example and fill in the required release values. Never commit real secrets. Keep comments in .env as # comments because sentry-cli does not accept // comments when it loads the file.

For production releases, add a matching entry to ReleaseNote.json, then run:

npm run release

Choose beta or production when prompted. Production releases also create the Sparkle appcast, push the v<version> tag, and publish the GitHub release. Artifacts are written under:

~/Desktop/tcpviewer-production/

License

TCP Viewer is licensed under GPL-2.0-or-later. This matches the app's Wireshark integration: libwireshark, libwiretap, and libwsutil are GPL-covered Wireshark libraries.

The full GPL text is in COPYING, third-party notices are in THIRD_PARTY_NOTICES.md, and binary-release source availability terms are in SOURCE_CODE_OFFER.md.

Acknowledgements

TCP Viewer builds on Wireshark for packet dissection and HexFiend for the embedded hex viewer. See THIRD_PARTY_NOTICES.md for details.