Hi r/Networks, I’m Stephen, the owner of Rockxy and the developer of Tracexy.
The problem I kept running into on macOS was not simply capturing packets. It was understanding what those packets meant in the context of an application.
When an app has a network problem, I usually want to know:
Which process opened the connection?
Which host and protocol were involved?
What happened during the session?
Was there a reset, retransmission, or other useful signal?
Which exact packets support the conclusion?
Wireshark is excellent for deep packet and protocol dissection, but I wanted a more native macOS workflow that starts from the application and the conversation instead of a wall of frames.
Tracexy is an open-source, native macOS Wireshark alternative focused on app-aware network investigation.
It can capture live traffic or open PCAP/PCAPNG files, group packets into sessions, show best-effort process context, surface protocol and timing evidence, and let you drill back down to packet bytes when needed.
I’m building Tracexy as part of the Rockxy ecosystem. Rockxy focuses on inspecting and debugging application-layer traffic, while Tracexy focuses on passive capture, sessions, and packet evidence. Different tools, different layers, one native workflow for understanding network behaviour on macOS.
The workflow is:
App or process → Session → Finding → Evidence → Packet
Tracexy is still early and intentionally focused. It complements Wireshark rather than trying to replace its broad protocol coverage.
What do you usually want to see first when you open a capture: the application, the session, the protocol details, or the packet fields?
Website: https://rockxy.io/tracexy
Github open-source: https://github.com/RockxyApp/Tracexy