theviewer 0.3.0

A packet viewer, reference notes on about 260 formats and protocols, a data API with a command line and an MCP server, and a history of every step that you can save as a recipe and run on other files. The README is now short, with a user guide for the detail.

Highlights

Layouts: a Layout menu with recommended layouts for each kind of work (Overview, Network capture, File structure, Firmware, Signals, Forensics, Compare, Focus), layouts you save yourself, and Last session. The status bar suggests one for each kind of file.

Packet viewer: a Packets tab for pcap, pcapng, snoop, Network Monitor and ERF captures found anywhere in a file. It has dissectors from Ethernet, 802.11 and IP through DNS, HTTP, SNMP, DHCP, SMB, S7comm, Modbus, MQTT, RTP and TLS records. You can also:

• filter by Wireshark field names;
• see conversations and endpoints, and follow a stream;
• export as pcap;
• edit packets in place;
• split any range into frames, with Decode frames as detecting the protocol;
• optionally decode with tshark.

Reference notes: the protocol or format at the cursor is explained, with its field layout drawn out and the cited RFC section fetched on demand. You can add your own notes in TOML.

Data API: about 170 methods for reading, viewing, editing and analysing data, with JSON schemas. You can reach it from:

• the command line: theviewer api;
• Lua plugins: theviewer.api, plus subscribe, publish and register_method;
• MCP: theviewer mcp, a stdio server for Claude and other clients.

Each client gets its own permission setting (Allow, Ask or Deny). See docs/api.md and docs/mcp.md.

History and recipes: a History tab records every step, from you, plugins, Ask or MCP. You can undo across steps, go back to any step, or play the history back. Save the steps as a recipe and run it on other files with theviewer replay (docs/recipes.md).

And more: column and multi-range selections, a shared Selection menu, numeric heatmaps, Morton curves, and new Structure map, Trigrams, Size map, Characterise and Learn tools. Signature scans are much faster.

Fixes

DNS, HTTP and IP fragment decoding, OS/2 bitmap headers, nudging ranges that touch each other, overflow checks on padding and field offsets, all-or-nothing undo, and no panic when output is piped into head.

The full list is in CHANGELOG.md.

Install (macOS, Apple silicon)

tar -xzf theviewer-0.3.0-macos-arm64.tar.gz
xattr -d com.apple.quarantine theviewer-0.3.0-macos-arm64/theviewer   # the binary is not signed
./theviewer-0.3.0-macos-arm64/theviewer path/to/file.bin

On other platforms, build from source with cargo build --release.