Four standalone HTML files. Double-click, drop a file in, read it.

No server. No build step. No dependencies to install. Nothing ever leaves the machine.

The Viewers

File	Opens	Highlights
pcap-viewer.html	.pcap .pcapng .cap .gz	Full 802.11 and TCP/IP dissection, hex pane, filter language
MD-Viewer.html	.md .markdown	Rendered Markdown, self-contained parser, fully offline
MD-Viewer1.html	.md .markdown	Same job via marked + highlight.js from CDN, needs internet
CSV-Viewer.html	.csv .tsv	Sortable, searchable table view

PCAP Viewer

A real packet analyzer in one file. Packet list on top, expandable protocol tree bottom-left, hex dump bottom-right. Click any field in the tree and its bytes light up in the hex.

Capture formats — classic pcap in either endianness, microsecond or nanosecond, plus pcapng with multiple interface blocks. Gzipped captures are decompressed in the browser.

Link layers — Ethernet, IEEE 802.11 raw, Radiotap, Prism, AVS, Linux cooked v1 and v2, raw IPv4 and IPv6, Null/Loopback.

Wireless dissection — management, control, and data frames with correct address mapping for every toDS/fromDS combination. Tagged parameters are parsed out: SSID, channel, supported rates, country, HT/VHT/HE capability. RSN and WPA elements are decoded down to their AKM and cipher suites, so networks are labeled WPA3 SAE, WPA2 PSK CCMP-128, WEP, or Open rather than just "protected". CCMP, TKIP, and WEP payloads are identified from the IV. EAPOL frames are matched to their handshake position, message 1 through 4.

Wired dissection — IPv4, IPv6, TCP with flag breakdown, UDP, ARP, ICMP and ICMPv6, DNS, mDNS, LLMNR, DHCP, NTP, SSDP, TLS record types, and HTTP request lines.

Tabs

Tab	What it shows
Packets	The list, detail tree, and hex
Wireless	Access point inventory, probe requests per station, EAPOL frames, busiest radios
Endpoints	Endpoint and conversation totals with traffic bars
Summary	Capture metadata, protocol distribution, frame classes, channel spread

Filter language — type into the bar, terms combine with spaces, prefix any term with ! to negate.

beacon                    frame-class keywords: beacon, probe, probereq, proberesp,
                          mgmt, ctrl, data, deauth, auth, assoc, eapol, enc,
                          retry, hidden, bad

ssid:office               field filters: ssid, mac, src, dst, bssid,
mac:aa:bb:cc              ch, proto, port, len
ch:6
port:443

deauth !retry             negate with !
proto:tcp port:443        combine freely

Anything else is matched as plain text against the whole row and highlighted in the results.

Keys — arrows or j/k to step through packets, PageUp/PageDown, Home/End, / to jump to the filter, Esc to clear it.

Also does MAC vendor lookup with randomized-MAC detection, CSV export of the filtered view, a light and dark theme, and a draggable splitter between the list and the detail panes.

MD Viewer

Drop a .md file and read it rendered instead of raw. Code blocks get syntax highlighting and the theme follows light or dark.

There are two builds of this one, and which you want depends on whether the machine has internet.

	MD-Viewer.html	MD-Viewer1.html
Markdown parser	written in the file	marked from jsDelivr
Syntax highlighting	written in the file	highlight.js from cdnjs
Needs internet	no	yes
Renders air-gapped	yes	no, falls back to raw text

MD-Viewer.html is the one to reach for. It carries its own renderer and highlighter, so it works on an air-gapped box, on a plane, or anywhere the CDN is blocked — same as the PCAP and CSV viewers.

MD-Viewer1.html is kept because the CDN libraries cover a few more Markdown edge cases and a longer tail of languages in code fences. On a machine with internet it renders a little closer to GitHub.

CSV Viewer

Drop a .csv and get a real table — sortable columns and a search box — instead of squinting at commas in a text editor.

Use

1.  Clone or download this repo
2.  Double-click the viewer you want
3.  Drag a file onto the page, or click to browse

That is the whole setup. They are ordinary HTML files that open straight off the disk over file://.

Everything is parsed locally in the page using FileReader. There is no fetch, no XHR, no upload, and no telemetry — captures and spreadsheets never leave the machine, which is the point when the file is a packet capture.

That holds for every viewer here. The one and only network request any of them makes is MD-Viewer1.html pulling its two libraries from a CDN at load — and even there the Markdown file itself is still read locally and never sent anywhere. Use MD-Viewer.html instead if the machine is air-gapped or the request is unwelcome.

Keep them handy

Pin the folder to Quick Access, or drop shortcuts on the Desktop. Once a viewer is set as the default program for its extension, double-clicking a .pcap or .csv opens it straight into the right tool.