Free Packet Capture Tools Compared: Which to Use
Este conteúdo não está disponível em sua língua ainda.
The common free packet capture tools are Wireshark, Fiddler Classic, mitmproxy, ProxyPin, Reqable’s Community edition and Trace Eagle; Charles and Fiddler Everywhere are paid, with trials. Pick by three questions: do you need HTTP(S) only or any protocol, can it decrypt HTTPS (including apps with certificate pinning), and does it support your computer and your phone? For web pages and ordinary APIs, any proxy-based tool is enough. For apps that ignore the proxy, SSL pinning or HTTP/3, you need NIC capture with automatic decryption, or plaintext read from inside the app.
Which packet capture tools are free?
Section titled “Which packet capture tools are free?”| Tool | Pricing | Desktop platforms | Capture method | How HTTPS is decrypted |
|---|---|---|---|---|
| Wireshark | Free, open source | Windows, macOS, Linux | NIC capture, any protocol | You export TLS keys (SSLKEYLOGFILE) and load them |
| Fiddler Classic | Free | Windows only | Proxy | Root certificate, man-in-the-middle |
| Fiddler Everywhere | Subscription, with trial | Windows, macOS, Linux | Proxy | Root certificate, man-in-the-middle |
| Charles | One-time license; 30-day trial, 30 minutes per session | Windows, macOS, Linux | Proxy | Root certificate, man-in-the-middle |
| mitmproxy | Free, open source | Windows, macOS, Linux | Proxy (CLI and web UI) | Root certificate, man-in-the-middle |
| ProxyPin | Free, open source | Windows, macOS, Linux, plus iOS / Android apps | Proxy | Root certificate, man-in-the-middle |
| Reqable | Community edition free (3 rewrite, script and breakpoint rules each); paid Professional | Windows, macOS, Linux, plus mobile apps | Proxy | Root certificate, man-in-the-middle |
| Trace Eagle | Free, every feature | Windows, macOS, Linux; iOS and Android through the connected computer | 6 methods: proxy, NIC, per-process, app-layer, system-level and more | Session keys matched automatically, decrypted on capture, including HTTP/3 and pinned apps |
Compiled in October 2026; check each vendor for current prices and versions: Wireshark, Fiddler, Charles, mitmproxy, ProxyPin, Reqable.
What’s the difference between proxy and NIC capture tools?
Section titled “What’s the difference between proxy and NIC capture tools?”Proxy tools (Fiddler, Charles, mitmproxy, ProxyPin, Reqable) set themselves as the system or phone proxy and record traffic that passes through. Once you install their root certificate, they swap certificates in the middle and decrypt HTTPS. They are quick to start and good at rewriting and replay, but they only see traffic that agrees to use the proxy.
NIC tools (Wireshark, tcpdump) record every packet on the network interface: DNS, QUIC and any TCP/UDP, regardless of proxy settings. The catch is that HTTPS arrives as ciphertext, and decrypting it needs the TLS session keys.
Trace Eagle puts both into one tool, lands all traffic in one list and matches session keys automatically; see decrypt HTTPS.
When can’t an ordinary proxy tool capture traffic?
Section titled “When can’t an ordinary proxy tool capture traffic?”- Apps that ignore the system proxy: WeChat mini-programs, Flutter apps and similar connect directly, so the proxy sees nothing. Use NIC capture; see capture WeChat mini-programs.
- Apps with SSL pinning: they trust only a built-in certificate and fail as soon as the proxy swaps it. Read plaintext from inside the app, or bypass SSL pinning first.
- Android 7 and later: apps don’t trust user-installed certificates by default, so the proxy certificate does nothing; see Android capture.
- HTTP/3 (QUIC): it runs over UDP, so a plain HTTP proxy can only force a downgrade and never sees real H3 traffic.
- Private binary protocols: you get raw bytes that need framing to make sense; see custom protocol decoding.
Which tool should you pick for your scenario?
Section titled “Which tool should you pick for your scenario?”| Your scenario | Free option that’s enough |
|---|---|
| Web pages and ordinary app APIs, occasional rewriting | Any proxy tool: Fiddler Classic (Windows), mitmproxy, ProxyPin, Reqable Community, Trace Eagle |
| Low-level protocols, DNS, TCP handshakes | Wireshark, or Trace Eagle’s NIC capture |
| WeChat mini-programs, Flutter and other proxy-blind apps | NIC capture plus decryption: Trace Eagle |
| SSL pinning, recent Android, HTTP/3 | Trace Eagle (app-layer plaintext, unpinning, true H3 decryption) |
| iPhone capture without a jailbreak | Trace Eagle; see capture iOS traffic |
| Letting an AI agent drive the capture | Trace Eagle’s built-in MCP server; see AI · MCP |
Is there a completely free Charles alternative?
Section titled “Is there a completely free Charles alternative?”Yes. Fiddler Classic (Windows only), mitmproxy, ProxyPin and Trace Eagle are free. Trace Eagle is free with every feature on Windows, macOS and Linux, and adds NIC capture, app-layer plaintext and HTTP/3 decryption on top of proxy capture.
Can Wireshark show HTTPS in plaintext?
Section titled “Can Wireshark show HTTPS in plaintext?”Not by itself. Wireshark captures HTTPS as ciphertext; the program has to write its TLS session keys to an SSLKEYLOGFILE that you then load into Wireshark (see Wireshark’s TLS page). Trace Eagle’s NIC capture matches keys automatically and can forward the decrypted traffic to Wireshark live.
What free tool can capture phone traffic?
Section titled “What free tool can capture phone traffic?”Any desktop proxy tool works for iPhone and Android if you point the phone’s Wi‑Fi proxy at the computer and install the root certificate. When the app pins certificates, or Android 7+ ignores user certificates, the proxy can’t decrypt; Trace Eagle then captures over a cable through the computer, with no jailbreak on iOS.
Are free packet capture tools safe?
Section titled “Are free packet capture tools safe?”Tools downloaded from the official site or repository are safe in themselves. The thing to watch is the root certificate you install: it can decrypt that device’s HTTPS, so remove it in the system certificate settings when you’re done, and never install one from an unknown source.
Related: What is packet capture? · Getting started · Download Trace Eagle