Tracexy

Tracexy

A native, session-first Wireshark alternative for macOS.

Native macOS network intelligence, organized around sessions—not packet noise. Capture live traffic or open a saved capture, then investigate hosts, processes, protocols, timing, and raw packet evidence in one local-first workspace.

The AGPL-licensed public source edition of Tracexy for macOS.

Latest Tagged Release

v0.9.1 — 2026-10-08

Fixed

• When live capture has no sessions, show guidance for specialized Wi-Fi interfaces and active capture filters.

See [CHANGELOG.md](CHANGELOG.md) for the full release history.

Tracexy is an open-source network intelligence app built specifically for macOS. It captures traffic passively and turns frames into explainable sessions and correlated activities: which process contacted which host, which protocols appeared, how much data moved, and what evidence supports the grouping.

The main experience is session-first. Raw protocol fields and hex remain one click away when the bytes are the answer, but they do not dominate the workspace.

This repository contains Tracexy's public source edition under [AGPL-3.0-or-later](LICENSE). Builds made solely from this repository are AGPL builds. Rockxy LLC may also offer official binaries, support, enterprise rights, hosted services, or downstream distributions under separate commercial terms. Those terms apply only to the copy, service, or distribution that presents them; they do not remove the AGPL rights granted for this public source edition. Third-party components remain under their own licenses; see [Licensing](#licensing) below.

Part of the Rockxy Ecosystem

Tracexy is part of the Rockxy ecosystem (opens in a new tab), a family of native, local-first tools for understanding and controlling software and network behavior. The products have distinct jobs and separate repositories, while sharing a focus on transparent evidence, explicit data boundaries, and native platform experiences:

• [Rockxy](https://github.com/RockxyApp/Rockxy) — intercept, inspect, and modify HTTP, HTTPS,

WebSocket, GraphQL, and other application traffic.

• Tracexy — passively capture network traffic and organize it into explainable sessions,

protocol observations, and evidence-linked investigation workflows.

• [Shieldxy](https://github.com/RockxyApp/Shieldxy) — application-aware network security,

connection control, and policy-oriented visibility.

Tracexy complements the ecosystem rather than replacing any one tool: the application-level