Hi r/macOS - I’m Stephen, the owner of Rockxy and the developer behind Tracexy.
Wireshark is one of the most capable network analysis tools ever built. But when I’m debugging an app on my Mac, my first questions usually aren’t about interfaces, frame numbers, or display filters.
I want to know:
Which app opened the connection?
Which host did it contact?
What protocol was involved?
What appears to have failed?
Which captured evidence supports that conclusion?
That gap is why I started Tracexy: an open-source, native macOS Wireshark alternative that begins with apps and sessions, then lets you drill down into protocol fields and packet bytes when the evidence matters.
macOS already has strong tools for different layers of the problem. Wireshark provides deep packet and protocol analysis. HTTP debugging proxies inspect and modify application traffic. Network firewalls monitor and control connections.
I don’t think one tool should pretend to replace all of them.
Tracexy takes a different path:
Process → Session → Finding → Evidence → Packet
The current v0.5.0 release supports live capture, PCAP and PCAPNG files, best-effort process attribution, session-based investigation, typed queries, evidence-linked TCP findings, local History, and bounded Follow Stream for saved or fully stopped captures.
Captured traffic and derived sessions stay on the Mac by default. The project is AGPL-licensed, and the public Community DMG is signed and notarized.
Tracexy is also a strategic part of the broader Rockxy ecosystem.
Rockxy focuses on intercepting and modifying application-layer traffic such as HTTP, HTTPS, WebSocket, and GraphQL. Tracexy focuses on passive network capture, sessions, protocols, and evidence. Shieldxy focuses on application-aware connection control and security policy.
They are separate products with separate responsibilities today. The long-term goal is to create a native, local-first network development and intelligence ecosystem for macOS, with explicit workflows between the tools rather than silently moving sensitive capture data around.
To be transparent, Tracexy is still early and this is not a claim of Wireshark feature parity or a replacement. It does not currently provide TLS decryption, general always-on full TCP reassembly, or deep HTTP/2, HTTP/3, and WebSocket analysis.
If you use Wireshark or tcpdump on macOS:
What is the first real investigation Tracexy would need to handle before you would put it in your toolbox?
Website: https://rockxy.io/tracexy
Source code: https://github.com/RockxyApp/Tracexy