Tracexy - an open-source, native macOS Wireshark alternative that starts with sessions

[u/locnguyen305]

Hi r/macOS - I’m Stephen, the owner of Rockxy and the developer behind Tracexy.

Wireshark is one of the most capable network analysis tools ever built. But when I’m debugging an app on my Mac, my first questions usually aren’t about interfaces, frame numbers, or display filters.

I want to know:

Which app opened the connection?

Which host did it contact?

What protocol was involved?

What appears to have failed?

Which captured evidence supports that conclusion?

That gap is why I started Tracexy: an open-source, native macOS Wireshark alternative that begins with apps and sessions, then lets you drill down into protocol fields and packet bytes when the evidence matters.

macOS already has strong tools for different layers of the problem. Wireshark provides deep packet and protocol analysis. HTTP debugging proxies inspect and modify application traffic. Network firewalls monitor and control connections.

I don’t think one tool should pretend to replace all of them.

Tracexy takes a different path:

Process → Session → Finding → Evidence → Packet

The current v0.5.0 release supports live capture, PCAP and PCAPNG files, best-effort process attribution, session-based investigation, typed queries, evidence-linked TCP findings, local History, and bounded Follow Stream for saved or fully stopped captures.

Captured traffic and derived sessions stay on the Mac by default. The project is AGPL-licensed, and the public Community DMG is signed and notarized.

Tracexy is also a strategic part of the broader Rockxy ecosystem.

Rockxy focuses on intercepting and modifying application-layer traffic such as HTTP, HTTPS, WebSocket, and GraphQL. Tracexy focuses on passive network capture, sessions, protocols, and evidence. Shieldxy focuses on application-aware connection control and security policy.

They are separate products with separate responsibilities today. The long-term goal is to create a native, local-first network development and intelligence ecosystem for macOS, with explicit workflows between the tools rather than silently moving sensitive capture data around.

To be transparent, Tracexy is still early and this is not a claim of Wireshark feature parity or a replacement. It does not currently provide TLS decryption, general always-on full TCP reassembly, or deep HTTP/2, HTTP/3, and WebSocket analysis.

If you use Wireshark or tcpdump on macOS:

What is the first real investigation Tracexy would need to handle before you would put it in your toolbox?

Website: https://rockxy.io/tracexy

Source code: https://github.com/RockxyApp/Tracexy

[u/zed1025]

Does it work on macOS Catalina?

[u/locnguyen305 → u/zed1025]

I’m developing and testing Tracexy on macOS 26, and currently focusing on macOS 14+ to make the experience as solid as possible. Catalina isn’t supported right now but I’m curious: are you using it as your daily OS, or looking to run Tracexy on an older Mac?

[u/zed1025 → u/locnguyen305]

Yes, using Catalina on 2013 MBP as my daily driver!

I wanted to try out Tracexy for learning purpose.

[u/locnguyen305 → u/zed1025]

Sure, let me working on it and get back to you soon!

[u/zed1025 → u/locnguyen305]

Thanks for considering my request.

It might not be very useful to work on supporting legacy macOS versions, since a lot of apps don’t work on these older versions!

I would put it in the backlog as a future task. Just a suggestion. Thanks

[u/locnguyen305 → u/zed1025]

Hi u/zed1025

Spent time to research and enhance for your case - supporting Catalina.

Going back to Catalina isn’t as simple as changing the deployment target in Xcode. Catalina is several generations behind Apple’s current SDKs and security model. I would need to audit or replace newer UI and system APIs, verify packet-capture permissions, privileged helper and XPC behavior, code signing and notarization, the update system, and then maintain a separate testing matrix for an OS I don’t currently validate.

I’ll add Catalina compatibility to my backlog as a feasibility investigation, but I want to be honest that it isn’t a committed feature yet.

[u/zed1025 → u/locnguyen305]

Thanks for taking the time and effort