Packet Decoder
Inspect Ethernet, VLAN and IP packet headers from hexadecimal bytes, with explicit start-layer selection and bounded fragment handling.
About this tool
Paste one Ethernet II frame or IPv4/IPv6 packet in hex, with spaces, colons, commas or hyphens, then Decode. Offsets are zero-based byte positions in the pasted data. Example restores a 74-byte Ethernet/IPv4 TCP SYN from 192.168.0.104:1024 to 192.168.0.1:80. Editing removes the old result; no packet is sent or uploaded.
Auto prefers a recognized Ethernet EtherType, then an IP version nibble, then an unrecognized Ethernet II type. Raw IP bytes and MAC addresses can be ambiguous: choose Ethernet II, IPv4 or IPv6 explicitly when needed. Supply packet bytes only, without hexdump offsets, ASCII columns, pcap container headers or 0x prefixes.
The decoder respects captured buffers and declared IP/UDP/header lengths. It separates trailing padding/extra bytes and distinguishes invalid lengths from truncated captures. IPv4 fragment offset is in bytes; More fragments is 0 or 1. Any fragmented payload stays raw without reassembly. IPv6 extension headers stay raw; only direct TCP/UDP and the four common ICMP/ICMPv6 header bytes are interpreted. DNS over UDP port 53 displays its 12-byte header, with names and records left raw.
Limits: 65,536 captured bytes, 400,000 text characters and 16 VLAN tags. Raw fields remain available in locally scrollable regions. No checksum validation, TCP stream assembly, DNS-over-TCP, ARP/802.3 LLC, IPv6 jumbograms, full DNS records or traffic capture. Displayed checksums are stored values, not correctness verdicts. Related: Subnet / CIDR. Header conventions: RFC 791, RFC 8200 and RFC 768.
Click a layer’s byte range to select its exact bytes in the original input, including your separators. Inputs, decoded results, field errors, source selection and local table scroll positions are saved locally. Inputs exceeding automatic storage remain live and exportable; the previous saved copy is kept, so export before reloading. Imported results are always decoded again from the bytes.
Only input values are remembered in this browser. Calculated results and experiment histories are not saved.