See every byte on the wire.
Mark it up. Send it back out.
byteplay captures raw TCP/UDP traffic, lets you edit it byte-by-byte in a hex view, and replays the result against your own service — so you can see exactly what it does with input you designed, not just input it expected.
Windows · macOS (Apple Silicon) · Linux — native installers, no runtime to set up
The full loop, not half of it
Most tools stop at reading traffic or stop at sending it. byteplay carries one packet through capture, edit, and replay without switching tools.
Live packet capture
Raw-socket capture with a virtualized list, BPF-style filters, and rolling per-minute stats. A 50k-packet ring buffer keeps the view instant under load.
Byte-level editing
Dual-pane hex and ASCII view with a visual diff against the original capture, so you always know exactly which bytes you changed before you send.
Raw TCP/UDP replay
Resend a captured or edited packet to any host and port. Protocol-agnostic — byteplay works below the application layer, not just over HTTP.
Mutation fuzzing
A deterministic, seeded fuzzer mutates a payload and replays each variant with live progress and a cancel button. Bounded runs, reproducible seeds.
Replay sequences
Chain several packets into a scripted session with a delay and timeout on each step — for reproducing a handshake or a multi-step exchange exactly.
Packet library
Save and tag packets in a local SQLite library with full replay history, plus export to PCAP or JSON when you need to hand a capture to someone else.
Where byteplay sits
Wireshark reads. Burp edits HTTP. Scapy scripts anything. byteplay is the GUI that does capture-edit-replay on the raw wire.
| Capability | Wireshark | Burp Suite | Scapy | byteplay |
|---|---|---|---|---|
| Packet capture & analysis | yes | no | yes | yes |
| Edit bytes, then resend | no | no | yes | yes |
| Protocol-agnostic (raw TCP/UDP) | no | HTTP only | yes | yes |
| GUI, no scripting required | yes | yes | no | yes |
| Mutation fuzzer + sequences | no | no | yes | yes |
| Persistent packet library | no | no | no | yes |
Get byteplay 0.2.0
Free forever, MIT licensed. No account, no telemetry — nothing leaves the machine it runs on.
Not sure which file? Open the full release page — Windows needs Npcap installed before it can capture traffic.
Responsible by default
Packet crafting can do real damage pointed at the wrong target. byteplay keeps the guardrails on until you take them off yourself.
Replay and fuzz targets are restricted to localhost and private ranges (RFC 1918) out of the box.
Sending to an external target needs an explicit Allow external checkbox, set per session.
Everything lives in a local SQLite database. Zero telemetry, zero cloud — nothing phones home.
Every replay is logged locally with a timestamp, target, and payload hash, so you can always retrace a run.
MIT licensed for use against systems you own or are explicitly authorized to test — the tool doesn't check, so you have to.
Shipping, tested, open
Signed installers published for Windows, macOS, and Linux.
Parsing, capture, replay, fuzzing, storage, and IPC contracts. CI runs on every push, across 3 OSes.
clippy -D warnings, rustfmt, eslint, tsc, and prettier — all enforced in CI, none optional.
Free to use, modify, and redistribute. Contributions and issues welcome on GitHub.