Hex Packet Decoder
Paste a raw hex packet, get an interactive colour-coded byte map and a full Wireshark-style protocol tree — instantly, in the browser. Ask Nox, the built-in AI assistant, plain-English questions about any packet and get expert answers in seconds.
Overview
HPD takes raw hexadecimal packet data (starting from the Ethernet header, or from an IPv4/IPv6 header if you use Force IP) and produces:
Quick start
- Paste your hex data into the text area. HPD accepts most common formats: raw hex, tcpdump, Wireshark hex dump — see Input formats.
- Press Enter or click Decode. The page reloads with the hex map and protocol tree below.
- Explore. Hover over a byte in the map to see its field name in a tooltip. Click a byte (or a tree item) to highlight the full field. Click a protocol badge in the legend to dim all other protocols.
Input formats
HPD automatically normalises the following input formats:
Raw hex
ffffffffffff0050569c8264080045000035...Spaced hex
ff ff ff ff ff ff 00 50 56 9c 82 64 08 00 45 00 ...tcpdump / Wireshark hex dump
0x0000: ffff ffff ffff 0050 569c 8264 0800 4500
0x0010: 0035 0001 0000 4011 f96e c0a8 0101 c0a8Wireshark copy-as-hex
00000000 ff ff ff ff ff ff 00 50 56 9c 82 64 08 00 45 00 .......P V..d..E.
00000010 00 35 00 01 00 00 40 11 f9 6e c0 a8 01 01 c0 a8 .5....@. .n......0x prefixes automatically.
The packet must start with an Ethernet header unless you use Force IPv4/IPv6.
Hex map
The hex map displays every byte of the packet as a two-character hex cell. Each cell is:
- Colour-coded by protocol (Ethernet, IPv4, TCP, DNS…). Each protocol gets a unique pastel colour from the palette.
- Shaded alternately within each protocol — even/odd fields alternate slightly to help distinguish field boundaries.
- Bordered on the left and right edges of each field.
- Hoverable — a tooltip shows the field name, value, and protocol.
- Clickable — clicking a byte highlights its entire field and scrolls the tree to the matching node.
The map width (bytes per row) can be changed via the Width dropdown in the toolbar (8, 12, 16, 24, or 32 bytes per row). The setting is preserved in the URL.
Protocol tree
The protocol tree is a full Wireshark-style dissection rendered as a collapsible tree. It mirrors exactly what tshark produces.
- Click + / − (top-left of the tree) to expand or collapse all nodes at once.
- Use the search box above the tree to filter visible nodes by keyword.
- Click any leaf node (a field with a value) to highlight the corresponding bytes in the hex map and scroll the map into view.
Highlighting & selection
Field highlight (click a map byte or a tree item)
Clicking a cell in the map, or a field in the protocol tree, dims all bytes outside that field so the selected bytes stand out clearly. The page scrolls automatically to make the selected field visible. Press ✕ (bottom-right of the legend) to cancel.
Protocol highlight (click a legend badge)
Each protocol has a coloured badge in the legend row below the map. Clicking a badge dims all bytes that do not belong to that protocol. Click the same badge again (or ✕) to deselect.
Themes
Click the Theme button in the top-right corner to pick a colour scheme.
Your choice is saved in localStorage and applied on every future visit.
pcap upload
Click Upload to upload a .pcap file.
HPD will parse up to 100 packets (configurable by the administrator).
- Use Prev packet / Next packet to navigate.
- Click Select packet to open a searchable list of all packets in the file.
- Click Reset to delete the uploaded file and return to manual input.
Force IPv4 / IPv6
By default HPD expects a full Ethernet frame (14-byte Ethernet II header at the start). If your data starts directly at the IP layer (no Ethernet header), HPD will prompt you and ask if you want to add a IPv4/Ipv6 header, you can also force it using the URL parameters:
| URL parameter | Effect |
|---|---|
?data=…&force=ipv4 | Prepends a dummy Ethernet header and treats data as IPv4 |
?data=…&force=ipv6 | Prepends a dummy Ethernet header and treats data as IPv6 |
When Force IP is active, the 14-byte dummy Ethernet header is hidden in the map and the PNG export automatically crops it.
Share a packet
Click the Share packet button (chain-link icon in the toolbar) to generate a short permanent link to the current packet. The link is automatically copied to your clipboard.
https://hpd.gasmi.net/?s=a3f8c2d1Anyone opening that link will see the same packet, decoded exactly as you see it. Share links expire after one year without any visit.
Export
Click the Export dropdown in the toolbar:
| Format | Description |
|---|---|
| as PNG | A pixel-perfect image of the hex map with the legend, suitable for documentation or reports. |
| as Text | Plain-text protocol tree (same output as tshark -V). |
| as XML | Raw PDML (Packet Details Markup Language) — the XML format Wireshark uses internally. |
Sample packets
When the page loads without any data, it shows a random sample packet. The samples are defined by the administrator and cover common protocol combinations (DNS, TCP, ICMP, HTTP, ARP, etc.). You can also manually select a sample packet from the top right "Samples" button.
Nox — AI Chat assistant
Every decoded packet comes with Nox, an AI-powered chat assistant. Click the floating Nox button in the bottom-right corner of the page to open it, then type any question in plain English — no protocol expertise required.
Why is this useful?
Reading a raw protocol tree is great for engineers who already know what
tcp.flags = 0x012 means, but it can be opaque for everyone else.
Nox bridges that gap: it has full visibility into the decoded packet
and can explain any field, flag, or value in plain language, put it in context,
and answer follow-up questions conversationally.
How it works
When you send a message, HPD transmits the full decoded packet content (not the raw bytes — the human-readable dissection) to a large language model along with your question and the conversation history. The model has the same information you see in the protocol tree, so its answers are always grounded in the actual packet — not generic theory.
Tips for better answers
- Ask specific questions — "Why is the DSCP field set to CS6?" gets a more useful answer than "explain this packet".
- Follow up freely — the context of the whole conversation is kept, so you can drill down step by step.
- Ask for comparisons — "What would this look like in a normal response vs. this one?"
- Ask for RFC references — "Which RFC defines this option and what does it say?"
REST API
HPD exposes a free public HTTP API — no authentication required. Full parameter reference, response format, and code examples (curl, Python, JavaScript) are covered in the dedicated API documentation.
GET https://hpd.gasmi.net/api?data=<hex>[&format=xml|text|file|png][&force=ipv4|ipv6]📖 Read the full API documentation →
HPD by Salim Gasmi — packet decoding powered by Wireshark / tshark — hpd.gasmi.net