AI PCAP Analysis with PacketSnitch
Packet captures are not short of data — they are short of conclusions. A 200 MB capture produces thousands of decoded packets, dozens of carved files, and a list of hosts that is technically complete and practically unreadable.
AI PCAP analysis closes the last mile: a language model reads the structured output the analyzer already produced and writes down what it means. This page explains what PacketSnitch actually does with a model, what it deliberately does not do, and how to run it entirely on your own machine.
What the model sees — and what it never sees
The model is not handed raw packets, and it is not handed your capture.
PacketSnitch’s Python backend (TShark plus Scapy) does the dissection, carving, credential extraction, GeoIP enrichment, and threat-intel scoring first. Only that derived, structured output reaches the LLM: decoded protocol fields, host and stream summaries, extracted artifacts, and the anomalies the detectors already flagged.
Two consequences follow, and both matter:
- Your capture does not leave the machine unless you deliberately point the LLM at a cloud model. Local Ollama keeps everything local.
- The model cannot hallucinate a packet that is not there. It is summarizing evidence the analyzer produced, not imagining traffic.
Three things AI does in PacketSnitch
1. Capture and stream summaries
The Summary workspace generates a running analysis of the loaded capture and refreshes it as you navigate. Summary generation is stream-aware: when packet navigation settles on a stream, a follow-up summary for that stream is scheduled after an idle delay and its non-duplicate findings are appended, so the report stays current without re-summarizing the entire capture every time you click.
Your own notes are folded in automatically. A note marked verified data (concrete) is rendered in its own section, and the summary treats it as a fact rather than an observation — which keeps the model from arguing with something you have already confirmed.
2. Asking questions about a packet
The context menu exposes LLM actions on a selected packet or stream. The question is answered against the decoded packet context, not against a generic knowledge base, so “what is unusual about this exchange?” is answered from what was actually captured.
3. The rat flock — multi-agent investigation
A single model call summarizes. A flock investigates.
PacketSnitch’s flock runs several primitives in phases — discover, drill, verify, maze-walk — that contribute to a shared scratchpad, then synthesize the result into one narrative. Each primitive can call tools against the loaded capture rather than only reasoning about a summary.
The flock is driven by an ordered investigation playbook rather than a free-form prompt, so it does not wander. The phases are:
| Phase | What it forces |
|---|---|
| Inventory | Capture status, candidate streams, overview statistics, anomaly list |
| File artifacts | Every carved file listed, hashed, and available to open |
| Threat intel | Threat-relevant file types resolved against hash lookups |
| Decompression | Compressed artifacts opened, then the earlier phases re-run on the members |
| Cleartext decode | Unencrypted protocols loaded and decoded |
| Secret reuse | Secrets collected from artifacts tried against encrypted traffic |
| Consolidate | One finding per checked-out item, with honest confidence and named gaps |
That is the difference between “ask an LLM about a PCAP” and an investigation with a defined stopping condition.
Running it locally, or not at all
The LLM is optional and disabled by default. This is a hard design property, not a preference: if the Ollama client module is missing, every LLM feature disables silently rather than crashing the application.
Two providers are supported:
| Provider | Where inference runs | Configuration |
|---|---|---|
| Ollama | Your machine, or ollama.com for :cloud models |
settings.llm.ollamaModel; cloud models need settings.apiKeys.ollamaApiKey |
| OpenRouter | A hosted endpoint | settings.llm.openrouterModel; needs settings.apiKeys.openrouterApiKey |
A local Ollama daemon keeps the entire analysis on your hardware. Cloud models
are an explicit opt-in per model name — names ending in :cloud are served by
ollama.com, and the shipped default (minimax-m3:cloud) is one of them, so
“it works out of the box” never means “it phoned home”.
The settings that matter
| Setting | Default | What it controls |
|---|---|---|
llm.activeByDefault |
false |
Whether the Use LLM toggle starts on |
llm.backgroundSummaryGenerationEnabled |
true |
Generate summaries without asking each time |
llm.triggerDelaySeconds |
5 |
How long navigation must settle before a stream summary fires |
llm.maxSummaryTokens |
1024 |
Output cap per summary |
llm.ollamaRequestTimeoutSeconds |
300 |
Request timeout |
llm.retryCount |
2 |
Retries before giving up |
llm.analysisCompactionThresholdBlubs |
6 |
When the running summary is compacted |
activeByDefault: false and backgroundSummaryGenerationEnabled: true look
contradictory but are not: the first governs whether you have opted in, the
second governs whether, once opted in, you have to press a button each time.
What AI PCAP analysis will not do
Being precise about the limits is the point of this page.
- It will not decrypt traffic for you. Decryption is a separate subsystem (802.11 CCMP/TKIP with keys you supply, plus TLS certificate inspection). The flock’s secret-reuse phase tries secrets found in artifacts against encrypted traffic; it does not break encryption.
- It will not replace the dissector. Every field the model reasons about came from a protocol decoder. A protocol nobody has written a decoder for produces less to reason about.
- It will not make a weak capture strong. A capture with no relevant traffic yields an honest “nothing found” rather than a fabricated incident.
- It is not a cloud service. There is no PacketSnitch-hosted inference endpoint; you choose a local daemon or a provider you have an account with.
Where to go next
- Full feature list — every workspace, including the LLM flow.
- Sample captures — download a capture and try the flock on it.
- Frontend documentation — the Summary frame, context-menu LLM actions, and the flock tool surface in detail.
- FAQ — licensing, privacy, and what is optional.
- Download —
.deb,.rpmand.exe.
Download PacketSnitch and load a capture — the LLM toggle stays off until you turn it on.