Known selector
Begin with a host, flow, protocol, timeframe, or display filter for a bounded fast start.
Fast answerEnterprise packet investigation · Large PCAPs
Find the needle in the packet haystack.
PacketSafari turns large, complex captures into a compact evidence map, then helps Agent investigate the connections, anomalies, and exact packets most likely to matter.
Spend less time manually filtering and more time validating evidence.
Capture-wide investigationSomething failed around this time. Find what changed.
Evidence remains packet-linked
Bounded discovery
Triage + Core EngineIndexes, rules, correlations, and reusable findings narrow the search.Evidence map
- Connection outliers
- Protocol failures
- Time-window anomalies
time window + failing peersA sparse, reviewable evidence setMany packetsFocused candidatesExact proof
When you do not know the filter
Start with the incident. Not a perfect display filter.
Agent turns an operational question into selectors, evidence candidates, and packet-level follow-up. The analyst keeps control of what is accepted.
01Users report occasional failures.
02Something happened around this time.
03This host may be compromised.
04The application is sometimes slow.
05Find anything unusual.
Three responsible starting points
Use the direction you have. Search wider when you do not.
The workflow changes with the question and capture—not a one-size-fits-all model prompt.
Partial direction
Start from a reported symptom, narrow progressively, and independently verify strong candidates.
Fast + verificationUnknown cause
Build the wider evidence map first when the capture is large, complex, or unfocused.
Triage then reportEvidence that survives the investigation
Analyze once. Reuse what matters.
The PacketSafari Core Engine uses bounded decoding, indexes, rules, correlations, and retrieval. Agent reasons over compact evidence—not the entire PCAP as model context.
- 01Capture accepted
- 02Preliminary evidence
- 03Candidate RCA
- 04Independent verification
- 05Defensible report
Less manual filtering
Fewer repeated broad scans
Reviewable analyst handoff
Exact evidence behind conclusions
Large-capture capacity and investigation time depend on deployment, capture structure, enabled processing, and the question being asked. PacketSafari does not claim a universal file-size or time-to-answer guarantee.
Find the evidence that matters