PCAP Investigation Workflows · PacketSafari Root cause on your clock Start RCA now.Triage for wider proof. Get a focused answer as soon as the PCAP is ready, or let PacketSafari Triage—powered by the PacketSafari Core Engine—build a wider evidence map first: protocols, priority flows, correlations, and exact frames. Test your capture See the tradeoffs Compare a focused answer first, background PacketSafari Triage and verification, or Triage before the answer Fast answerFast + verificationTriage then report AI contextEarly direction. Independent checks. Wider final. Focused evidence starts first; targeted verification and Core Triage continue independently Early → finalseparate evidence clocks Capture ready5 min10 min Focused RCAAgent starts immediately PacketSafari TriageCore Engine: decode · organize · correlate · retrieve VerificationChallenges each strong early candidate Final adjudicationReconciles the completed evidence map 1:27Preliminary Report EarlyVerification After TriageFinal Report BenefitDirection now + capture-wide final TradeoffThe final report has a longer clock Animated comparison using a persisted TLS regression investigation. Timings are measured sample evidence, not a universal performance commitment. What PacketSafari Triage prepares Turn a raw capture into evidence you can inspect. The PacketSafari Core Engine searches across flows, protocols, rules, and correlations. Relevant specialists surface the strongest signals and keep them linked to exact frames; AI receives only that bounded evidence. See how Triage works 01 · Raw captureOne noisy PCAP Lots of traffic. A few decisive signals. 02 · PacketSafari Core EngineSearch across the capture Organize flows, decode protocols, and correlate the relevant specialists. 03 · Bounded evidenceKeep what matters Ranked findings stay linked to exact packets. Priority connectionsRanked Protocol anomaliesLinked Exact frame pivotsReady AIAI reasons over the evidence—not the whole capture.Ready for Agent, Copilot, dashboards, and analysts. Raw PCAP → capture-wide Core Engine search → ranked signals linked to exact frames → bounded evidence for Agent, Copilot, dashboards, and analysts. Choose when Agent starts Three clear paths. Every path preserves inspectable packet evidence. The difference is when Agent starts and which later evidence milestones are included. 01Fast answer Agent starts As soon as the PCAP is ready You gain Fastest direction You trade Bounded context 02Fast + verification Recommended Agent starts Early results; final after Triage You gain Direction, checks, then final You trade Separate clocks 03Triage then report Agent starts After PacketSafari Triage You gain Capture-wide context first You trade Longest wait * Controlled TLS sample: ~1m 27s to preliminary direction and ~9m 48s to independent verification. Capture structure, question, queue, deployment profile, and PacketSafari Triage work change runtime. The up-to-1-GiB / roughly-two-minute preliminary envelope remains a profile-specific validation target, not a shipped universal guarantee. Separate choices Keep each decision separate. Ask forIs the network at fault? Executive summary Root cause Security review Custom question Driven byInspect manually Copilot guided Agent investigation Protected byAnoncap privacy Milestone email Deployment boundary 01 · Preliminary emailUseful direction is ready 02 · Targeted outcomeEarly claims were checked 03 · Final emailCapture-wide result is ready One investigation. Separate clocks. Preliminary, targeted verification, and final adjudication stay visibly distinct. Test the tradeoff on your PCAP Choose first-answer speed. Keep packet-level proof. Evaluate with your captureRead sample report