Upload PCAPs · Documentation · PacketSafariUpload PCAPs Drag-and-drop captures to start analysing them in PacketSafari. From the analyzer landing page choose Upload a PCAP (or press the upload action in the capture library). You can upload multiple .pcap, .pcapng, or .cap files at once. The uploader shows progress, size limits, and which captures will be private or published. Choose what happens next The upload dialog starts with the real workflow choice: Agent investigation uploads one PCAP into a focused Agent workspace. Choose what PacketSafari should answer and how quickly it should trade first-result speed for capture-wide context. Inspect manually uploads and processes the PCAP, then opens the packet and summary workflow for hands-on analysis. The setup is progressive. Agent investigations move through focused Goal, Starting point, Plan, and Review steps, while manual uploads skip the Agent-only decisions. Each setup screen shows only its current decision; the Plan step shows all three speed-versus-verification choices directly, and the final Review confirms the complete selection. Optional Privacy, Email, Agent, Triage, Security, and Developer controls remain available from Advanced settings on Review without adding another required step or dialog. For an Agent investigation, first choose the question. Is the network at fault? is a focused incident shortcut: describe the reported symptom and PacketSafari returns one ownership assessment—network primary cause, network contributing factor, no captured network fault, or inconclusive—with packet evidence, capture limitations, and the next evidence to collect. It recommends Fast + verification and remains a goal, not another analysis workflow. The standard report goals are Executive summary, Root cause, Security review, or Custom prompt. For a Root cause capture of 5 MiB or more, also provide a known IP, hostname, Call-ID, stream, protocol/error, or time range—or explicitly ask PacketSafari to search the whole capture first. Then choose the analysis workflow: Both Fast answer and Fast + verification require a concrete operator-entered problem/question or focused starting point. Selecting only a preset is not enough. You do not always need an exact connection selector: a specific symptom can qualify for bounded discovery. For a large root-cause capture without structured focus, PacketSafari recommends Triage then report instead of silently blocking an informed early-start choice. Triage then deep is the only broad preset-only path. Selecting Security review automatically enables the complete Suricata-compatible IDS scan and keeps PacketSafari Triage running. The results persist in Security, independently of which Agent report milestones the selected workflow includes. Available MITRE ATT&CK mappings remain visible with those security findings. Fast + verification is the recommended early-start path when the question/goal/size policy makes it eligible. A focused Agent uses your concrete question to produce a clearly labelled Preliminary Report while PacketSafari Triage processes the wider capture. A fresh Verification starts from the durable Preliminary Markdown without waiting for full Triage and challenges its material conclusions. Triage continues, then capture-wide adjudication produces a Final Report that can visibly supersede an earlier outcome. Admins and on-prem operators can change the runtime profile without changing this workflow. Fast answer starts a bounded preliminary analysis for that concrete question or focus as soon as the capture is safely readable. It does not wait for Triage or full IDS. When full IDS is requested, the preliminary result is labelled IDS pending until that independent Security milestone completes or fails. Triage then report waits for capture-wide Core processing to complete. Agent then retrieves the bounded packet evidence it needs and produces one Final Report. This path has the slowest first response and the strongest capture-wide coverage boundary. The recommendation is goal- and size-aware. Executive summary below 5 MiB and Security review up to 10 MiB recommends Triage then report. Security review always requests full IDS plus Triage. With a concrete question on a larger capture, Fast + verification can be recommended so early milestones arrive while Triage/IDS continue into its existing Final Report. The backend 10 MiB boundary is the Sharkd progressive preliminary-first/indexing gate, not a security-postprocessor cutoff. When Security review or Run full IDS security scan is selected, the Security settings separate three decisions: Quick IDS screening checks the first 50,000 packets and is explicitly partial; Complete IDS verification checks every packet and runs as its own evidence milestone. High + Critical rules reduce lower-severity noise; All severities includes informational and minor hunting indicators. Rule severity does not change how much of the capture is scanned. Emerging Threats Open and Stamus Lateral Movement can be selected for the investigation. PacketSafari local rules and enabled Abuse.ch feeds remain active. Stamus must first be enabled and refreshed by an administrator under Settings → Intelligence Feeds. PacketSafari shows approximate active-rule counts when inventory is available. The selected source and severity policy is retained with the scan so a result cannot be silently reused under a different rule policy. Is the network at fault? always requires the operator to describe a symptom and recommends Fast + verification. Its Preliminary Report remains provisional; Verification must independently adopt, qualify, rebut, or mark every strong earlier claim inconclusive. For a qualified deployment profile and suitable capture up to 1 GiB, roughly two minutes to the Preliminary Report and roughly five minutes to Verification are validation goals measured from the point where the uploaded capture is ready for analysis. They are not guarantees, exclude network upload, and do not bound full Triage or the Final Report. Before upload, any Triage/Final Report range shown in the plan is a size-based planning estimate because packet count is not available yet. PacketSafari may refine it after safe-open using packet count; protocol mix and runtime load also affect the result. See Investigation Path Guide and Processing runtime. These are analysis-depth choices. They are separate from the question preset, model profile, who drives the investigation, anoncap anonymization, and report-email delivery. For a visual comparison, see Investigation workflows or the detailed Investigation Path Guide. Hosted Agent Pro users choose the investigation workflow first. Where the deployment allows a model-profile choice, they can then select Standard model or Strongest model without changing what Fast answer, Fast + verification, or Triage then report means. Higher-cost combinations are confirmed before PacketSafari spends the selected weighted Agent units. If Anonymize before upload is enabled, the queued Agent prompt runs on the anonymized sibling capture. If report email delivery is enabled for the deployment and your entitlement allows it, PacketSafari can email selected Preliminary Report, Verification, and Final Report milestones separately. Email delivery is selected by default when delivery is available, and you can turn it off or change the selected milestones before starting. Fast answer selects only the Preliminary Report; Fast + verification selects all three significant milestones; and Triage then report selects its Final Report. Choose an organization workspace For an account with one active organization, PacketSafari selects that workspace automatically. If you belong to multiple active organizations, the metadata step shows a required Organization workspace selector. Choose the customer workspace that should own the capture before uploading. The selected organization supplies the capture's shared-access default, pooled upload and storage quota, retention policy, AI-provider policy, and analysis capacity. That organization ID remains stored on the capture and its derived cases, tags, profiles, saved filters, chats, investigations, and reports. Changing the selector on a later upload does not move an existing capture. When an Agent upload exactly matches a capture that is already visible, PacketSafari reuses the stored capture instead of importing another copy. The question, workflow, verification, and delivery choices still start a new investigation; deduplication does not cancel the requested analysis. Only active organizations with an unexpired entitlement are available. If the workspace list cannot be loaded or the selected organization is unavailable, the upload stops instead of falling back to a different tenant. See Organizations for roles, sharing, quotas, and governance. Starting AI work after upload PacketSafari does not run a separate background AI summary after upload. Model-backed work begins through an explicit chat or investigation action: Output What it is When it runs Where it appears Copilot / Ask AI An interactive packet-aware conversation started from a selected packet, field, flow, dashboard finding, or question. When you explicitly choose an Explain or Ask AI action. Copilot chat and saved chat history. Agent investigation run An Agent investigation started from the upload dialog with a chosen question and analysis-depth workflow. When you choose Agent investigation and submit a prompt/report preset. It follows Fast answer, Fast + verification, or Triage then report. Agent progress view, persisted Preliminary Report, Verification, and Final Report milestones when applicable, saved reports, and optional milestone email with delivery status. Deterministic upload and Triage signals remain visible while processing continues. They do not create a second AI result or replace an explicit Copilot or Agent run. When Agent investigation is configured to email reports, PacketSafari durably stores the request with the investigation and tracks each selected Preliminary Report, Verification, and Final Report delivery separately from the Agent run. A delivery can still be waiting, queueing, queued, sending, sent, failed, or skipped after the relevant report milestone finishes. Triage and indexing progress do not generate an email sequence. Create a protected copy during upload In the Review step, enable Protect capture with Anoncap. PacketSafari stores the original upload first, then runs anoncap as a background follow-up and creates a protected sibling capture. When anonymization is enabled, the Privacy pane exposes the complete anoncap configuration directly without opening another dialog. Network evidence is the recommended sharing profile: it preserves supported tunnel and L2–L4 evidence while removing application payload. An optional stronger setting also hides topology and MAC-vendor detail. Application evidence · DeepAnon keeps application payload and rewrites supported HTTP, SIP, Diameter, and Kerberos identity fields. Unsupported or encrypted values can remain, so this profile carries more disclosure risk. Free SaaS users receive the public/basic policy. Active premium and Enterprise SaaS members, admins, and on-prem users can also configure PacketSafari's private privacy classes and identity groups. The upload dialog defaults to scrubbing pcapng metadata and comments from the anonymized sibling capture. Sanitize pcapng metadata removes capture-level metadata such as section comments, capture application / OS strings, interface names and descriptions, address info, name-resolution blocks, and embedded decryption-secret blocks. Sanitize comments removes pcapng capture comments and per-packet comments. PacketSafari stores anoncap run metadata on the capture. PacketSafari keeps the original upload by default and creates the anonymized result as a separate sibling capture. If you turn source retention off, the original is deleted only after the …