Investigate a capture

Select your local file

For the Desktop test capture used in our Koi examples:

PCAP="$HOME/Desktop/PacketSafari-High-Value-PCAPs-2026-09-08/Small/22-koi-loader-full-infection.pcap"
ls -lh "$PCAP"

This fixture is not installed by the CLI. If you do not have it, set PCAP to an actual local .pcap or .pcapng file. The following commands use saved authentication and explicitly select Luna/low; your AI connection must offer that model.

Troubleshoot

packetsafari investigate "$PCAP" \
  --goal troubleshoot --workflow fast \
  --model gpt-5.6-luna --reasoning-effort low --format markdown

To focus on a reported symptom, add a quoted question:

packetsafari investigate "$PCAP" \
  'Explain slow HTTP transfers. Separate server delay, receiver backpressure, and network loss; cite frames and limitations.' \
  --goal troubleshoot --workflow fast \
  --model gpt-5.6-luna --reasoning-effort low

Review security without an IDS alert

packetsafari investigate "$PCAP" \
  --goal security --workflow fast \
  --model gpt-5.6-luna --reasoning-effort low --format markdown

Security review requests full IDS scanning by default. Fast's answer and IDS completion are separate; inspect the result's securityScan status rather than assuming the Fast report includes a completed scan. A general security question does not require a SID. Use alert verification when you have an actual alert to test.

Choose a workflow

The milestones progress as follows:

Lifecycle and evidence maturity are separate. Running, completed, and failed describe execution. Preliminary, verified, contradicted, and inconclusive describe what the evidence supports. Read the milestone and verification status before acting on a completed report.

packetsafari investigate "$PCAP" --goal security --workflow fast --verify
packetsafari investigate "$PCAP" --goal troubleshoot --workflow progressive
packetsafari investigate "$PCAP" --goal troubleshoot --workflow triage_deep
packetsafari investigate "$PCAP" --workflow triage
packetsafari investigate "$PCAP" --tui

--inference-speed fast requests provider acceleration where supported. It does not select the Fast investigation workflow. Do not combine --verify with a workflow that already includes verification.

Goals: troubleshoot, security, wifi, summary, network, and custom. Supply a question for custom, and describe the observed symptom for network-responsibility or Wi-Fi diagnosis.

Common goal examples

packetsafari investigate "$PCAP" --goal summary --workflow fast
packetsafari investigate "$PCAP" --goal network --workflow triage_deep \
  'Determine whether the network, a remote service, or insufficient evidence best explains the failure.'
packetsafari investigate "$PCAP" --goal wifi --workflow progressive \
  'Explain association, authentication, roaming, and loss symptoms from the captured viewpoint.'
packetsafari investigate "$PCAP" --goal custom --workflow fast \
  'List DNS failures for api.example.test and cite the decisive frames.'

Use an existing upload

packetsafari investigate --capture-id CAPTURE_ID --goal security --workflow fast

Replace CAPTURE_ID with the ID from an upload or result. With an ID, no local file is uploaded.

Reuse advanced settings

Save this as investigation.json:

{
  "goal": "security",
  "workflow": "fast",
  "ai": {"model": "gpt-5.6-luna", "reasoning_effort": "low"},
  "security": {"full_ids_scan_requested": false},
  "privacy": {"enabled": false},
  "delivery": {"email_report_requested": false}
}

packetsafari investigate "$PCAP" --settings investigation.json

This example explicitly disables IDS for a Fast-only AI test. --full-ids requests IDS explicitly. --analysis-plan FILE supplies the upload indexing plan; --email account requests eligible report delivery to the account email. The TUI also offers advanced settings categories. Unsupported combinations fail validation.

Anonymization

packetsafari investigate "$PCAP" --goal troubleshoot --anonymize

The original uploads to PacketSafari first. Anoncap runs server-side, and investigation submission waits for the protected copy. A failed or mismatched preparation blocks analysis. Use --anoncap-options FILE with --anonymize to select supported policy options. Policy can remove payload, identities, or metadata needed for some findings; review its evidence impact in the UI's Privacy settings.

Local workstation Anoncap preparation is not offered by this command. If the original must remain on your device, do not use server-side anonymization as a substitute for local protection.