CLI overview

Use packetsafari to submit a local PCAP, investigate an uploaded capture, verify an IDS alert, or save results for automation. Packet analysis runs in your PacketSafari deployment. You do not need to enroll a capture sensor to use an operator API key.

Start here

Pick the shortest workflow that answers the question

Your situation	Start with	Why
“What most likely caused this failure?”	`investigate --goal troubleshoot --workflow fast`	Returns a bounded first assessment quickly.
“Is this capture suspicious?”	`investigate --goal security --workflow fast`	Runs the security goal without requiring an IDS alert.
“I need a second opinion on the first answer.”	Add `--verify` to Fast	Runs an independent Verification after the Fast Report.
“I need the complete incident workflow.”	`investigate --workflow progressive`	Produces Fast Report, Triage, Verification, and Final Report milestones.
“Give the model complete Triage evidence first.”	`investigate --workflow triage_deep`	Completes Core/Triage before the AI report.
“Run deterministic packet analysis without AI.”	`investigate --workflow triage`	Produces Triage evidence without a model report.
“Did this exact IDS alert really match?”	`alert verify`	Binds the investigation to alert/rule context.

Start with Fast for an ordinary question. Escalate the same case when the decision needs broader capture processing, independent verification, or a comprehensive final report. A completed Fast Report is preliminary; it does not become verified merely because execution completed.

Choose a command

What you want to do	Command	Guide
Troubleshoot or review security	`packetsafari investigate`	Investigations
Check an existing IDS alert	`packetsafari alert verify`	IDS alerts
Transfer one capture	`packetsafari upload`	Uploads
Transfer a directory or watch incoming files	`packetsafari ingest`	Uploads
Save defaults or inspect configuration	`packetsafari config`	Setup
Install and enroll a capture sensor	Capture probes UI	Capture probes
Integrate without the CLI	`/api/v2/investigations`	API
Maintain an on-prem deployment	`packetsafari-ops`	Deployment CLI

A typical local-file workflow

After saving your server and API key, replace the path below with a file that exists on your workstation:

PCAP="$HOME/Desktop/incident/capture.pcap"
ls -lh "$PCAP"
packetsafari investigate "$PCAP" --goal troubleshoot --tui

The CLI uploads the file (or reuses an identical existing upload), submits the investigation, shows progress, and prints the result. The TUI guides configuration before submission. AI workflows use the selected provider's allowance; Triage only does not call an AI model.

Examples use macOS/Linux shell syntax. Quote paths containing spaces. In PowerShell, use $PCAP = "$HOME/Desktop/incident/capture.pcap" and put the command on one line; Bash backslash continuations do not apply.

packetsafari
packetsafari help investigate
packetsafari help alert
packetsafari investigate --help
packetsafari alert verify --help

doctor diagnoses local capture support; capture-local captures workstation traffic. probe works with enrolled sensor evidence. Use each command's --help for its prerequisites.

analyze and run are lower-level Agent streaming commands. Prefer investigate for goal/workflow selection and investigation results. In a source checkout, ./packetsafari dev ... manages development services; it is not a required step for normal CLI users.

Source-checkout warning: ./packetsafari is the development and release launcher. The installed operator command is packetsafari from your PATH. Do not add ./ when following these CLI investigation examples.

See the command reference for goals, workflows, configuration, and flags. For unattended use, continue with automation recipes.

Start here

Pick the shortest workflow that answers the question

Choose a command

A typical local-file workflow

Help and related tools