PacketSafari
Log in

Upload and ingest

Upload one capture, transfer folders, and separate transfer completion from analysis.

One capture

The standalone upload and status commands use a saved login session or bearer token. Unlike investigate, upload does not exchange your saved operator API key automatically. With an API key, prefer investigate for analysis or ingest for transfers.

For a deployment supporting password login, establish the session first (MFA may additionally require --otp):

export PACKETSAFARI_PASSWORD='YOUR_ACCOUNT_PASSWORD'
packetsafari auth login --server http://127.0.0.1:8080 --username YOUR_USERNAME
unset PACKETSAFARI_PASSWORD

The password command can be recorded in shell history; use your normal secret-injection method for automation. Login does not currently prompt for a missing password.

packetsafari upload "$HOME/Desktop/incident/capture.pcap"
packetsafari status CAPTURE_ID

The upload prints a capture ID. Substitute it in the status command. Quote the actual local path; path/to/capture.pcap is only a placeholder, not a bundled fixture.

To upload without starting capture-wide processing:

packetsafari upload "$HOME/Desktop/incident/capture.pcap" --metadata-only

When the goal is an AI investigation, use investigate directly. It owns upload/reuse, preparation, submission, and result observation, so a separate upload is unnecessary.

A folder or landing directory

For API-key transfers, set the ingest environment explicitly; ingest does not read the investigation command's saved defaults:

export PACKETSAFARI_BASE_URL=http://127.0.0.1:8080
export PACKETSAFARI_API_KEY='PASTE_YOUR_API_KEY_HERE'

packetsafari ingest "$HOME/Desktop/incident" --recursive --case INC-4821
packetsafari ingest watch "$HOME/Desktop/incoming" --recursive
packetsafari ingest status
packetsafari ingest --help

ingest uses resumable transfers and a local ledger. File transfer, capture readiness, and any requested investigation are distinct lifecycle steps. Do not treat a successful transfer as a completed AI report.

The ingest command has its own options and persisted controller state. Consult its help before applying investigation flags to it.

Troubleshoot file selection

ls -lh "$HOME/Desktop/incident/capture.pcap"

If the shell cannot find the file, fix the path before submitting. For an existing upload, use investigate --capture-id CAPTURE_ID; a capture ID is not a filesystem path.

For expired credentials, upload limits, and interrupted requests, see results and troubleshooting.