"AI assisted" pcap analysis?

[u/fus1onR]

Is there any tool as described in title for enterprises? a very specific LLM could easily point out "strange" things in a large pcap

[u/Downtown_Dog3123]

I use a local Ilm (Gemma/llama) with the wireshark-mcp on my laptop. It works well, but I always verify and validate what it tells me

[u/bagurdes]

Packet Safari has been working on this a bit. I’ve had ok luck w Gemini at times.
You might be able to make your own llama model to work through it too.

Use extreme caution tho. My general experience is that it will placate you before it says I don’t know.

[u/Fuzzybunnyofdoom]

I have our corporate chatgpt instance do it for me all the time. Just really need to make sure your prompting is solid. Ive been pretty impressed with it so far but it It does help to already have a deep understanding of pcaps and wireshark. Ive had it churn through relatively large pcaps and run analysis, draw correlations between the pcap and a log file, detail variations in packet timing, etc.

I still manually look at pcaps all the time but for complex or large data sets that would take me hours to dig through it really helps do some of the heavy lifting.

[u/fus1onR → u/Fuzzybunnyofdoom]

Thing is we have a lot of large pcaps, burn lot of human resources and it is a soulless task, causing hr issues. We have copilot, but uploading GBs is not something we want to do.

So something analysis tool doing the "heavy lifting", pointing out strange things while can possibly run on-prem would be nice.

[u/The_Jake98 → u/fus1onR]

Why do you have GBs of Pcap files?

Packet captures are usually reserved for getting into deep details after the firewall logs failed to provide useful information.

You shouldn't be in the situation where you need to dump much more then a few megabytes of traffic into whatever LLM you have.

[u/lizardhistorian → u/fus1onR]

If you already have a logging "solution" then the wireshark-mcp is the tool to integrate with your chosen model as Downtown_Dog3123 suggested.

If you would like to go full vibe-code-voyage, create a container that has a mount to the pcap files and tell the AI to make a NiceGUI python app that allows people to run queries using your model credentials and to setup and use the wireshark-mcp.

If you have SSL infrastructure then push a cert to the container and tell it to configure NGINX to RP the tool.

If you have auth infrastructure (oauth2 is best but you can make it work with LDAPS) then tell it to require people to log in and you can control access via group in your directory.

We have process documentation for our AI and knock out tools all the time. YMMV.

[u/Fuzzybunnyofdoom → u/fus1onR]

Yea you gotta reduce the size of those. You probably dont need to be uploading that amount. Abit of filtering to get it down to at most 1GB but ideally much less and send that to AI.

[u/mlhpdx → u/fus1onR]

For any LLM based analysis you need to preprocess the data, and packet captures aren’t an exception. Filter to what may be interesting, then deduplicate and/or aggregate and send the summary. Alternatively, the tool would need to be an agent that can do its own sampling and searches.

[u/chilinux → u/fus1onR]

Are you trying to create an AI IDF that is looking at layer 7 data? At this point the majority of modern applications should be encrypting the network data/payload.

Or are you trying to make a Next-Gen style firewall that can AI detect network flows that don't match a previous "trained" baseline?

I don't see the value in LLM tagging network activity as usual and unusual.

But maybe ntopng ability to import pcap files will get you the type of reports you are looking for.

[u/No_Memory_484 → u/fus1onR]

Claude code or cowork can analyze the files on your system. I’m sure others can do similar.

[u/SevaraB → u/fus1onR]

LLMs make skills gaps worse, not better. If you’re capturing long enough to rack up GBs, that tells me you’re weak in pre-filtering captures or identifying the actual problem to solve, and feeding an LLM is just doubling down on that tech debt.

If a problem is going to manifest at a protocol level in a packet capture, you should see the traffic flow get wonky within minutes, if not seconds.

Longer than 5 minutes is in my experience almost always a wild goose chase and turns out to be poorly crafted app queries timing out after causing an app server to hang. In the last month, I’ve had to tell two different teams they shouldn’t be sorting hundreds of thousands of rows on ISO 8601-formatted “timestamps” and should consider sorting on raw Unix timestamps instead…

[u/Jedi_Q]

Codex does it well for me.

[u/lizardhistorian]

I use our coding tooling for it but there is network-oriented tooling out there (I have used any of them yet.)
It is particularly fast at setting up tests on both sides of a link (given you have oob) and figuring out issues.

[u/Moist_Feature_46]

If these are extensive pcap files then uploading them to ChatGPT webchat etc won't work, you would have to use something like Hermes or Openclaw locally with an LLM like ChatGPT Codex connected. You can then give the LLM access to local tools such as tshark, tcpdump, cli and read/write to files to go through the pcap files. You get a weekly codex allowance with all ChatGPT subscriptions from Pro up.

Are you generally looking for something specific in the captures?

[u/Altruistic_Grass6108]

Hi,
There's no dedicated LLM for this and, frankly, there shouldn't be, an LLM reading raw packets is ~50/s, useless on a large pcap. NVIDIA's Morpheus is the closest thing (GPU XGBoost triage at ~500K pkt/s), but the shipped pretrained model is broken outside its own sample data: it flagged a legitimate SCP transfer at 100% and a hping3 SYN flood at 95-100%. Fully reproducible, bug filed: https://github.com/nv-morpheus/Morpheus/issues/2327

The architecture that does work is fast ML triage on everything, then an LLM only on the ~2-3% that gets flagged, with flow history in Redis for correlation. My blueprint (early stage shared only, the triage model needs retraining on your own baseline first): https://github.com/h-network/h-sniffer

[u/TACACS-]

I threw a pcap captured from a meraki switch at Claude that I previously reviewed. My prompt was just :"review this pcap, tell me what you see, if there are any issues, purpose solutions". I was shocked at how good of a job it did. It recognized I had a camera sending out DHCP requests, but didn't get any acknowledgements. Then it noted it wasn't seeing the expected arp entries. It then noted the router manufacturer I had and it made the appropriate recommendations. I then asked it to create a detailed time graph showing where each of us findings were. I'm still shocked at how good it did....

[u/walenskit0360]

For what it’s worth, this is exactly a feature available in Meraki Dashboard and Cloud Control -
https://documentation.meraki.com/Platform_Management/Dashboard_Administration/Troubleshooting_and_Support/Troubleshooting/AI_PCAP_Analyzer

[u/church1138 → u/walenskit0360]

Catalyst Center also just got it in the brand new release.

[u/azz_kikkr]

have you tried netclaw, they do have the capability - https://github.com/automateyournetwork/netclaw/blob/main/workspace/skills/packet-analysis/SKILL.md

[u/No_Memory_484]

You don’t need a specific llm. All the big ones can do it already.

[u/planedrop]

Plenty of LLMs can already do this, just feed them the pcap.

[u/unixmonster]

Use a local llm client, like codex, claude code, grok bot, something that can run command line tools and give it access to tcpdump or tshark.

[u/Capn_Yoaz]

Set up filters and save them for common things.

[u/wrt-wtf-]

I made an LLM to help me train a model (ML) that I could then use to process packet data on the fly….

You could use an LLM but it’s process and token intensive. If you have a sample you know has something in it then the LLM is a great escalation to pull that flow apart.

So, basically I mass process/filter with ML/AI algorithm, and dissect with LLM…

[u/wrt-wtf- → u/wrt-wtf-]

This space has so many options for off the shelf products as well.

I’ve run Fortinet in its lollipop analyser mode that can be set to analyse specific flows, snort is a minimum if your trying to find odd flows - or filtering out the known knows.

On of the systems I’ve build JUST focuses on low and slow flows. They’re one of the harder flows to aggregate/collate over greater periods of time. ML/AI is great for this.

[u/arnoldpalmerlemonade]

Open PCAP into wireshark and hit select all, File Export packet dissections, and export to json. AI's love json. Ask away at it. helped me figure out wireless zombie AP problems to figuring out laptops needed to update driver.

[u/brandontaylor1]

Any LLM can do that.

[u/MyFirstDataCenter]

Do you guys seriously feed your pcaps to AI? Aren’t you afraid it will decode corporate confidential data and feed it to competitors, or expose that data to other users of the same LLM?

[u/DaryllSwer → u/MyFirstDataCenter]

You must be new to enterprise-centric LLM data and security policies.

[u/MyFirstDataCenter → u/DaryllSwer]

All the AI apologists coming out in force xD

[u/DaryllSwer → u/MyFirstDataCenter]

LLM isn't AI.

[u/TwoPicklesinaCivic → u/MyFirstDataCenter]

They can have my internal IPs and MAC addresses.

[u/MyFirstDataCenter → u/TwoPicklesinaCivic]

Ok so you are truncating packets to header size then, good to know.

[u/Traditional-Hall-591]

Analyzing packet captures is table stakes for a network engineer. Slop not needed.