What Is PcapAI?
Online PCAP analysis for network problems and security threats — no software to install, no filters to build. Upload a capture, read the free summary in about two minutes, and get a client-ready PDF report for $9.
PcapAI is a web-based tool that analyzes PCAP and PCAPNG capture files automatically. Where Wireshark needs hours of filters, stream following and note-taking, PcapAI turns the same packets into a structured report: what is wrong, where in the network, which hosts are involved and what to do next. There is no software to install, and uploads without an account are deleted 24 hours after upload.
It is built for the people who get handed a capture and a deadline: network engineers chasing a slow application, MSPs and IT consultants who owe a client an explanation, and security teams triaging an incident. A Rust packet engine parses the protocols and runs detection rules and network health checks; an AI language model then writes the summary from those findings — it does not invent findings of its own.
How PcapAI Works
The analysis pipeline runs in three stages after a file is uploaded.
Parsing & Metadata Extraction
A custom Rust engine deconstructs the binary capture file and extracts structured metadata: flow statistics, protocol hierarchy from Ethernet to application layer, DNS queries, HTTP headers, SSL/TLS certificate details, and raw credential patterns in unencrypted traffic. Parsing a capture of a few megabytes takes seconds.
Detection Rules with Evidence
Detection rules for 69 MITRE ATT&CK techniques and network health checks run on the parsed traffic. They look at sequences, timing, volumes and protocol details, not just signatures, and every finding keeps the frames it rests on. Thresholds and scoring are documented in each report’s methodology appendix.
Report Generation
Findings go into a PDF with two audiences in mind: a one-page executive summary for the client or manager, and evidence, affected hosts and fix steps for whoever does the work. A language model writes the summary text from the findings only: it gets them with IP addresses, numbers and times replaced by placeholders, and the engine fills in the values. The free summary uses no AI at all.
Who Uses PcapAI
Three audiences, one shared problem: a capture to explain and not enough time to read it packet by packet.
Network Engineers & IT Admins
When users say the application is slow, PcapAI shows whether the client, the network path or the server is at fault: packet loss per server, MTU problems, zero windows, DNS and DHCP failures and slow responses, with the hosts and times. The PDF is evidence you can send to your ISP, hosting provider or vendor, or proof that the network is fine and the server is not.
MSPs & IT Consultants
Turn a client’s capture into a deliverable without writing it up by hand. The report opens with a one-page summary for the client, carries your client’s organization and a TLP label when you set them in your account, and lists fix steps with owners.
Security Teams
Triage a capture during incident response: C2 communication, exposed credentials, lateral movement or exfiltration, mapped to MITRE ATT&CK with the frames as evidence — before committing hours to manual Wireshark analysis.
Core Capabilities
Network Troubleshooting
The Troubleshooting report runs 100 diagnosis rules in 11 areas: packet loss per server and direction, round-trip times and latency spikes, slow server answers, zero windows, MTU black holes, DNS and DHCP failures, duplicate IP addresses and broadcast storms, TLS handshakes and certificates, and VPN, file-share, directory and mail errors. It ties each problem to the hosts and times involved and says which part of the network the fault lies in and who owns the fix — the analysis a network engineer would otherwise assemble by hand. See all checks and thresholds →
Client-Ready PDF Reports
Every report has the same structure: a one-page executive summary; scope, evidence integrity (the capture’s SHA-256, engine and ruleset versions) and limitations; every finding with severity, confidence, affected hosts and evidence; a remediation roadmap with owners; coverage of what was checked and what could not be; assets, capture quality and what to capture next. See a sample report →
MITRE ATT&CK Threat Detection
Every security finding is mapped to the MITRE ATT&CK framework, a shared vocabulary for escalation and documentation. The engine covers 69 techniques; a sample of the most common detections:
- T1071.004 DNS tunneling & C2 over DNS
- T1071.001 C2 beaconing over HTTP/HTTPS
- T1557.002 ARP Cache Poisoning (MITM)
- T1595 Active scanning & reconnaissance
- T1048.003 FTP-based data exfiltration
- T1040 Network sniffing & credential interception
- T1558 Kerberos ticket extraction
The full rule set covers 69 MITRE ATT&CK techniques across network-based tactics, from reconnaissance and lateral movement to exfiltration and C2 communication, each with the rule that fires it. See full coverage matrix →
Credential & Forensic Discovery
Scans application-layer traffic for plaintext credentials, NTLM challenge-response hashes, Kerberos tickets, and session tokens transmitted over unencrypted protocols including HTTP, FTP, SMTP, and SMB. Every secret is masked in the report — only the first and last character and the length are printed, for example S******! (11) — so the report proves the exposure without handing anyone the password.
Deep Packet Inspection
Full-stack deep packet inspection across every layer — from Ethernet frames and IP headers down to application-layer payloads. Decodes TCP, UDP, DNS, HTTP, HTTPS, FTP, SMB, SMTP, Kerberos, and more. The result is a complete map of every conversation in the capture: who talked to whom, on which protocol, for how long, and how much data was exchanged.
REST API
Advanced subscribers can automate the workflow with the REST API: upload a capture, poll its status and download the PDF report — for example after network tests in a CI pipeline, or from a script that collects captures from your sensors.
MCP Server for AI Agents
PcapAI offers an open-source MCP Server built in Rust. Through the Model Context Protocol, an AI assistant like Claude Desktop passes it a capture's file path; the server uploads the file over TLS to the PcapAI engine and returns the findings to the conversation, with no browser upload step. Analysis runs server-side, so the MCP Server needs outbound network access and does not work offline or in air-gapped environments. If your captures cannot leave your network, contact us about on-premise deployment.
Learn about the MCP ServerPrivacy & Security Architecture
PcapAI was designed with a security-first posture, appropriate for a tool whose users regularly handle sensitive internal network data.
- All file transfers use TLS 1.3 encryption in transit. Files are encrypted at rest during processing.
- Each analysis runs in an isolated container. Captures and reports are stored in Amazon S3 (us-west-2).
- Uploads without an account and their reports are deleted 24 hours after upload; reports saved to an account are kept for 30 days, or for as long as an Advanced subscription lasts.
- Reports show the IP and MAC addresses and host names needed to act on a finding; passwords and other secrets are masked.
- The language model that writes the PDF summary never receives the capture: it phrases the findings with IP addresses, numbers and times replaced by placeholders, and the engine fills in the values. The free summary uses no AI.
- Findings come from rules, so the same capture and engine version give the same findings; every report prints the capture’s SHA-256 and the engine and ruleset versions.
Controls to Review for Audits
Each finding lists the framework controls it touches. The report names controls to review; it does not issue a compliance verdict.
Annex A controls to review for each finding, in every report.
Controls such as SC-8 (transmission confidentiality), CM-7 (least functionality) and SI-2 (flaw remediation), in every report.
Safeguards to review for each finding, in every report.
Requirements such as 4.2.1 (strong cryptography in transit), added when your account’s sector is a cardholder-data environment.
Article 21 measures, added when your report settings mark an EU essential or important entity.
Short notes on GDPR, NIS2 and the HIPAA Security Rule, chosen by the country and sector in your report settings.
PcapAI vs. Manual Analysis
| PcapAI | Manual (Wireshark + Analyst) | |
|---|---|---|
| Time to first finding | About 2 minutes | 30 min to several hours |
| MITRE ATT&CK mapping | Automatic | Manual lookup |
| Credential detection | Automated, masked in report | Manual, error-prone |
| PDF report | Included | Hours of documentation work |
| Consistency | Every capture analyzed identically | Varies by analyst and fatigue |
| Scalability | REST API on the Advanced plan | Bottlenecked by headcount |
| Where analysis runs | PcapAI engine (uploaded) | On your machine |
PcapAI is not a replacement for expert network forensic analysis in complex investigations. It is a force multiplier — handles the first 80% automatically so analysts can focus on the findings that actually matter.
Comparing online analyzers? See AI PCAP analyzers compared: PcapAI, PacketSafari, CloudShark, Meraki, Red Hand, Wireshark and others.
Frequently Asked Questions
Try It on Your Own Capture
Upload a PCAP — no account needed. The summary is free and takes about two minutes; the client-ready PDF report is $9, refundable within 7 days.