Analysis readiness
PacketSafari no longer treats ingest as a single all-or-nothing event. A capture can become usable before every heavy analysis artifact has finished.
This is why the analyzer and upload surfaces show readiness states instead of only a binary "indexed / not indexed" signal.
Lifecycle states
Accepted
The capture was accepted and PacketSafari has started ingesting it.
What to expect:
- metadata may still be incomplete
- packet view is not guaranteed to open yet
- deeper analyzer tabs may still be empty or hidden
Open ready
The real packet view can open on the capture.
What to expect:
- packet list, decode, and basic navigation are available
- required first-pass metadata exists
- some heavier dashboards can still be missing, provisional, or refining
This is the key usability milestone for large captures.
Refining
The capture is usable, but background analysis is still running.
Typical examples:
- protocol post-index families still finishing
- infrastructure summary still deepening
- file-object inventory still materializing
- adaptive queued work still running for large captures
PacketSafari should label these results as provisional or non-authoritative when relevant.
Complete
All required analysis for the current capture generation is finished.
What to expect:
- required analyzer surfaces are fully available
- queued required follow-up is no longer pending
- optional on-demand artifacts may still exist, but they no longer block capture completion
Failed
A required ingest stage failed.
What to expect:
- the analyzer may still show partial context
- the capture may need a retry, a rerun, or operator recovery
- error and degraded-mode surfaces should explain what blocked completion
Why PacketSafari works this way
For large captures, some tasks are much more expensive than others. PacketSafari separates:
- the work required to open the capture safely
- the work required for complete analyzer coverage
- optional heavy artifacts that can be materialized later
That design improves first-open UX without hiding the fact that deeper work is still happening.
What is safe to do during refining
During refining, users can usually:
- open the packet list
- inspect decode and hex
- browse early summary information
- use many AI and search workflows
What may still change:
- heavy dashboards may gain more detail
- optional artifacts may switch from preview or sampled coverage to full coverage
- queued follow-up jobs may populate more precise infrastructure or file-object results
Provisional results
Some analyzer surfaces can show results before they are fully authoritative.
Examples:
- preview means an intentionally reduced first-pass result
- sampled means a bounded but useful result
- full means authoritative persisted coverage
PacketSafari should tell you which of these you are seeing. AI and operator surfaces also expose whether a result was loaded from persisted data, queued for later, or materialized on demand.
Where to look in the UI
- Upload progress shows when the capture becomes open ready
- App loading / analyzer status explains whether the capture is still refining
- Ingestion performance shows the runtime timeline, degraded items, and queued follow-up work
- Upload insights and admin infrastructure pages expose deeper unit-level state for operators
See also: