Raw-First Captures

PacketSafari can store a PCAP and make raw packets available before the full analysis pipeline finishes. This is useful when you need to inspect frames immediately, when a migrated capture exists on disk but has not been reprocessed yet, or when you intentionally skip full processing during upload.

Raw-first mode does not mean the capture is fully analyzed. It means the source file is available and PacketSafari has enough lightweight metadata to open bounded packet tooling.

What is available immediately

Raw packet rows and bounded decode workflows.
Display-filtered packet field rows.
Payload search and direct tshark-style packet inspection where enabled.
Basic capture metadata from a fast capinfos pass, such as packet count, duration, timestamps, file type, and encapsulation when available.

What waits for full processing

Enriched summaries and dashboard conclusions.
Conversation and endpoint statistics backed by processed artifacts.
Protocol, security, infrastructure, file-object, and post-index views that depend on derived data.
Full Agent runs that use PacketSafari Triage context.

If a view depends on full processing, PacketSafari keeps it unavailable or marks it as refining until the indexing worker finishes the required data.

Upload without full processing

In the upload dialog, open the metadata step and enable Skip full processing after upload.

When this option is on:

PacketSafari stores the original PCAP.
PacketSafari runs a fast minimal capinfos metadata pass.
The capture appears in your library as file-available but unprocessed.
The analyzer opens raw packets with a notice that full analysis is not ready.
An owner or admin can start full processing later with Process now.

The option is off by default. Normal uploads still store the file, collect minimal metadata, and queue full indexing automatically.

Processing later

For an unprocessed capture that is available on disk, click the capture name in the library. PacketSafari offers:

Open raw packets to inspect the PCAP immediately.
Process now to queue full analysis, when you are the owner or an admin.
Cancel to leave the capture unchanged.

Read-only users can see that the capture is unprocessed and can open raw packets when their capture permissions allow it, but only an owner or admin can queue full processing.

Full processing reuses the same capture ID. It does not create a second capture row, and reprocessing replaces old processed artifacts through the normal generation cleanup path.

Fast answer and PacketSafari Triage

When a capture is file-available but PacketSafari Triage is not finished, PacketSafari Agent can use Fast answer. This mode is intentionally narrower than Fast + verification or Triage then deep.

Fast answer can use bounded raw-file tools such as packet decode, field rows, payload search, tshark, and cached tool output. It does not start with triage summaries, endpoint/conversation statistics, post-index navigation maps, or enriched dashboard artifacts.

Use Fast answer for immediate packet questions:

Inspect the first TCP failures and tell me which frame range I should open.

Use Fast + verification when you want the immediate bounded result followed by an independent indexed check. Use Triage then deep when the first report must start from broader correlations, derived summaries, and the capture-wide overview. See Investigation Path Guide.

Failed, missing, and archived captures

Raw-first mode only applies when the PCAP file is available on hot storage.

Missing files cannot open raw packets.
Archived or restoring captures must become hot again first.
Empty captures remain empty.
Corrupt or failed captures stay marked as broken until they are repaired or re-uploaded.