Fast answer
Start from a concrete symptom or selector for the fastest bounded preliminary direction.
Enterprise packet investigation · Root-cause analysis
Find the root cause. Prove it in the packets.
Reduce the time from a reported symptom to defensible causal direction. PacketSafari compares affected and healthy behavior, challenges strong candidates, and keeps exact evidence, ruled-out alternatives, uncertainty, and the next action attached.
Reported symptom
Packet evidence
Defensible RCA
Less manual packet huntingPacketSafari rca · Fault-domain adjudicationtls-reset-regression.pcapng
Failed attempts12 repeated sequences
56 ClientHello→57 RST/ACK81 ClientHello→82 RST/ACK
Healthy baselineSame destination service
29 ClientHello→31 ServerHello
Adjudication
Packet loss rebutted · reset ownership unresolved
SupportedImmediate post-ClientHello resets
RebuttedPacket loss as the primary cause
OpenWhich service-path hop generated the reset?
Specialized goal · one question · four responsible outcomes
When the question is ownership, adjudicate the network.
PacketSafari separates supported ownership from suspicion and missing evidence. Every verdict includes the next operational action.
Responsible verdict
Network primary cause
Captured network behavior directly explains the reported symptom.
- Evidence threshold
- Require causal packet evidence, a matching time window, and healthy comparison where available.
- Operator handoff
- Repair the implicated path, device, policy, or transport condition.
No captured network fault means only that the available capture does not show one. It never proves the network is healthy outside that evidence.
Automatic RCA for complex captures
Direction first. Verification stays visible.
The PacketSafari Core Engine searches capture-wide evidence while Agent reasons over compact facts, not the whole PCAP as model context.
- Capture accepted
- Preliminary evidence
- Candidate RCA
- Independent verification
- Defensible report
Fast + verification
Recommended: start early, independently test strong candidates, then adjudicate with capture-wide evidence.
Triage then report
Build the wider Evidence Map first when the capture is large, complex, or unfocused.
Large-capture capacity is deployment-defined and validated. Bounded decoding, indexed evidence, selector-first retrieval, and reusable findings improve scale without creating a universal RCA-time guarantee.
End the blame loop