Every conversation on the wire, drawn. The one that never finished, named.
sta-a7 asked to join ap-east and was answered. Before association could complete, a deauthentication arrived carrying ap-east's address, sent by a transmitter that was not ap-east. sta-a7 never joined. Nothing was decrypted to say so.
Every conversation on the wire, drawn. The one that never finished, named.
sta-a7 asked to join ap-east and was answered. Before association could complete, a deauthentication arrived carrying ap-east's address, sent by a transmitter that was not ap-east. sta-a7 never joined. Nothing was decrypted to say so.
Drop a .pcap or .pcapng. It is decoded automatically and profiled whole. Every finding is cited to the frame with the filter that surfaced it, so you can re-run it yourself. No filter fluency required. Payloads are never decrypted.
Watch it work on a real capture.
One capture, one question. The investigation drills the raw packets, tells a deliberate attack from RF corruption, and shows its verdict with the exact filters you can re-run yourself.
The map says an arc never closed. The investigation says why: it pulls the deauth frames, checks who transmitted them, and names the mechanism, with every claim grounded in frames it actually pulled.
9,715 bad-FCS · 5,637 malformed
one well-formed teardown
The full investigation, end to end.
Not a highlight. The entire deep-research run, from the malformed-frame profile to the attack-or-noise verdict.
Before it answers, it profiles the capture.
Every capture is first reduced to a sourced profile and a categorized set of threat and protocol findings: the deterministic floor every investigation builds on, computed without decrypting a byte.
Auto-generated from the packets: the protocol mix, and a packet rate that never drops across the whole capture, the signature of a sustained flood. Every value traced back to a frame.
Why packet captures are hard to read.
A capture is hundreds of thousands of frames across three interleaved planes. The signal is in the metadata, the timing, and the malformed structure, rarely in any one packet.
A few minutes on the wire is hundreds of thousands of frames. The packet that explains the outage is somewhere in the middle.
Display filters and capture statistics are their own language. Knowing what to even type is half the battle.
Management, control, and data planes interleave. A roaming failure or an injection attack lives across frames, never in one.
The bytes are encrypted. The story is in headers, timing, fingerprints, and what is malformed, read without ever decrypting.
Hours scrolling Wireshark to find the handful of frames that matter.
Guessing which display filter even surfaces the problem.
Spotting an injection, scan, or beaconing pattern by eye across thousands of frames.
Telling deliberate frame fuzzing apart from ordinary RF corruption.
Writing it up with frame-cited evidence the next team can act on.
What logcat.ai does differently.
Every capture is profiled first, then investigated against that profile.
Deterministic detectors run on open (port scans, host sweeps, beaconing, DGA-like DNS, malformed-frame floods) merged with a protocol and conversation profile into one scored read.
Ask a plain-language question and the agent translates it into the right display filters and statistics, drilling the raw capture across rounds until it can answer. Every claim grounded in frames it actually pulled.
Protocol mix, top talkers, expert severity, packets over time, TLS versions, fingerprints: the dashboard is chosen for the capture and drawn from the packets, not a template.
Put two captures side by side (a good run and a bad one) and see exactly what changed in protocol mix, errors, and behavior. On the map: the same routes, and the one arc that differs.
What's inside a capture.
A .pcap or .pcapng holds every frame on the wire or in the air, across the management, control, and data planes. logcat.ai extracts each layer into queryable structure instead of flattening it to text.
Beacons, probes, auth / assoc / deauth: the roaming and join story.
Source to destination conversations with ports, packets, and byte volume.
Queries, response codes, and high-entropy names worth a second look.
Handshake versions, cipher suites, and SNI: the security posture.
Requests, hosts, and status codes from cleartext exchanges.
Leases, assigned addresses, and client hostnames.
Malformed frames, retransmissions, and protocol-violation events.
JA3 / JA3S / HASSH client and server stack IDs: computed, no decryption.
Objects reconstructed from cleartext HTTP, SMB, and TFTP payloads.
Periodicity, scans, and sweeps: the patterns no single frame shows.
How a capture reaches you.
A capture is taken when the network is the suspect. Three times it is, and what the packets settle.
Hundreds of thousands of frames and the ones that matter are buried. The investigation above sorted 22 deauths and 9 disassociations into corruption versus one real teardown, out of 267,597 packets, cited to the frame.
Clients will not associate, sessions drop, and the capture looks like an attack at a glance. The analysis traced it to weak-signal corruption, not spoofing, and named the frames behind it.
You want the shape of the traffic, not a filter language. The dashboard above read this capture's protocol mix and what was breaking, then drew the charts that fit it: protocol distribution, packets over time, expert severity.
Frequently asked questions.
Network capture analysis, answered. Questions on the evidence side, answers on the answer side.
Both .pcap and .pcapng (the modern Wireshark format), captured from wired or wireless interfaces, including 802.11 monitor-mode captures. The capture is decoded automatically for analysis, no export step.
On upload, the capture is profiled in a single pass (protocol hierarchy, expert info, conversations) and loaded into a queryable store. Deterministic detectors flag scans, sweeps, beaconing, and malformed-frame floods, then the model synthesizes a cited read. Deep Research can drill the raw packets with further filters.
Retransmissions and link stress, DNS failures, TLS posture, 802.11 roaming and auth failures, port scans and host sweeps, periodic beaconing, DGA-like DNS, JA3 / HASSH fingerprints, and frame injection or fuzzing, all without decrypting payloads.
No. You ask in plain language and the agent writes the display filters and statistics for you. The filters it ran are shown alongside the answer, so you can reproduce any finding yourself.
Captures are spooled and processed by streaming, not loaded whole into memory, so multi-hundred-megabyte files are handled. The example on this page is a 93 MB, 267k-frame capture.
Your capture data is encrypted in transit (TLS 1.3) and at rest (AES-256), processed in your own tenant, and never used to train AI models. Payloads are never decrypted: analysis works on metadata, headers and structure. Files are deleted after 90 days, or immediately from your dashboard. Enterprise plans offer on-premise deployment for regulated or air-gapped environments.
Stop scrolling Wireshark. Ask the capture.
Upload a .pcap and get a cited, frame-grounded read in minutes: protocol profile, threat findings, auto-built charts, and a deep-research agent that drills the raw packets for you.