AI PCAP Analyzer is a next-generation network analysis tool that combines the power of Wireshark with a local Large Language Model (LLM) to act as your intelligent security analyst.
Note
The application is under development. I welcome suggestions on how to improve it or any bugs you encounter.
- Local AI Analyst: Powered by Ollama (recommended model:
gemma3:12b). - Conversation Memory: The AI remembers your context and files.
- Smart Visuals: Instant red/orange highlighting for network anomalies (Retransmissions, RSTs).
- Multi-language Support: 🇮🇹 🇺🇸 🇨🇳 🇷🇺 (Italian, English, Chinese, Russian).
- Contextual Understanding: Rename captures (e.g., "Firewall Logs") to give the AI better context.
- Privacy First: All analysis happens locally. No data leaves your machine.
- Python 3.10+
- Node.js 18+
- Wireshark/Tshark installed (
sudo apt install tshark). - Ollama installed and running.
This project requires a running Ollama instance.
- Install Ollama from ollama.com.
- Pull the recommended model:
ollama pull gemma3:12b
- Make sure Ollama is accessible. By default, the app expects it at
http://127.0.0.1:11434(updatebackend/chat.pyif different).
You can use the automated installer to set up both backend and frontend:
chmod +x install.sh
./install.shThen start the application:
./run.shcd backend
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
./run.sh # Starts backend on http://localhost:8000cd frontend
npm install
npm run dev # Starts frontend on http://localhost:5173- Open
http://localhost:5173. - Drag & drop a
.pcapfile. - Click the Robot Icon (🤖) to open the AI Analyst.
- Ask questions like:
- "Why is the connection resetting?"
- "Show me all DNS traffic from 192.168.1.5"
- Use the Language Switcher in the top right to change the interface language.
Created by privatefound.
MIT
