# PacketSnitch user help reference
# This file is consumed as bounded reference material by Ask PacketSnitch.
# Keep this document factual, user-facing, and free of secrets.

## What PacketSnitch is
PacketSnitch is a desktop packet-capture analysis application for PCAP and PCAPNG files. It combines a Python packet-analysis backend with an Electron frontend for filtering, protocol analysis, conversions, threat intelligence, artifacts, notes, and optional LLM-assisted analysis.
Source: https://packetsnitch.com/

## Loading captures and sessions
Use Load Capture or Session to open a backend hosts JSON capture or a previously saved PacketSnitch session. After loading, the application opens the configured default workspace. The default landing tab can be changed in Settings.
Source: https://packetsnitch.com/docu/frontend

## Main workspaces
The Analysis workspace contains summaries and analyst notes. Host Data shows host and packet data. Conv provides conversions, protocol decoders, and extraction tools. Crypt provides cryptographic and wireless workflows. Stats provides statistics, maps, anomalies, and threat intelligence. List shows packet rows. Notes stores analyst notes and can feed the summary. Settings controls application behavior and integrations. Artifacts stores persistent local files and extracted artifacts.
Source: https://packetsnitch.com/docu/frontend

## Filtering
The filter bar uses dot-notation fields and supports `:`, `==`, `!=`, `>`, `>=`, `<`, `<=`, `&&`, `||`, `!`, and parentheses. Use `application.proto` for application-layer protocols, `decoded.proto` for decoder-identified protocols, `link.proto` for link-layer protocols, `network.proto` for network-layer protocols, and `transport.proto` for transport-layer protocols. Size fields such as `payload.len` and `wire.len` use byte values.
Source: https://packetsnitch.com/docu/filters

## Conv conversions and decoders
The Conv workspace can load selected packet data, payload bytes, HTTP bodies, or followed streams. The Decodes subtab provides protocol-aware decoders. A decoder may be selected manually or inferred from protocol and file hints. The extraction tools can identify, decompress, inspect, hash, and load supported file content into the surrounding workspaces.
Source: https://packetsnitch.com/docu/frontend

## Notes and summaries
Context-menu analysis results can be written to Notes. Notes are marked as inferred by default and can be marked concrete or verified by the analyst. Notes are incorporated into the Summary workspace with separate inferred and verified sections.
Source: https://packetsnitch.com/docu/frontend

## LLM features
LLM features are optional and use the configured provider and model. Ask PacketSnitch can interpret capture questions, generate filters, summarize context, open workspaces, send filtered packets to Conv or Crypt, and add results to Notes. Help questions can use the documentation lookup action when documentation is available. LLM output should be treated as assistance and checked against the capture and documentation.
Source: https://packetsnitch.com/docu/context-menu

## Help and support
The Help button opens the PacketSnitch documentation hub at https://packetsnitch.com/docu/ in the in-app browser. The FAQ covers installation, supported capture formats, LLM/Ollama configuration, plugins, licensing, privacy, and common workflows.
Sources: https://packetsnitch.com/docu/ and https://packetsnitch.com/faq/
