TransIT AI
Sign up

Sessions & terminal

Capture packets

The PCaps surface records traffic from a network interface on your machine — driving the OS’s own capture tool, no driver install — and opens any .pcap, .pcapng, or .pcap.gz for analysis. The AI can read the analysis, never the payload.

Record a capture

  1. Click the PCaps tab in the left rail (the fifth rail tab).
  2. Pick an interface. Optionally add a capture filter in BPF syntax — host 10.0.0.5, port 443, vlan 120 — to record only what matters, and tick Headers only if you don’t want payload on disk at all.
  3. Press Start. The sidebar shows bytes written and elapsed time while it runs. (If it’s been running a while and written nothing, your filter probably matches no traffic — the sidebar will say so.)
  4. Press Stop. The capture opens as a tab. On Windows the packet list appears at Stop rather than live — pktmon records to a log that’s converted at the end — with counters shown while recording.

On macOS and Linux, capture permission is whatever your system already grants tcpdump — if Wireshark works on your machine, so does this, with no password prompt.

Open a capture someone sent you

Drag a .pcap / .pcapng / .pcap.gz onto the PCaps sidebar, or use its Open capture… button. Nothing is recorded; you’re just reading a file.

Work the capture

  • Filter with Transit’s view syntax — tcp.port == 443 and dns.rcode != 0 — it validates as you type.
  • Click a packet for its dissected field tree and raw bytes.
  • Open the analysis drawer for the overview, conversations, protocol breakdown, and Findings — computed problems (retransmit rates, zero-window stalls, refused connections, DNS failures, fatal TLS alerts, and more), each with a one-click filter that shows its evidence.

Ask the AI

With a capture open, ask the chat panel directly: “why is this transfer slow?”, “what broke the TLS handshake to 10.0.0.5?”, “which host is retransmitting?”. The AI reads the same computed analysis you see — dissected fields and summaries, never packet payload — and cites findings you can jump to. If you’d rather it couldn’t see captures at all, [pcap] agent_access = false keeps the explorer and severs the AI’s view.

No PCaps tab?

An administrator has disabled the surface with [pcap] enabled = false in Transit’s config.toml. It’s on by default. See Packet capture for the full surface, including where the config file lives.