Packet capture

Some questions the CLI can’t answer. The interface is up, the config is clean, and the transfer is still slow — because the answer is on the wire, not in show output. Transit’s PCaps surface captures traffic from a network interface on your machine and opens any .pcap, .pcapng, or .pcap.gz someone sends you, as a tab beside your SSH, console, API, and file-transfer sessions.

It is the first Transit surface the AI can see — and the split still holds: you get the packets; the AI gets the analysis. Wire payload has no query it could ask.

Available in Transit 6.0.0 and later.

Two actors, one capture

	You (the explorer)	The AI agent
Sees	Everything — packets, fields, raw bytes	Dissected fields and computed summaries
Payload	Yes — a hex/ASCII bytes pane	No — no query for payload exists
Gated?	No — it’s your capture, on your machine	Reads only; nothing to gate or approve
Price	Free	The AI subscription

Capture without a driver

Transit ships no capture driver and installs no kernel code. It drives the capture tool your operating system already has — tcpdump on macOS and Linux, pktmon on Windows — so there’s no Npcap to license and nothing new running privileged. If your machine already permits packet capture (it does if you have Wireshark installed), you won’t even see a password prompt.

Pick an interface, optionally set a capture filter (standard BPF, like host 10.0.0.5 and port 443), and press Start. While it records, the sidebar shows bytes written and elapsed time — and says so plainly when a capture has been running a while and written nothing, which is what a filter matching no traffic looks like. Captures are bounded by size, file count, and duration, so one you forget about can’t fill a disk, and a Headers only mode records enough for flow and protocol analysis while capturing no payload at all.

One honest Windows caveat: pktmon records to a log that is converted when you stop, so there is no live packet list during a Windows capture — counters only, then the full explorer on Stop.

The explorer

Three resizable panes — packet list, dissected field tree, raw bytes — with a view filter in Transit’s own dotted-field syntax:

tcp.port == 443 and ip.src == 10.0.0.0/24 and dns.rcode != 0

It validates as you type, and it’s the same syntax the AI uses when it cites evidence, so a filter the AI hands you drops straight into the box.

Findings are computed, not inferred

Alongside the packet list sits an analysis drawer: an overview digest, conversations, a protocol breakdown, and Findings — problems Transit computes from the capture rather than asking a model to guess at them. MTU black holes. Retransmission rates per conversation. Zero-window stalls, with how long the sender sat stalled. Connections that were refused as distinct from ones that got no answer at all. Two MACs claiming one IP. DNS failure rates and unanswered queries. Fatal TLS alerts. Cleartext credentials crossing the wire. Routing loops.

Every finding carries a one-click filter that shows you its evidence. The AI cites the same findings the drawer shows you — deterministic analysis, so you and the model are looking at the same facts.

What the AI reads — and what it can’t

Ask the assistant why the transfer is slow, what killed a TLS handshake, or which host is retransmitting, and it works through the same analysis you can see. It starts from a compact digest whose size doesn’t grow with the capture — a 1.2 GB file and a 1 MB file cost the same to understand — then drills into packets, conversations, flows, and findings with bounded queries.

What it reads is dissected fields and computed summaries, never wire payload. That’s not a filter deciding per request — the AI’s capture tool simply has no query shape for payload, the same construction that makes its API tool GET-only. A prompt-injected or jailbroken model can’t ask for bytes there is no way to ask for. Everything it does read passes the same redaction filter as terminal output and arrives marked as untrusted wire content, because a capture’s strings were chosen by whoever put the frames on your network.

And if you want packet analysis without any AI involvement, one line in Transit’s config.toml severs the view while keeping the whole explorer:

[pcap]
agent_access = false

Turning it off (and DLP)

The surface itself has the same enterprise off-switch as the local terminal and file transfer:

[pcap]
enabled = false

Both switches live in Transit’s config.toml, next to the transit.toml inventory:

OS	Path
macOS	~/Library/Application Support/Transit/config.toml
Windows	%APPDATA%\Transit\config.toml
Linux	~/.config/Transit/config.toml

Create the file if it doesn’t exist yet, then restart Transit. With enabled = false set, the PCaps rail tab doesn’t appear and no capture can be started or opened. Where captures are written is up to you — Settings → General → Capture folder moves it somewhere with more room.

Not the other “capture”

Transit also has Capture & diff — named snapshots of command output, for catching config drift. This page is about packet capture: frames off the wire. Same word, different evidence.