For years I built satellite networks with an LTE air interface. Every time I opened a capture in Wireshark, I did the same thing: scroll thousands of packets across MAC, RLC, PDCP, RRC, and S1AP — then redraw the call flow on a whiteboard so the rest of the team could follow it.
Wireshark is unbeatable at showing you every packet. But it shows you a flat list, not the conversation — who said what to whom, in what order. That sequence diagram lives in your head, and you rebuild it by hand every time.
So I built VisualEther to draw the conversation straight from the capture.
What it does
VisualEther reads a PCAP/PCAPNG and renders it as a readable sequence diagram. It's built on tshark, so anything Wireshark can dissect, it can diagram — 5G, LTE, IMS, SIP, BGP, and dozens of other protocols out of the box. Extraction is driven by an XML "field extraction template" (FXT) that maps protocol fields to messages and sessions.
The AI part: the context-budget problem
Here's the wall I hit when I tried feeding captures to an LLM directly: a PCAP blows the context window before you finish pasting. Thousands of packets, dozens of fields per layer — megabytes of noise, and the model drowns.
So VisualEther ships an MCP server. Instead of raw packets, it extracts only the messages and fields that matter, so the agent reads kilobytes of structured data, not megabytes of logs. It then runs an author → debug → verify loop and cites frame numbers as evidence.
A concrete example
One worked case: an R16 gNB capture with the 5G user plane encrypted. With Claude Code driving the MCP server, VisualEther decrypted the PDCP (NEA2) down to the SIP REGISTER, then rebuilt the uplink BSR→grant→SDAP scheduling loop from PUSCH occupancy alone — because the grants were never in the capture. Every claim is anchored to a specific frame number. Full walk-through.
Triage and CI
Beyond a single diagram, the browser-based Session Navigator groups every session in a capture by outcome — pass, fail, late, timeout — so broken flows surface first. And because it emits machine-readable output (NDJSON / Markdown / HTML), you can wire it into CI to generate a diagram for every capture, unattended.
Try it
VisualEther is a commercial tool with a free tier:
- Community (free, no license): PDF sequence diagrams, up to 10 pages / 10 entities.
- Professional / Server (45-day trial): MCP/AI analysis, session triage, larger diagrams.
Runs on Windows, Linux, and macOS (Apple Silicon), installable via winget / Homebrew / apt / dnf. Needs tshark 4.6+.
- Free download: https://www.eventhelix.com/visualether/download
- Live, interactive output (no install): https://diagrams.eventhelix.com/visualether/5g-nr-radio/
I'd love feedback from anyone who lives in Wireshark — especially on the FXT format and the MCP tool design. Ask me anything.
Top comments (1)
I was particularly intrigued by the concept of the "context-budget problem" when trying to feed captures to a large language model (LLM) directly, and how VisualEther's MCP server helps alleviate this issue by extracting only the most relevant messages and fields. The example of decrypting the PDCP (NEA2) down to the SIP REGISTER in the R16 gNB capture is a great demonstration of the tool's capabilities. I'm curious to know more about the trade-offs involved in designing the FXT format and how it balances protocol complexity with the need for concise, actionable output. Have you encountered any notable challenges in mapping protocol fields to messages and sessions, and how do you see the FXT format evolving to support emerging protocols?