Turn Wireshark PCAPs into sequence diagrams — and let an AI read them published

Sandeep Ahluwalia — Tue, 14 Jul 2026 13:40:00 +0000

For years I built satellite networks with an LTE air interface. Every time I opened a capture in Wireshark, I did the same thing: scroll thousands of packets across MAC, RLC, PDCP, RRC, and S1AP — then redraw the call flow on a whiteboard so the rest of the team could follow it.

Wireshark is unbeatable at showing you every packet. But it shows you a flat list, not the conversation — who said what to whom, in what order. That sequence diagram lives in your head, and you rebuild it by hand every time.

So I built VisualEther to draw the conversation straight from the capture.

What it does

VisualEther reads a PCAP/PCAPNG and renders it as a readable sequence diagram. It's built on tshark, so anything Wireshark can dissect, it can diagram — 5G, LTE, IMS, SIP, BGP, and dozens of other protocols out of the box. Extraction is driven by an XML "field extraction template" (FXT) that maps protocol fields to messages and sessions.

The AI part: the context-budget problem

Here's the wall I hit when I tried feeding captures to an LLM directly: a PCAP blows the context window before you finish pasting. Thousands of packets, dozens of fields per layer — megabytes of noise, and the model drowns.

So VisualEther ships an MCP server. Instead of raw packets, it extracts only the messages and fields that matter, so the agent reads kilobytes of structured data, not megabytes of logs. It then runs an author → debug → verify loop and cites frame numbers as evidence.

A concrete example

One worked case: an R16 gNB capture with the 5G user plane encrypted. With Claude Code driving the MCP server, VisualEther decrypted the PDCP (NEA2) down to the SIP REGISTER, then rebuilt the uplink BSR→grant→SDAP scheduling loop from PUSCH occupancy alone — because the grants were never in the capture. Every claim is anchored to a specific frame number. Full walk-through.

Triage and CI

Beyond a single diagram, the browser-based Session Navigator groups every session in a capture by outcome — pass, fail, late, timeout — so broken flows surface first. And because it emits machine-readable output (NDJSON / Markdown / HTML), you can wire it into CI to generate a diagram for every capture, unattended.

Try it

VisualEther is a commercial tool with a free tier:

Community (free, no license): PDF sequence diagrams, up to 10 pages / 10 entities.
Professional / Server (45-day trial): MCP/AI analysis, session triage, larger diagrams.

Runs on Windows, Linux, and macOS (Apple Silicon), installable via winget / Homebrew / apt / dnf. Needs tshark 4.6+.

Free download: https://www.eventhelix.com/visualether/download
Live, interactive output (no install): https://diagrams.eventhelix.com/visualether/5g-nr-radio/