PacketPilot Analyze — Overview

PacketPilot Analyze is a self-hosted network diagnostics suite. You upload packet captures (pcaps) and log files; Analyze returns deterministic findings plus an AI-powered root-cause explanation — entirely offline, using a local Ollama instance.

What it does:

Uploads pcap files, NetFlow exports, and syslog archives
Runs deterministic rules against known network standards (CIS benchmarks, NIST guidelines)
Explains anomalies in plain English using a local Ollama AI model
Generates PDF reports for ticketing and audit trails

What it doesn't do:

Directly manage or configure network devices (use Config for that)
Capture live network traffic (use Wireshark or a span port for that)
Call external AI APIs — all inference runs locally

Key Features

Deterministic Findings

Rules-based checks fire on known-bad patterns in network traffic. Examples:

SNMP community strings in plaintext
Unencrypted FTP sessions
Expired TLS certificates
ARP spoofing indicators
VLAN hopping attempts

Rules are aligned to CIS Benchmarks and NIST guidelines. Custom rules can be added via the rules API.

Local AI Root-Cause Analysis

After deterministic rules fire, an Ollama model generates a plain-English explanation of the most significant findings. The AI explanation includes:

What happened
Why it likely occurred
What to check next
Confidence level (low / medium / high)

No data leaves your network. Ollama runs as a container inside the Analyze stack. Models are downloaded once and cached.

Supported File Types

| Type | Extension | Notes | |------|----------|-------| | Packet capture | .pcap, .pcapng | Standard libpcap format | | NetFlow v5/v9 | .nfcapd, .flow | | | Syslog | .log, .txt | Plain-text syslog exports | | JSON | .json | Findings exported from Config |

Case Management

Each analysis run creates a Case. A case contains:

Uploaded artifacts (raw files)
Findings (deterministic rule results)
AI explanation (Ollama output)
PDF report

Cases are stored in the PostgreSQL database and searchable by device, date, severity, and finding type.

How Analyze Fits into the PacketPilot Workflow

PacketPilot Config              PacketPilot Analyze
┌────────────────────┐         ┌────────────────────┐
│                    │         │                    │
│  SSH / Console ───────────────────► Findings      │
│                    │  export  │  upload           │
│  Bulk capture ───────────────────►                  │
│                    │         │  Deterministic     │
│                    │         │  rules + AI        │
│                    │         │  = Case            │
└────────────────────┘         └────────────────────┘

Config handles device interaction and can export findings directly to Analyze. Analyze can also be used standalone by uploading pcap files directly through the web UI.

System Requirements

Included Services

| Service | Default Port | Purpose | |---------|-------------|---------| | frontend | 3000 | Web UI | | backend | 8000 | REST API | | postgres | 5432 | Case and findings storage | | ollama | 11434 | Local AI inference | | license-server | 9000 | License validation |

License Model

Analyze uses per-device tier licensing — you purchase a tier based on the number of devices you manage, not per-seat or per-analysis.

| Tier | Devices | Cases/month | AI | |------|---------|------------|-----| | Solo (Free) | 5 | 10 | ✓ | | Pro | 50 | 100 | ✓ | | Enterprise | 500 | ∞ | ✓ |

Cases are created when you upload artifacts for analysis. If you exceed your case limit, cases queue until the next month or you upgrade your tier.

The license server is embedded in the Docker bundle. See Licensing for details on how license validation works in air-gapped environments.

overview