PacketSafari

Connections

Explore aggregated conversations, connection insights, and packet pivots without reading every frame first.

The Connections view groups traffic into conversations so you can work from flow behavior before dropping into raw packets. It is not limited to a plain TCP table anymore; the dashboard combines connection inventory, timelines, protocol grouping, and deep per-connection insight panels.

Main areas

  • Connection inventory: aggregated rows for the visible traffic slice, with bytes, packets, duration, state, protocol, and badges.
  • Timeline view: connection activity over time so you can spot bursts, gaps, and synchronized failures.
  • Protocol view: quick protocol grouping to understand dominant mixes and pivots.
  • Connection insights center: one selected connection with correlated findings, severity badges, graphs, protocol context, and AI interpretation.

How counts and tabs work

  • The Connections table is backed by the full indexed connection inventory for the capture, not just the currently visible rows.
  • The top chips such as TCP, UDP, IPv4, IPv6, and Ethernet reflect indexed connection counts for that facet and load that slice of the inventory when selected.
  • A separate ranked preview is used for overview and correlation-oriented UX so the product can highlight the most interesting connections first without sending thousands of rows into every panel.

Priority snapshot vs full inventory

PacketSafari keeps two different connection views for different jobs:

  • Full inventory: the canonical indexed set of connection rows used for filtering, paging, exporting, and protocol-family tabs.
  • Priority snapshot: a capped ranked subset used for overview-oriented summaries and "most interesting connection" workflows.

The priority snapshot is intentionally limited so overview payloads stay fast and readable. It is not the source of truth for the Connections table or tab counts.

Common actions

  • Apply a bidirectional or directional conversation filter to the packet list.
  • Copy a ready-made display filter for the selected connection.
  • Open endpoint insights for the source or destination side.
  • Inspect capture point details for the selected connection.
  • Export the current connection inventory as CSV.

Deep troubleshooting

For TCP-heavy captures, the deep view can expose RTT, throughput, and sequence/ack trends. For broader captures, the same screen still helps you identify noisy services, suspicious flows, and the best pivot back into packets.

Use Connections when the question is "which flow matters?" rather than "which packet comes next?"