VisualEther Case Studies

Worked examples of PCAP analysis with VisualEther's MCP server and Claude. Each case study is a verbatim user ↔ Claude session showing how the MCP tools turn raw captures into protocol-aware sequence diagrams and cross-layer findings. Each tackles work that normally costs hours of manual, frame-by-frame correlation in Wireshark — tracing a stall, a retransmission storm, or a security exposure across protocol layers — and shows Claude and VisualEther root-causing it in a guided narrative, with every step tied back to the linked PCAP.

5G-NR Radio (R16 MDT): PDCP Decryption to SIP, HARQ & IPsec ESP

R16 MDT gNB-side capture of one UE reconnecting on a shared C-RNTI. Claude authors the FXTs, decrypts the PDCP user plane (NEA2) down to SIP REGISTER, and walks RACH-to-IMS — reading SFN/slot timing, BSR→grant scheduling, the HARQ round-robin and the IMS IPsec ESP security associations.

5G-NR Radio (UE-side): RRC, RLC, PDCP, MAC Cross-Layer Analysis

UE-side captures of three 5G NR attaches (Moto Edge 30 Pro, Pixel 6a, SIMCom IoT module) walked across five session types. Cross-layer trace ties a power-limited UE's Power Headroom to an RRC Release retransmission storm.

5G-NR Radio (gNB-side): Two UEs, Cross-Layer Release Triage

gNB-side mac-nr capture (DLT=149) carrying two UEs on one cell. Claude drives VisualEther across RRC / PDCP / RLC AM / MAC to separate one UE's abnormal RRC Release retransmission storm from the other's normal switch-off deregistration.

5G-NR Radio (gNB-side): DRB Uplink RLC-AM Stall, Frozen at ACK_SN=0

gNB-side mac-nr capture where a UE's uplink stalls, retransmitting RLC AM SN=0 ~18× while the gNB freezes at STATUS ACK_SN=0. Claude and VisualEther walk MAC, RLC AM, PDCP and NAS to fault the gNB receiver and author a custom FXT highlighter for the stalled loop.

4G LTE Attach Across Four Vantages + srsENB UL Scheduler

One UE attach captured simultaneously from UE NAS, eNB S1AP, EPC and eNB MAC. Claude and VisualEther trace how a single NAS Attach Request fans out across the four vantages, then reverse-engineer the srsENB uplink scheduler from BSR / PHR / grant patterns.

VoIP Call Flow Analysis: SIP, RTP, SBC

Three SIP/RTP calls through a Deutsche Telekom SBC pair. Compares native VoLTE (EVS, AMR-WB, SRVCC capability) against PSTN-gateway interconnect — From-URI domain emerges as the strongest origin discriminator.

HTTP/3 + QUIC Page Load Latency: DNS, Retransmissions, IPv4 vs IPv6

Cross-layer pcap triage of a mixed HTTP/3, HTTP/2 and TLS 1.3 web capture. A ~2 s upstream DNS forwarder stall — not TCP/QUIC loss — dominates page-load latency. Includes HTTP version mix, top hosts by bytes, and IPv4-only Happy Eyeballs outcome.

QUIC & TCP Retransmissions in a Noisy Google Capture: FXT Authoring & Loss Triage

A noisy www.google.com browsing capture (DNS, TLS, QUIC, HTTP/3, HTTP/2, mDNS, ARP). Claude and VisualEther author the FXTs, coalesce IPv4/IPv6 onto single lifelines, then triage 3 TCP and 5 QUIC retransmissions while the main www.google.com QUIC connection stays loss-free.

bigFlows.pcap Sessions: HTTP, TLS, DNS, DHCP — Failures, Late & Long-Poll

One mixed-traffic pcap framed as a CI/CD run. Claude and VisualEther build sessions for HTTP / TLS / DNS / DHCP / SSH, rank failure rates per protocol, correlate HTTP and TCP errors via tcp.stream, and split HTTP into short-poll vs long-poll on a Host-header regex.

Kerberos AS / TGS / AP Cycle + AS-REP-Roasting & Kerberoasting Detection

32-frame Windows AD Kerberos pcap walked through a full AS-REQ → AS-REP → TGS-REQ → TGS-REP → AP-REQ → AP-REP cycle. Claude and VisualEther then flag the attack patterns in the capture — AS-REP-roasting vs normal pre-auth, and 12 RC4-HMAC TGS-REPs exposed to Kerberoasting, with a detection cheat-sheet.
Download — free Start 45-day trial Buy a license