Analyze Network Traffic with Network Intelligence#

Network Intelligence helps you investigate wireless network behavior by using existing packet captures, decoded protocol information, semantic search, and live network traffic. It supports troubleshooting, protocol-event analysis, decryption-key management, sniffer configuration, and live debugging.

Use this guide to understand the available workflows and choose the right approach for your network investigation.

1. Inspect an Existing Network Capture#

Use Network Intelligence to understand the contents and quality of an existing packet capture before you investigate a specific issue.

You can:

• Validate whether a PCAP or PCAPNG file can be analyzed.

• Identify the capture's link type, packet count, timestamps, and duration.

• Decode packets into structured information that you can examine and filter.

• Discover which protocol fields are available for analysis.

• Extract selected fields to focus on a particular device, protocol, or event.

Example use case: You have a wireless capture but do not know whether it contains the expected traffic. Ask Network Intelligence to validate the file, identify its link type, summarize its contents, and report the time span covered by the capture.

2. Find and Count Protocol Events#

Use Network Intelligence to investigate specific events in a capture, such as Bluetooth Low Energy (BLE) connections, Zigbee network joins, device association attempts, protocol commands, responses, or errors.

You can:

• Discover the protocol fields available in the capture.

• Identify packets that match a specific event or condition.

• Count matching frames by using exact protocol filters.

• Extract relevant timestamps, addresses, status fields, and other available information.

• Focus your investigation on packets relevant to a particular device or exchange.

Example use case: You want to know whether a BLE connection occurred and which devices were involved. Ask Network Intelligence to identify the relevant fields, locate matching packets, count the frames, and report the available device addresses and timestamps.

Important distinction: An exact packet count is not necessarily a count of unique protocol events. A single exchange can be represented by multiple frames.

3. Search for Events Using Natural Language#

When you know what you are looking for but do not know the precise protocol field or filter, use semantic search to locate relevant decoded packets.

You can:

• Search for traffic related to a natural-language description of an event.

• Locate rows that are semantically similar to a query.

• Identify candidate packets for further investigation.

• Refine the search using a more specific description or similarity threshold.

The default embedding model runs locally. Semantic search using this model does not require a large language model (LLM) API key.

Example use case: You suspect that a device's network association failed but do not know which status field indicates the failure. Search for association failures, inspect the matching packets, and then verify the relevant events with exact protocol filters.

Important distinction: Semantic search counts represent similarity matches under the selected threshold. They are not exact protocol-event counts.

4. Ask Questions About a Network Trace#

Use trace question-answering to summarize a capture, investigate a sequence of events, or explain possible causes of a network problem.

You can:

• Summarize the overall traffic and identify notable behavior.

• Investigate protocol sequences and request-response exchanges.

• Explore possible causes of connection failures, rejected operations, or unexpected behavior.

• Ask targeted follow-up questions about the trace.

• Analyze decoded captures and supported text-based logs.

Network Intelligence supports different analysis strategies depending on trace size and the type of question. You can analyze smaller traces as a whole. Larger traces can benefit from chunking or embedding-based retrieval.

Example use case: A device fails to join a Zigbee network. Ask Network Intelligence to examine the relevant sequence, identify where progress stops, and highlight the packets or status information that support its findings.

Data handling: LLM-based trace analysis sends trace data to the configured model provider. Choose the provider and analysis method according to your organization's data-handling requirements.

5. Investigate Encrypted or Partially Decoded Traffic#

A capture can contain packets without exposing the higher-layer protocol information required for an investigation. Missing or incorrect decryption keys are one possible explanation.

You can:

• Inspect which protocol layers and fields are visible.

• Check whether supported keys are available.

• Add authorized key material for supported protocols.

• Synchronize supported keys with Wireshark preferences.

• Reanalyze the original capture after key configuration.

The Network Intelligence key-management workflow covers supported 802.15.4 and BLE-related key material. Other decryption settings, including Wi-Fi security settings, might need to be managed separately in Wireshark.

Example use case: Your capture contains wireless frames, but expected application commands or cluster information are missing. Ask Network Intelligence to determine whether the available fields suggest a decoding or decryption problem before concluding that the traffic was never present.

6. Capture Live Network Traffic#

Use live capture when an existing capture is unavailable or does not include the behavior you need to investigate.

You can:

• Discover connected Silicon Labs adapters.

• Inspect adapter information and availability.

• Start and stop captures on supported adapters.

• Save captured traffic for later analysis.

• Capture on multiple adapters and analyze the resulting files separately.

Live capture requires Simplicity Device Manager (SDM) and supported hardware.

Example use case: A device intermittently loses connectivity. Start a live capture on the appropriate adapter, reproduce the issue, stop the capture, and investigate the resulting trace for the events surrounding the failure.

7. Configure a Supported Sniffer#

Network Intelligence supports configuring compatible EFR32 adapters for wireless packet sniffing.

You can:

• Discover the supported sniffer protocols.

• Check whether a protocol is available for the selected adapter.

• Flash a supported RailTest image when required.

• Configure a sniffer for a supported protocol and channel.

• Verify the resulting sniffer status.

The documented workflows cover IEEE 802.15.4, BLE, and IEEE 802.15.4 Sub-GHz. Supported protocols, channels, and available images depend on the hardware. A compatible Gecko SDK RailTest image might be required when a bundled image is unavailable. The documented configurator does not support em3xx devices.

Example use case: You need to capture IEEE 802.15.4 traffic on a specific channel. Check adapter and protocol support, configure the sniffer, and then use live capture to collect traffic for analysis.

8. Detect Events During Live Debugging#

Use live debugging when a problem is intermittent or needs to be detected as it happens.

You can:

• Define event triggers using semantic phrases or regular expressions.

• Specify an expected response to an event.

• Set a timeout for the expected response.

• Start a live-debug capture and monitor for configured triggers.

• Review the resulting event report and companion packet capture.

Live debugging requires SDM, Wireshark's tshark utility, and at least one configured or explicitly provided trigger. Semantic trigger matching uses the default local embedding model and does not require an API key.

The workflow produces a JSON Lines (JSONL) report and a companion PCAPNG file for further investigation.

Example use case: You want to detect a BLE connection followed by termination. Configure the relevant event triggers, capture traffic while you reproduce the scenario, and inspect the report and companion capture to determine what occurred.

9. Choose an Analysis Strategy#

Choose an analysis strategy based on the trace size, your investigation goals, and whether remote LLM analysis is appropriate.

For large traces, embedding-based analysis can reduce the amount of data sent to an LLM. Chunking processes multiple portions of a trace and can incur higher costs. The appropriate strategy depends on the trace and the investigation.