dsct, developed by Higebu, is a command-line packet dissection utility designed to make large capture files accessible to model-based analysis. It converts pcap and pcapng traffic into machine-readable JSONL and exposes a Model Context Protocol server for agent queries. Core functionality emphasizes streaming ingestion, on-demand file navigation, and SQL-like filtering. Network engineers, security researchers, and AI developers gain a tool that bridges raw packet forensics and model-oriented workflows.

What tasks can you actually use it for?

dsct targets high-volume packet conversion and exploratory inquiry: it processes multi-gigabyte captures and turns raw traffic into structured records for downstream processing. Use cases include programmatic extraction of flows, scripted inspections of live captures piped from tcpdump, and automated query-driven analysis by agents that connect to the built-in protocol server. The tool is oriented toward production workflows where capture size and predictable resource use matter.

How reliable are the outputs for AI workflows?

The tool generates JSONL by default, which matches common model input expectations and log pipelines. Its "LLM-first" design means outputs are formatted for automated reasoning, while the SQL-like filter helps narrow records before model consumption. Analysts should treat model-derived conclusions as provisional and verify findings manually, since downstream interpretations depend on prompt engineering and model behavior rather than the dissection alone.

What inputs and environment does it require?

dsct accepts standard pcap and pcapng files and supports streamed stdin ingestion for live data. Memory mapping and on-demand dissection keep resident memory stable when navigating very large files, and an optional text UI offers mapped navigation for manual review. The tool runs in a terminal environment and connects to any MCP-compliant host for agent access.

Is it easy to slot into existing toolchains?

The CLI-first design fits automated pipelines: JSONL output can be piped into analytics tools, the stats command emits structured traffic summaries, and SQL-like filters extract precise slices for further processing. The built-in Model Context Protocol server lets agents query captures directly, and compatibility examples list MCP hosts such as model desktops. Integration work focuses on query tuning and pipeline endpoints rather than custom parsing.

Recommended where AI-assisted inspection complements human analysis

dsct is a practical option for network engineers and AI developers who need machine-oriented packet records for model-assisted review. Its focus on predictable resource use and agent integration suits large-scale capture handling, but automated interpretations from connected agents require human validation before operational action. Treat the tool as a bridge between forensic capture data and model-driven analysis, not as a replacement for analyst oversight.