Dsct FAQs

Question 1

What kind of output format does Dsct produce?

Accepted Answer

Dsct prioritizes machine-readable output. It emits packet records as JSONL (JSON Lines) and commands like `stats`, `list`, `fields`, and `schema` output a single JSON object or array. Even errors, warnings, and progress updates are structured JSON on stderr, ensuring easy parsing for automation.

Question 2

How does Dsct handle very large network capture files?

Accepted Answer

Dsct is built for efficiency on large captures. It processes files with predictable, low memory usage by streaming packets one at a time. Additionally, it offers an optional, memory-mapped Text User Interface (TUI) for interactive analysis of massive files without loading the entire dataset into memory.

Question 3

How does Dsct integrate with AI agents and LLMs?

Accepted Answer

Dsct is 'LLM-friendly by default' through its machine-readable JSON/JSONL output and a built-in Model Context Protocol (MCP) server. This allows AI agents and LLM plugins (like those for Claude Code, GitHub Copilot, or Gemini) to directly call Dsct's tools, such as `dsct_read_packets` or `dsct_get_stats`, for automated packet analysis.

Question 4

Can I filter specific packets with Dsct?

Accepted Answer

Yes, Dsct provides robust filtering capabilities. You can use SQL-like filtering expressions with operators like `AND`, `OR`, `NOT`, and comparison operators (`=`, `!=`, `>`, `<`, `>=`, `<=`) to precisely select and analyze packets based on various protocol fields and values.

Question 5

What is Dsct and its primary use?

Accepted Answer

Dsct is a command-line interface (CLI) tool designed for dissecting network packets from large capture files (PCAP/PCAPNG). Its primary purpose is to generate machine-readable output, making it ideal for advanced analysis, automation, and seamless integration with AI agents and Large Language Models (LLMs).

Dsct

Dsct

Key Features

Use Cases

Key Features

Use Cases