EventHelix launches VisualEther for AI-driven PCAP analysis

EventHelix on July 14 launched VisualEther, a tool that turns Wireshark packet captures into sequence diagrams and lets AI explain session failures in plain English. The release targets 5G developers, network engineers and test teams, with a free Community edition available now and paid editions adding AI analysis and CI automation.

Why it matters: - VisualEther is built to make packet-capture analysis faster for engineers who otherwise have to sift through thousands of packets manually. - The tool also aims to make PCAP data usable by AI agents without running into context limits, which could speed troubleshooting and automation. - EventHelix is positioning the product for 5G, telecom, networking and test workflows where capture analysis is routine.

What happened: - EventHelix announced VisualEther on July 14, 2026. - VisualEther converts Wireshark PCAP and PCAPNG captures into readable sequence diagrams. - The tool lets an AI agent explain, in plain English, why a session failed. - A free Community edition is available now.

The details: - VisualEther is designed for 5G developers, network engineers and test teams. - The product turns packet captures into frame-accurate, reproducible sequence diagrams. - VisualEther includes 82-plus built-in protocol templates covering 5G NR, 5G core, LTE, IMS/VoLTE, SIP/RTP, BGP, DNS, HTTP/3, TLS, Kerberos and industrial protocols. - The Session Navigator groups sessions by outcome, including pass, fail, late and timeout. - Engineers can drill back to a Wireshark-style packet tree with one click. - Users can point an AI agent such as Claude Code at a capture and ask questions in plain English. - A capture project can run unattended in CI and produce a diagram plus machine-readable output for each run. - Professional and Server editions include a built-in Model Context Protocol server. - The MCP server extracts only the messages and fields that matter, so the agent works from structured data instead of raw logs. - The MCP workflow is tested with Claude Code and works with any MCP-capable client. - EventHelix says the AI workflow uses an author-debug-verify loop and cites specific frame numbers as evidence. - Published case studies show VisualEther and Claude Code decrypting an encrypted 5G user plane down to a SIP REGISTER. - Those case studies also show the tool reconstructing an uplink scheduling loop from PUSCH occupancy alone. - Another case study flagged 12 RC4-HMAC tickets exposed to Kerberoasting in a Windows Active Directory capture. - A mixed HTTP/TLS/DNS/SSH capture was split into application faults and transport faults. - The free Community edition generates PDF sequence diagrams from any capture and is aimed at learning and small captures. - Professional adds AI analysis, browser-based session triage and unlimited pages for individual engineers. - Server includes three seats and a shared CI install for small test teams. - A free 45-day trial gives access to the full paid feature set. - VisualEther runs on Windows through winget, on macOS Apple Silicon through Homebrew, and on Linux through apt or dnf. - The software requires Wireshark's tshark 4.6 or later. - Sandeep Ahluwalia said the product skips the whiteboard step and lets users ask AI why a session failed while keeping answers anchored to frame numbers. - EventHelix.com, Inc. also makes EventStudio and publishes tools and tutorials for protocol engineers, telecom architects and systems developers. - More information is available at eventhelix.com. - The media kit is available at visualether press materials.

Between the lines: - The launch reflects a broader push to turn raw infrastructure data into structured inputs that both humans and AI can use. - By pairing diagrams with frame-level evidence, VisualEther is trying to reduce the gap between visual triage and defensible root-cause analysis. - The tiered edition model suggests EventHelix is targeting both individual engineers and team workflows with the same core product.

What's next: - Engineers can download the free Community edition now. - Teams that need AI analysis, broader triage features or CI automation can move to Professional or Server after the trial. - EventHelix is likely to lean on the MCP server and case studies to show how the product works in real troubleshooting scenarios.