VisualEther Case Studies

Worked examples of PCAP analysis with VisualEther's MCP server and Claude. Each case study is a verbatim user ↔ Claude session showing how the MCP tools turn raw captures into protocol-aware sequence diagrams and cross-layer findings. Every conclusion is grounded in the linked PCAP, the FXT templates that drove the dissection, and the NDJSON outputs of extract_sessions.

5G-NR Radio: RRC, RLC, PDCP, MAC Cross-Layer Analysis

Three UE attaches (Moto Edge 30 Pro, Pixel 6a, SIMCom IoT module) walked across five session types. Cross-layer trace ties a power-limited UE's Power Headroom to an RRC Release retransmission storm.

5G Core Control Plane: NGAP, NAS, PFCP on Open5GS + UERANSIM

Lab-grade Open5GS core driven by a UERANSIM gNB and UE simulator. Walks NGAP setup, NAS-5GS registration, PFCP session establishment, and SBI service interactions across AMF / SMF / UPF / AUSF.

VoIP Call Flow Analysis: SIP, RTP, SBC

Three SIP/RTP calls through a Deutsche Telekom SBC pair. Compares native VoLTE (EVS, AMR-WB, SRVCC capability) against PSTN-gateway interconnect — From-URI domain emerges as the strongest origin discriminator.

Chrome DNS-over-HTTPS (DoH): TLS 1.3 + HTTP/2

Chrome's encrypted DNS traffic to Cloudflare. Walks the TLS 1.3 handshake, HTTP/2 framing of DoH queries, and contrasts plaintext-DNS observability with DoH's privacy guarantees.