One prompt, 33 captioned packets — AI-annotating a DNS capture

A single command generated 33 AI-annotated packets from a DNS capture. Wireshark displayed the 33 frames of a recursive DNS lookup, showing a resolver requesting DNSSEC records with a 512-byte buffer using two TCP connections. VisualEther 9.1 added AI annotation using Claude Code through its MCP server to generate plain-English captions for each arrow in the sequence diagram. The test used Chris Greer's dns_full_recursion.pcapng file from his video "How DNS Works Under the Hood (Packet by Packet)."

Claude started from TCP samples, added five DNS templates, and validated them, matching all 33 frames. It read the flow before writing, rendering the diagram with each packet's field tree while examining all 33 frames, ensuring accuracy. However, it discovered a mistake: the 392 bytes for frame 23 were UDP length, while the DNS message was 384 bytes. The tool named servers from evidence, listing g.root-servers.net, g.gtld-servers.net, and ns5.infoblox.com based on the capture's glue records in frames 15, 19, and 23.

Its caption broke down the 159 ms lookup into steps: truncation and TCP retry at the root accounted for about 56 ms, making up more than a third of the total. The session took approximately six minutes and 14 VisualEther tool calls. The result was an annotated PDF, an interactive viewer with each packet's full field tree, and captions as a Markdown file with one section per frame.

The AI-generated captions were a draft, requiring expert review before publication. A reviewed walkthrough of the same capture is available at https://www.eventhelix.com/networking/dns-recursive-resolution/. To annotate your own capture, refer to Track 3 of VisualEther's getting-started guide.