CLI Reference

pcapai · 35 command groups, 252 verbs

Generated from the shipped binaries — not written by hand.

`pcapai wifi`

Live Wi-Fi scan and BSSID location using PCAPAI backends

Verb	What it does
`pcapai wifi scan`	Scan using PCAPAI's platform Wi-Fi scanner (currently macOS)
`pcapai wifi connection`	Read the currently associated Wi-Fi interface (currently macOS)
`pcapai wifi details`	Fetch WiGLE address fields for an observed BSSID (candidate address, not verified premises)
`pcapai wifi locate`	Look up an observed BSSID; coordinates are database estimates, not measured GPS
`pcapai wifi adapters`	List the MediaTek MT7921/MT7925 USB Wi-Fi adapters PCAPAI can capture on (macOS)
`pcapai wifi capture`	Capture live frames from a USB Wi-Fi adapter into a pcapng (macOS; USB source only)

`pcapai convert`

Convert PCAP/PCAPNG files to PCAPAI format

`pcapai convert-batch`

Convert MANY PCAP/PCAPNG files to PCAPAI, several at a time

`pcapai dissect`

Dissect PCAP/PCAPNG files with full protocol analysis

`pcapai analyze`

Analyze packet files

`pcapai analyze-bundle`

Assemble the stable analysis bundle for a .pcapai as JSON (health report, capture summary, protocol hierarchy…

`pcapai reanalyze`

Rebuild the stored analysis inside a .pcapai file, in place

`pcapai filter`

Filter packets based on criteria

`pcapai desktop`

Launch desktop GUI

`pcapai performance`

Show performance metrics and reports

`pcapai parquet`

Parquet file operations

Verb	What it does
`pcapai parquet convert`	Convert PCAP/PCAPNG to optimized PCAPAI parquet format
`pcapai parquet info`	View parquet file information and statistics
`pcapai parquet view`	View packets from parquet file
`pcapai parquet validate`	Validate parquet file integrity
`pcapai parquet benchmark`	Benchmark parquet file performance

`pcapai netinsights`

PCAPAI NetInsights network inventory and topology tools

Verb	What it does
`pcapai netinsights license-status`	Show NetInsights license availability
`pcapai netinsights workspace`	Create or inspect NetInsights workspaces
`pcapai netinsights workspace create`	Create or initialize a NetInsights workspace directory
`pcapai netinsights workspace status`	Show NetInsights workspace status
`pcapai netinsights workspace encrypt`	Encrypt an existing plaintext workspace in place (backs up the database first)
`pcapai netinsights workspace delete`	Delete a workspace directory and remove its OS-keychain encryption key
`pcapai netinsights artifact`	Import, classify, or list raw evidence artifacts
`pcapai netinsights artifact import`	Import files, directories, and archives (.zip/.tgz/.tar/.gz) into the workspace artifact store.
`pcapai netinsights artifact list`	List imported artifacts
`pcapai netinsights artifact preview-safe`	Show a redacted text preview of an imported artifact
`pcapai netinsights artifact classify`	Classify artifacts and extract first-pass device identity facts
`pcapai netinsights inventory`	List or search inventory facts produced from artifacts
`pcapai netinsights inventory list`	List current devices built from classified artifacts
`pcapai netinsights inventory search`	Search current devices by identity, metadata, services, resources, or topology hints
`pcapai netinsights inventory interfaces`	List current interfaces built from classified artifacts
`pcapai netinsights inventory policy-tags`	policy tags with the SSIDs they carry and the VLAN each lands on — the C9800 equivalent of "AP group → SSID l…
`pcapai netinsights inventory site-tags`	site tags and their AP-join bindings
`pcapai netinsights inventory ssid-coverage`	Which APs broadcast an SSID
`pcapai netinsights inventory client-counts`	The aggregate client counts a Cisco C9800 show-tech carries — total clients, the 802.11 generation mix, the c…
`pcapai netinsights inventory rogue-clients`	The rogue-client inventory from `show wireless wps rogue client summary`
`pcapai netinsights inventory radios`	Wi-Fi radios (migration v26) — band, channel, width, tx power.
`pcapai netinsights inventory clients`	clients from the shared v28 tables, each joined with its newest sample
`pcapai netinsights inventory ip-addresses`	List current IP addresses built from classified artifacts
`pcapai netinsights inventory vlans`	List current VLAN facts built from classified artifacts
`pcapai netinsights inventory vlan-subnet-catalog`	List paged VLAN and subnet catalog records with canonical network derivation
`pcapai netinsights inventory neighbors`	List current LLDP/CDP neighbor facts built from classified artifacts
`pcapai netinsights inventory mac-table`	List current MAC table facts built from classified artifacts
`pcapai netinsights inventory arp-table`	List current ARP table facts built from classified artifacts
`pcapai netinsights inventory routes`	List current route facts built from classified artifacts
`pcapai netinsights inventory services`	List current service and control-plane feature facts built from classified artifacts
`pcapai netinsights inventory resource-profiles`	List current forwarding profile and resource capacity facts built from classified artifacts
`pcapai netinsights inventory topology-edges`	List current topology edges derived from neighbor, MAC, ARP, and route evidence
`pcapai netinsights inventory topology-edge-evidence`	List protocol evidence attached to current topology edges
`pcapai netinsights inventory topology-edge-detail`	Show both-sides detail for a single topology edge (link)
`pcapai netinsights inventory topology-neighborhood`	Show a bounded topology neighborhood around a device
`pcapai netinsights inventory topology-path`	Find a basic resolved topology path between two devices
`pcapai netinsights inventory topology-graph`	Export a scoped, renderable topology graph (nodes + edges, optional layout)
`pcapai netinsights inventory topology-override`	Add or list manual topology override records
`pcapai netinsights inventory topology-override add`	Add a manual topology override record
`pcapai netinsights inventory topology-override list`	List manual topology override records
`pcapai netinsights inventory refresh-topology-resolutions`	Refresh topology edge resolution using the latest device and IP facts
`pcapai netinsights device`	Show detailed inventory state for one device
`pcapai netinsights device show`	Show a device and its current interfaces, services, resources, and topology facts
`pcapai netinsights evidence`	Browse source evidence and current fact explanations
`pcapai netinsights evidence list`	List current fact evidence with source artifact links
`pcapai netinsights evidence device`	Show fact evidence, parser observations, and quality issues for one device
`pcapai netinsights evidence snippet`	Show a redacted source snippet around one parser observation
`pcapai netinsights config`	Store redacted config snapshots and compare config drift
`pcapai netinsights config snapshot`	Create, list, or show redacted config snapshots
`pcapai netinsights config snapshot create`	Create a redacted config snapshot from an imported artifact
`pcapai netinsights config snapshot list`	List redacted config snapshots
`pcapai netinsights config snapshot show`	Show one redacted config snapshot
`pcapai netinsights config template`	Save or list redacted intended config templates
`pcapai netinsights config template save`	Save or replace a redacted intended config template from a file
`pcapai netinsights config template list`	List config templates
`pcapai netinsights config compare`	Compare redacted configs and captured parsed facts
`pcapai netinsights config compare snapshots`	Compare two config snapshot IDs
`pcapai netinsights config compare devices`	Compare latest config snapshots for two devices
`pcapai netinsights config compare template`	Compare a config snapshot to a saved template
`pcapai netinsights config drift`	Detect drift against a template or previous snapshot
`pcapai netinsights data-quality`	Report missing, weak, stale, or conflicting data-quality states
`pcapai netinsights data-quality report`	Show derived data-quality summary and issue rows
`pcapai netinsights health`	Report assertion-style device, topology, and capacity health checks
`pcapai netinsights health report`	Show derived assertion and health-check results
`pcapai netinsights health infra`	Run the Infra Health engine (IC config + IL controller-log + IB baseline-drift) over the workspace's stored c…
`pcapai netinsights sources`	The workspace's sources (Ruckus One, SmartZone, SSH device group, watched folder): list, refresh now, add, re…
`pcapai netinsights sources list`	List the workspace's sources (last synced, status, counts) and any sources an older import left behind that c…
`pcapai netinsights sources choices`	For each fleet device: which of API, SSH and RESTCONF can feed this workspace, and in plain words why one can…
`pcapai netinsights sources refresh`	Pull from the workspace's sources now. Read-only on the source side; writes the pulled data into the workspac…
`pcapai netinsights sources add`	Add a source. Exactly one of --ruckus-one, --ssh-folder/--ssh-tag, --restconf-folder/--restconf-tag, --folder
`pcapai netinsights sources remove`	Remove a source. The data it pulled stays in the workspace
`pcapai netinsights sources adopt`	Confirm (or decline) a source proposed from an older import's artifacts
`pcapai netinsights aaa`	per-client AAA / join events and the per-WLAN AAA-path verdict from an imported SmartZone `debug → export log…
`pcapai netinsights export`	Export inventory, catalog, quality, and topology report datasets
`pcapai netinsights ai`	Prepare redacted AI extraction input and evidence-backed troubleshooting briefs
`pcapai netinsights ai prepare-extraction`	Prepare a bounded redacted artifact excerpt plus schema for AI extraction
`pcapai netinsights ai troubleshoot`	Build an evidence-backed troubleshooting brief for one device
`pcapai netinsights diagnostics`	Export a redacted parser-diagnostics report for remote debugging
`pcapai netinsights diagnostics export`	Write the redacted parser-diagnostics JSON report.
`pcapai netinsights geo`	Cellular layers: FCC filed coverage, towers, a device's own cells and fixes
`pcapai netinsights geo fetch`	Fetch public cellular data for a box into the workspace: FCC filed coverage (fcc) and OpenStreetMap towers (o…
`pcapai netinsights geo import-bugreport`	Store an Android bugreport's location fixes, serving cells and graded LTE levels
`pcapai netinsights geo extract-download`	Download the hosted OpenCelliD extract for each operator the stored serving cells use (or --plmn), verified b…
`pcapai netinsights geo locate-cells`	Place the stored serving cells from the cached OpenCelliD extracts, OFFLINE.
`pcapai netinsights geo layers`	List the stored layers: what each is, its licence, and what it cannot tell
`pcapai netinsights geo export`	Write one GeoJSON FeatureCollection per layer, licence and attribution attached
`pcapai netinsights bench`	Synthetic scale benchmark: generate N devices and measure import and query latency

`pcapai workspaces`

global workspaces — list, discover, inspect

Verb	What it does
`pcapai workspaces list`	List every known workspace and its live state
`pcapai workspaces discover`	Find workspaces on disk and add anything new to the list
`pcapai workspaces show`	Show one workspace's contents (captures, designs, logs, inventory)
`pcapai workspaces add`	Add a folder to the workspace list (it is never modified)
`pcapai workspaces forget`	Remove a workspace from the list. The folder and its contents are kept
`pcapai workspaces relocate`	Point a workspace at its new folder after it has been moved
`pcapai workspaces active`	Print or set the active workspace

`pcapai device-cards`

your own savable AP device cards, for models the bundled RUCKUS catalog does not have

Verb	What it does
`pcapai device-cards list`	List your saved device cards, with each band's provenance
`pcapai device-cards show`	Show one card in full
`pcapai device-cards add`	Add or update a card with a hand-entered peak gain
`pcapai device-cards import-antenna`	Import a vendor antenna file (MSI / Planet `.msi` / `.pln` / `.ant`) onto a card.
`pcapai device-cards remove`	Delete a card

`pcapai antenna`

The Antenna Designer's solver and evolution, headless

Verb	What it does
`pcapai antenna evolve`	Evolve a wire antenna with the Antenna Designer's solver and write the design JSON

`pcapai planner`

Wi-Fi Planner designs — build a plan from what a workspace already knows

Verb	What it does
`pcapai planner new-from-workspace`	Build an OpenIntent plan from a workspace's floor plans and AP positions
`pcapai planner planned-vs-deployed`	Compare the designs published in a workspace with the APs it observes: deployed, planned but not observed, pl…
`pcapai planner sync`	Compare an OPEN plan (an OpenIntent file) with what its workspace observes now, and optionally apply the diff…
`pcapai planner import-esx`	Convert Ekahau `.esx` files into OpenIntent plans, one per BUILDING
`pcapai planner coverage-report`	Render a saved plan's coverage report, headless
`pcapai planner bom`	Render a saved plan's bill of materials and PoE budget
`pcapai planner field-pack`	Write the installer's field pack for a saved plan

`pcapai fleet`

Fleet SSH automation: device inventory, login profiles, runbooks, runs, firmware upgrades

Verb	What it does
`pcapai fleet import-text`	Import devices from a plain text list (one host[:port] per line)
`pcapai fleet import-csv`	Import devices from a CSV (auto-maps host/name/vendor/...
`pcapai fleet import-netinsights`	Import devices from a NetInsights workspace (pre-enriched inventory)
`pcapai fleet devices`	List/search the device inventory
`pcapai fleet profiles`	Manage login profiles (credential sets)
`pcapai fleet profiles list`	List login profiles
`pcapai fleet profiles add`	Add a login profile. --auth: password \
`pcapai fleet profiles set-password`	Store the password for a profile (reads one line from stdin)
`pcapai fleet profiles set-enable-secret`	Store the enable secret for a profile (reads one line from stdin).
`pcapai fleet profiles set-enable-mode`	Change a profile's enable (privileged-exec) mode without touching its secrets.
`pcapai fleet profiles delete`	Delete a login profile (and its keychain secrets)
`pcapai fleet runbooks`	List saved runbooks
`pcapai fleet validate`	Validate a runbook YAML file (structure, expressions, read-only classifier)
`pcapai fleet run`	Run a runbook (read-only by default; explicit reviewed writes supported)
`pcapai fleet results`	Show run results (defaults to the most recent run)
`pcapai fleet upgrade`	Upgrade ONE device's firmware (Ruckus ICX): serve the image over TFTP to that device only, `copy tftp flash`,…
`pcapai fleet restconf`	RESTCONF to a device over HTTPS with its login profiles: list operations, GET; PATCH/POST only with --approve…
`pcapai fleet restconf operations`	List the operations the device offers (GET /restconf/operations)
`pcapai fleet restconf get`	GET a data path, e.g. `restconf-state`, `openconfig-lldp:lldp/interfaces` or `data/...`
`pcapai fleet restconf patch`	PATCH (merge) a data path. JSON body from --data (or @file)
`pcapai fleet restconf post`	POST (create, or invoke an operation under operations/).
`pcapai fleet restconf forget-cert`	Forget the recorded certificate for this device (after you verified a changed one)
`pcapai fleet rerun-failed`	Re-run only the failed devices of a previous run
`pcapai fleet cancel`	Cancel an active run

`pcapai ssh`

SSH client utilities: host-key trust store and file transfer

Verb	What it does
`pcapai ssh known-hosts`	Manage the SSH host-key trust store (ssh_known_hosts.json)
`pcapai ssh known-hosts list`	List every trusted host key
`pcapai ssh known-hosts show`	Show the trusted key for one host (host, host:port, or [v6]:port)
`pcapai ssh known-hosts probe`	Fetch and print the host key a device is currently offering (no auth)
`pcapai ssh known-hosts approve`	Trust the key a device is currently offering, replacing any previous one
`pcapai ssh known-hosts remove`	Forget a trusted host key (the next connect re-does trust-on-first-use)
`pcapai ssh known-hosts import`	Import host keys from an OpenSSH known_hosts file.
`pcapai ssh known-hosts export`	Export the trusted host keys as an OpenSSH known_hosts file (entries whose whole key is held; fingerprint-onl…
`pcapai ssh keys`	SSH keys: create, list, import, export the public half, and plan installing one on a device family (plans onl…
`pcapai ssh keys generate`	Create a key pair: ed25519 (default), rsa3072 (older devices) or rsa4096.
`pcapai ssh keys list`	List the keys in the vault
`pcapai ssh keys audit`	Key hygiene (K5), read-only: which devices each key reaches (through login profiles and recorded installs) an…
`pcapai ssh keys show`	Show one key (by name, id or SHA256 fingerprint)
`pcapai ssh keys import`	Add an existing key by its file (the .pub, or the private file: only its public half is read; the private fil…
`pcapai ssh keys scan`	List the public keys in a folder (default ~/.ssh).
`pcapai ssh keys export-public`	Print a key's public half: openssh (one line), rfc4716 (SSH2, for Ruckus ICX) or body
`pcapai ssh keys recipes`	List install recipes, or show one family's help page
`pcapai ssh keys plan-install`	Plan installing a key on a device family: the install runbook, the verify step, the save runbook, the key fil…
`pcapai ssh tunnel`	Forward a local port to a host:port reachable from a saved device (ssh -L).
`pcapai ssh copy-id`	Install a public key in a Linux/OpenSSH device's authorized_keys.
`pcapai ssh exec`	Run ONE command on a saved fleet device (its login profiles; no password typed) and exit with the remote exit…
`pcapai ssh logs`	Read a detached job's output (`ssh exec --detach`): `--tail N`, `--follow`, `--stderr`
`pcapai ssh job`	Detached jobs started from this machine: list, status, kill
`pcapai ssh job list`	Jobs started from this machine, newest first
`pcapai ssh job status`	Is the job running, and how did it end
`pcapai ssh job kill`	Stop the job's command (SIGTERM)
`pcapai ssh ls`	List a remote directory over SFTP
`pcapai ssh get`	Download a file FROM the device to this machine
`pcapai ssh put`	Upload a file TO the device from this machine

`pcapai console`

Serial / USB-serial console: list ports, probe a cable, run read-only commands over a console when SSH cannot…

Verb	What it does
`pcapai console list`	List serial ports (USB-serial console adapters first).
`pcapai console probe`	Open a console, press Enter, and report what the device is showing.
`pcapai console run`	Run read-only commands over a console and print their output

`pcapai serve`

Serve a folder over TFTP, FTP, SFTP, HTTP or HTTPS on a selected local address.

Verb	What it does
`pcapai serve start`	Start any supported protocol on an explicitly selected local address
`pcapai serve tftp`	Serve a folder over TFTP so a switch or AP can pull firmware from this machine and push its configuration back
`pcapai serve interfaces`	List the addresses a listener can bind on this machine
`pcapai serve protocols`	List available file-transfer protocols and their standard ports
`pcapai serve ports`	Explain what binding a given port costs on each operating system

`pcapai throughput`

Throughput test (iperf3 protocol): run a client test against a server, or listen as one

Verb	What it does
`pcapai throughput client`	Run a test against a server (the side that dials).
`pcapai throughput server`	Listen for tests from a client (the side that waits).
`pcapai throughput engines`	Show which engines this build can run, and why one cannot

`pcapai scan`

Network scans: TCP Connect() port scan of explicit targets (private/LAN by default)

Verb	What it does
`pcapai scan ports`	TCP Connect() port scan of explicit targets (no root, no raw sockets).

`pcapai snmp`

SNMP: get, walk, bulkwalk, set (needs --approve-writes) and diff for v1/v2c/v3 agents

Verb	What it does
`pcapai snmp get`	GET one or more OIDs
`pcapai snmp getnext`	GETNEXT one or more OIDs
`pcapai snmp walk`	Walk a subtree with GETNEXT (any SNMP version)
`pcapai snmp bulkwalk`	Walk a subtree with GETBULK (v2c / v3)
`pcapai snmp set`	SET values. Prints the request and sends nothing unless --approve-writes
`pcapai snmp diff`	Compare two walks (saved profiles and/or `walk --json` files): objects on one side only and objects whose val…
`pcapai snmp profile`	Manage saved SNMP targets (secrets go to the OS keychain)
`pcapai snmp profile save`	Save (or replace) a target. Secrets are read from the named environment variables and stored in the OS keycha…
`pcapai snmp profile list`
`pcapai snmp profile delete`

`pcapai oui`

Look up the vendor for MAC addresses or OUI prefixes in the embedded IEEE registry (offline)

`pcapai ping`

Ping ONE host (bounded count; LAN, loopback and private targets unless --allow-public)

`pcapai traceroute`

Traceroute to ONE host (LAN, loopback and private targets unless --allow-public)

`pcapai subnet`

Calculate an IPv4 subnet: mask, wildcard, broadcast, usable range, and an optional split (offline)

`pcapai myip`

Show this machine's interfaces, addresses, DNS servers and routes; --public adds the address the internet sees

`pcapai carrier`

Carrier & Identity lookups: RCOIs (OpenRoaming and the published table) and PLMN operators (offline)

Verb	What it does
`pcapai carrier rcoi`	List or search the 58 published RCOIs (empty query lists all)
`pcapai carrier decode`	Decode RCOIs: match the published table and read OpenRoaming policy bits
`pcapai carrier build`	Build an OpenRoaming RCOI from policy choices (unknown choices are refused, not clamped)
`pcapai carrier plmn`	Look up operators by MCC/MNC (310-410, 310410) or by operator or country name
`pcapai carrier cell-grade`	Grade a cellular received level using operator or Android thresholds
`pcapai carrier arfcn`	Convert an LTE EARFCN or NR-ARFCN using core's cellular raster
`pcapai carrier cell-tower`	Look up a cell only in the local verified OpenCelliD extract (offline)

`pcapai goto`

Test Go-to-Packet jump scrolling performance on a .pcapai file

`pcapai export`

Export a .pcapai back out to pcap/pcapng or dissection formats (Wireshark-style)

`pcapai notes`

Wireshark-style capture/packet comments + capture provenance in a .pcapai

Verb	What it does
`pcapai notes show`	Show capture comment, capture method/provenance, and packet comments
`pcapai notes set-packet`	Set (replace) a packet's comment
`pcapai notes remove-packet`	Remove a packet's comment
`pcapai notes set-capture`	Set the capture-level (file) comment
`pcapai notes set-method`	Set the capture method / provenance (e.g.

`pcapai dns`

DNS analyzer: transactions, servers, sites, health, security, name resolution

Verb	What it does
`pcapai dns summary`	Capture-wide DNS totals, variant mix, latency, rcode/qtype histograms
`pcapai dns servers`	Per-server stats: query/response counts, latency, classification
`pcapai dns sites`	Site/domain inventory (eTLD+1 rollup)
`pcapai dns transactions`	Individual DNS transactions (recomputed live from the capture)
`pcapai dns health`	DNS health report (checks, per-server/per-client grades, QoE)
`pcapai dns security`	DNS security findings (Pro). Requires the SecurityScanner license feature
`pcapai dns resolve`	Resolve an IP to its best passive-DNS name, or a name to its IPs
`pcapai dns lookup`	Look a name up NOW through this machine's resolver (A, AAAA, MX, TXT, NS, SOA, CNAME, PTR, NAPTR, SRV, WHOIS,…

`pcapai services`

Persisted DNS, DHCP, router advertisement and captive portal evidence

Verb	What it does
`pcapai services summary`	Network inventory and persisted coverage
`pcapai services details`	Complete paged observations; pass next_offset to continue

`pcapai merge`

find captures that are plausibly one event, and merge the ones you confirm.

Verb	What it does
`pcapai merge detect`	Propose merge groups. Read-only — nothing is merged, nothing is written
`pcapai merge run`	Merge captures into one pcapng. Explicit file list — this never acts on a proposal by itself