Use after open_capture to retrieve deterministic DNS transaction findings with packet-number evidence.

Use after open_capture to retrieve deterministic TCP flow findings with packet-number evidence, optionally for a single conversation.

Use after open_capture to inspect up to 50 explicit 1-based packet numbers; only allowlisted headers and payload lengths are returned.

Use after open_capture to enumerate largest-first TCP or UDP conversations, directional packet and byte counts, and supporting packet numbers.

Use this first to load exactly one attached or root-confined PCAP/PCAPNG into FrameCite's bounded, payload-redacted cache.

Use after open_capture for capture health, TCP, DNS, and classified ICMP path findings with packet-number evidence.