TraceCodec: A Compiler-Backed Neural Codec for Network Traffic Traces

Abstract

Critical networking workflows require high-fidelity packet captures (PCAPs) for testing, security analysis, and protocol validation, not just statistical flow-level summaries. Recent packet generators have demonstrated protocol-constrained PCAP synthesis, but many operate on raw or near-raw packet representations. These representations can entangle learned behavioral choices with deterministic protocol rules and make packet correctness depend on post-hoc repair. We identify the decode interface as a key bottleneck and present TraceCodec, a compiler-backed neural codec for stateful multi-flow traces. TraceCodec lifts each parsed packet into a timed packet action with explicit flow slots and transport cues, learns a continuous per-packet latent, and uses a state-aware deterministic compiler to decode actions to PCAPs while managing endpoint assignment, TCP sequence and acknowledgment state, declared compatibility constraints, and packet rendering. On CICIDS2017 Monday, TraceCodec matches packet count, protocol composition, and flow population to within 0.03%; raw-field baselines produce substantially larger flow-count and TCP-event errors under the same non-repair policy. In a matched flow-matching continuation setup, TraceCodec yields complete decoded suffixes in 100% of CICIDS2017 cases and 98.44% of MAWI cases, versus at most 10.94% for raw-field latent controls. Structural diagnostics further show that TraceCodec preserves TCP transitions and multi-flow interleaving. Together, these results support TraceCodec as a generator-facing latent interface with a deterministic path back to usable packet traces.