From 9c23f9037c506d6fec47487f8e8f285c5f64e617 Mon Sep 17 00:00:00 2001
From: YueGuobin <yueguobin@outlook.com>
Date: Tue, 12 May 2026 14:00:58 +0800
Subject: [PATCH] fix: document -c behavior caveat in PacketAnalysisTool
 description

---
 .../agent/gns3_copilot/tools_v2/packet_analysis_tool.py      | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/gns3server/agent/gns3_copilot/tools_v2/packet_analysis_tool.py b/gns3server/agent/gns3_copilot/tools_v2/packet_analysis_tool.py
index f46d447da..cf81f5937 100644
--- a/gns3server/agent/gns3_copilot/tools_v2/packet_analysis_tool.py
+++ b/gns3server/agent/gns3_copilot/tools_v2/packet_analysis_tool.py
@@ -81,7 +81,10 @@ class PacketAnalysisTool(BaseTool):
         -T fields         Tab-separated field output
         -e <field>        Extract field (use multiple -e for multiple fields)
         -T json           JSON output
-        -c <count>        Limit packet count
+        -c <count>        Limit packets READ (not matched count). Since -c limits
+                          total packets scanned, it can hide results when used
+                          with -Y. Prefer piping to head -10 or rely on -Y
+                          alone instead.
     """
 
     def _run(