diff --git a/gns3server/agent/gns3_copilot/tools_v2/packet_analysis_tool.py b/gns3server/agent/gns3_copilot/tools_v2/packet_analysis_tool.py
index 6a1a079c7..10a31e326 100644
--- a/gns3server/agent/gns3_copilot/tools_v2/packet_analysis_tool.py
+++ b/gns3server/agent/gns3_copilot/tools_v2/packet_analysis_tool.py
@@ -447,6 +447,13 @@ class PacketAnalysisTool(BaseTool):
                     logger.warning(f"tshark stderr: {result.stderr}")
 
             if not output.strip():
+                if "-c" in tshark_args:
+                    return json.dumps({
+                        "error": "No matching packets found",
+                        "hint": "The -c flag limits total packets READ, not matched results. "
+                                "Try removing -c so tshark scans the entire capture file. "
+                                'Use pipe to "head -N" to limit output instead.',
+                    })
                 return "No matching packets found"
 
             logger.info(f"tshark output: {len(output)} characters")