How a 140M Protocol-Aware Model Outperformed Trillion-Parameter LLMs

Almost two years ago at Cisco Meraki, we set out on an ambitious research effort: could we make zero-touch predictive network troubleshooting a reality? Our primary target was elevating the AI PCAP Analyzer (now Generally Available in the Meraki Dashboard) from a manual packet dissector into an intelligent, sequence-predictive foundation model.

When network issues occur (such as sudden client disconnects, DHCP negotiation hangs, or roaming stalls), packet captures (PCAPs) contain ground truth. However, human analysis of PCAPs is tedious, highly technical, and difficult to scale across millions of live enterprise networks.

The Tokenization Wall

Our first intuition seemed obvious: convert PCAP files into standardized text markup (Packet Details Markup Language, or PDML) and feed them directly into modern generative language models using standard Byte-Pair Encoding (BPE) tokenizers like tiktoken.

The outcome was disappointing. The models struggled with basic packet syntax, frequently hallucinating invalid hexadecimal fields and missing simple handshake progressions. We took all the textbook machine learning remedies:

• We enhanced dataset quality and stripped corrupted frames.
• We scaled up the training dataset by orders of magnitude across diverse enterprise topologies.
• We increased model depth, widened attention dimensions, and adjusted warmup schedules.
• We ran extensive hyperparameter sweeps across learning rates and batch sizes.

Still, the model hit a hard performance ceiling.

Protocol-Aware Tokenization from First Principles

We asked a fundamental question: can we make the tokenizer protocol-aware?

We redesigned tokenization from first principles to mirror the hierarchical state machine of 802.11 frames. Instead of chopping raw characters, the tokenizer respects frame boundaries, protocol headers, information elements (IEs in TLV format), sequence numbers, and management frame subtypes as unified semantic tokens.

The result was transformative. With a modest 140M parameter GPT-2 style architecture trained on protocol-aware tokens:

• The model began outperforming multi-trillion parameter state-of-the-art frontier models on packet sequence completion, root-cause localization, and anomaly detection.
• Token sequence length contracted by over 3x, dramatically lowering memory footprint and training latency.
• On zero-shot wireless anomaly classification, PLUME achieved 94.2% diagnostic accuracy, whereas frontier generalist LLMs achieved under 78% while hallucinating invalid 802.11 reason codes.

"Build your own AI models, but build them data-natively. When you design the model from first principles and keep native domain semantics central to the architecture, a 140M parameter model can comfortably outperform a multi-trillion parameter generalist."

From Research Paper to Enterprise Production

This work, detailed in our research paper (arXiv:2603.13647), is a collaboration with Shazal Irshad and Jerome Henry, alongside our broader Cisco Meraki engineering team including Rajat Mehrotra, Salvatore Valenza, Qinghai Gao, Vishal Desai, Amine Choukir, Stefano Ferrari, Giacomo Trifilo, MinSe Kim, and many others.

Today, these insights directly power Cisco Meraki's AI PCAP Analyzer in production, diagnosing complex connectivity issues across enterprise networks around the world in seconds instead of hours.

The takeaway for applied AI research extends far beyond networking: whenever you work with structured, non-linguistic physical data (whether wireless signals, acoustics, sensor feeds, or telemetry), do not force your data into generic text molds. Build data-natively, respect the physics of your domain, and you will unlock unprecedented accuracy and efficiency.