Reconstructing cyber incidents from network traffic captures remains a critical challenge in digital forensics, requiring specialized expertise with deep protocol knowledge to correlate malicious activities and establish attack timelines. Although Large Language Models (LLMs) show promising capabilities for interpreting vast amounts of security data, current implementations rely heavily on cloud-based proprietary services, posing serious privacy risks for sensitive forensic investigations. This study presents a privacy-preserving framework that combines external threat intelligence sources and leverages locally deployed open-source LLMs that allow security analysts to query malware packet captures via conversational interfaces. It offers two analysis approaches: direct query analysis (Option 1) using high-level PCAP summaries and an RAG-enhanced approach (Option 2) that converts PCAP artifacts and VirusTotal indicators into vector embeddings and stores them in a local vector database for secure and efficient querying. The framework was tested using four open-source LLMs, Llama3.1-7B, Llama3-chatqa-8B, Mistral-7B, and Mistral-nemo-12B, in both deployment options, all running locally on a single consumer-grade GPU workstation. Evaluations were conducted using two real-world malware samples, RedLine Stealer and Gozi/ISFB, to answer four fundamental forensic questions: identifying the infected client’s IP address, MAC address, hostname, and user account. Direct analysis (Option 1) without retrieval achieved only 25% accuracy for all the models. In contrast, RAG-enhanced analysis (Option 2) using nomic-embed-text improved the accuracy of the best-performing models, Llama3.1-7B and Mistral-nemo-12B, to 62.5%, representing a 37.5 percentage-point improvement over Option 1. However, switching to mxbai-embed-large caused most models to drop back to 25% accuracy, revealing that the embedding model selection critically affects the retrieval effectiveness for network protocol data. This study shows that smaller open-source LLMs, when combined with appropriate embedding models and vector databases, can meaningfully assist in traffic-based incident reconstruction while preserving complete data privacy.