Agent skill · security · aiskillstore
analysis-tshark
Network protocol analyzer and packet capture tool for traffic analysis, security investigations, and forensic examination using Wireshark's command-line interface. Use when: (1) Analyzing network traffic for security incidents and malware detection, (2) Capturing and filtering packets for forensic analysis, (3) Extracting credentials and sensitive data from network captures, (4) Investigating network anomalies and attack patterns, (5) Validating encryption and security controls, (6) Performing protocol analysis for vulnerability research.
Why this skill is useful
Provides specific commands and workflows for using TShark in network analysis and security investigations that the AI wouldn't reliably generate on its own.
What it needs
Requires python3, tcpdump, tshark, wireshark installed locally. About 10k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
TShark Network Protocol Analyzer Overview TShark is the command-line network protocol analyzer from the Wireshark project. It provides powerful packet capture and analysis capabilities for security investigations, forensic analysis, and network troubleshooting. This skill covers authorized security operations including traffic analysis, credential extraction, malware detection, and forensic examination. IMPORTANT: Network packet capture may expose sensitive information and must only be conducted with proper authorization. Ensure legal compliance and privacy considerations before capturing network traffic. Quick Start Basic packet capture and analysis: Core Workflow Network Analysis Workflow Progress: [ ] 1. Verify authorization for packet capture [ ] 2. Identify target interface and capture requirements [ ] 3. Capture network traffic with appropriate filters [ ] 4. Analyze captured packets for security indicators [ ] 5. Extract artifacts (files, credentials, sessions) [ ] 6. Document findings and security implications [ ] 7. Securely handle and store capture files [ ] 8. Clean up sensitive data per retention policy Work through each step systematically. Check off completed items. 1. Authorization Verification CRITICAL: Before any packet capture: Confirm written authorization for network monitoring Verify legal compliance (wiretapping laws, privacy regulations) Understand data handling and retention requirements Document scope of capture (interfaces, duration, filters) Ensure secure storage for captured data 2. Interface Discovery Identify available network interfaces: Interface types: eth0/ens33: Ethernet interface wlan0: Wireless interface lo: Loopback interface any: All interfaces (Linux only) mon0: Monitor mode interface (wireless) 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/analysis-tshark