Agent skill · data analytics · yaklang
traffic-analysis-pcap
Traffic analysis and PCAP forensics playbook. Use when analyzing network captures including Wireshark filters, protocol analysis (HTTP/DNS/FTP/SMTP/USB/WiFi), data extraction, covert channel detection, PCAP repair, TLS decryption, and tshark command-line analysis.
Why this skill is useful
Adds executable scripts for PCAP repair and specific Wireshark filter commands that enhance network traffic analysis capabilities.
What it needs
Requires tshark, wireshark installed locally. About 6k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Traffic Analysis & PCAP — Expert Analysis Playbook AI LOAD INSTRUCTION: Expert traffic analysis and PCAP forensics techniques. Covers PCAP repair, Wireshark essential filters, protocol-specific analysis (HTTP, HTTPS/TLS, DNS, FTP, SMTP, USB HID, WiFi, ICMP), data extraction (file carving, credential harvesting, covert channels), NetworkMiner, and tshark CLI analysis. Base models miss USB keyboard decode patterns, DNS tunneling detection heuristics, and TLS decryption workflows. 0. RELATED ROUTING Before going deep, consider loading: memory-forensics-volatility for correlating memory artifacts with network traffic steganography-techniques for analyzing files extracted from traffic captures network-protocol-attacks for understanding attack patterns visible in captures reverse-shell-techniques for identifying shell traffic in captures --- 1. PCAP REPAIR --- 2. WIRESHARK ESSENTIAL FILTERS IP / Host Filters Protocol Filters TCP / Stream HTTP DNS TLS Content Search --- 3. PROTOCOL ANALYSIS HTTP — Follow Stream & Extract HTTPS / TLS Decryption DNS — Tunneling Detection FTP — Credential & File Extraction SMTP — Email Content Extraction USB — Keyboard HID Capture Decode WiFi — WPA Handshake ICMP — Data Exfiltration --- 4. DATA EXTRACTION File Carving Credential Harvesting Covert Channel Detection Indicators: DNS with long subdomains, ICMP with large payloads, HTTP with encoded headers, regular beacon intervals (C2). Use tshark -q -z io,stat,1 and -z conv,tcp for statistical anomaly detection. --- 5. NETWORKMINER --- 6. TSHARK COMMAND-LINE ANALYSIS --- 7. DECISION TREE
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/traffic-analysis-pcap