Analyze PCAP network traffic with Linux tools for incident response.
npx skills add https://github.com/copyleftdev/sk1llz --skill forensics-team
Please help me install this Agent Skill. Skill: forensics-team Source: https://github.com/copyleftdev/sk1llz/tree/main/specialists/security/forensics-team Command: npx skills add https://github.com/copyleftdev/sk1llz --skill forensics-team
This Skill provides an expert-level analysis of network traffic (PCAP) and security incidents, enabling the identification of temporal patterns, attack types, and attribution with the rigor of an elite forensics team.
Act as the Lead Forensic Analyst and analyze the provided PCAP snippet surrounding the alert time, focusing on raw packet data and Layer 3/4 anomalies.
High-intent search queries and answers about installing and using this skill.
Deep packet analysis for incident response involves dissecting raw PCAP data from the OSI layer outward using tcpdump to identify temporal patterns, attack types, and C2 channels for security investigations.
Reconstructing a breach timeline from network traffic requires analyzing temporal patterns in PCAP data, correlating network layer anomalies with application artifacts like HTTP headers, and dissecting packets across OSI layers for precise attribution.
To identify a web shell attempt in PCAP data, examine HTTP headers for base64 encoded commands and correlate those application layer artifacts with underlying network layer anomalies across the OSI model.
Yes, PCAP forensics requires expertise in tcpdump and the OSI model to perform artifact correlation, native command-line analysis, and Layer 3/4 anomaly detection required for rigorous incident response and threat attribution.
Standard native Linux command-line tools like tcpdump work best for deep packet analysis, enabling efficient and reliable reconstruction of breach timelines and identification of command-and-control channels directly from raw PCAP data.
JingyueCongAnalyze PCAP files to identify communication issues and security anomalies.
coreymayprayAutomate evidence collection, timeline reconstruction, and artifact analysis from memory, disk, log, and network data.
StamusNetworksIdentify high-priority threats in PCAP and Suricata EVE JSON network traffic.
AgentSecOpsAnalyze network traffic and protocol behavior with Tshark for security investigations.
