skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-network-traffic-analysis-with-arkime

Query Arkime full packet capture data to detect beaconing, DNS tunneling, and TLS anomalies.

954|172|Updated Mar 13, 2026
Search Tags:#threat hunting#network traffic analysis#packet capture#pcap#dns tunneling#beaconing detection#arkime
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-network-traffic-analysis-with-arkime
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-network-traffic-analysis-with-arkime
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-security/implementing-network-traffic-analysis-with-arkime
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-network-traffic-analysis-with-arkime

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, and includes scripts (resource) components.

What problem does it solve?

Security teams need to analyze captured network traffic to find command-and-control beaconing, DNS tunneling, and suspicious TLS certificates, but manually searching Arkime sessions and downloading PCAPs is slow and error-prone.

Core Features & Use Cases

  • Session Search via Arkime API v3: Query captured sessions by IP, port, protocol, or Arkime expression and download PCAP data for forensic analysis.
  • Beaconing Detection: Analyze connection intervals and jitter to flag C2 beaconing behavior, such as 288 sessions roughly 300 seconds apart to a single destination.
  • DNS and TLS Analysis: Identify DNS tunneling through query length statistics and flag connections to known-bad TLS certificate issuers.
  • Use Case: A SOC analyst suspects a compromised host on 10.1.2.50; the agent queries Arkime, finds periodic 443 connections to 185.220.101.34 with 4.2% jitter, and reports a high-confidence C2 beaconing verdict.

Quick Start

Run the agent script with your Arkime viewer URL and credentials to search sessions, detect beaconing, and write the findings to arkime_report.json.

Frequently Asked Questions about implementing-network-traffic-analysis-with-arkime

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect C2 beaconing with Arkime?▼

Query Arkime sessions for a source host and analyze inter-connection intervals and jitter. A high-confidence beacon shows a tight interval with low jitter, such as 288 sessions about 300 seconds apart to one IP on port 443 with jitter under 5%.

How to search Arkime sessions using the API?▼

Send a GET request to /api/sessions with an expression parameter filtering by IP, port, or protocol. A successful query returns HTTP 200 with a non-zero recordsTotal, and you can then download the matching PCAP for payload analysis.

Why does Arkime return empty results for known traffic?▼

Empty results usually mean capture drops or snaplen truncation, not clean traffic. Check the stats page for non-zero dropped or overload counters, verify full-payload capture on a known session, and confirm NTP time sync across capture nodes.

Can Arkime detect DNS tunneling in captured traffic?▼

Yes, the agent analyzes DNS query length statistics across captured sessions to flag tunneling patterns. Unusually long or high-entropy query names to a single domain indicate possible data exfiltration over DNS.

What are the limitations of beaconing detection by interval analysis?▼

Strict jitter thresholds miss jittered C2 implants, while loose thresholds false-positive on NTP or AV update polls. Validate thresholds against a known-good periodic host and confirm a consistent destination before alerting.

Related Skills

Explore More Software Engineering Skills→
TrossitecTrossitec
1

wrap-up-ritual

Capture completed work, pending tasks, and learnings into .claude/handoff.md.

Official
Intermediate
YukiIto1999YukiIto1999

analyzing-docker-container-forensics

Analyze Docker container images, layers, volumes, logs, and runtime artifacts for malicious activity.

Community
Advanced
Muath2000Muath2000

threat-intel-engineer

Integrate, normalize, and correlate cyber threat data from STIX/TAXII feeds.

Community
Advanced
GhostPWNGhostPWN
4

Network Security & Traffic Analysis

Analyze PCAP files and firewall configurations to generate Suricata, Snort, and Zeek detection rules.

Official
Advanced