net

Capture and analyze network traffic for embedded devices with tshark.

551|66|Updated Apr 10, 2026
One-click install
npx skills add https://github.com/zhinkgit/embeddedskills --skill net-zhinkgit
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: net
Source: https://github.com/zhinkgit/embeddedskills/tree/main/net
Command: npx skills add https://github.com/zhinkgit/embeddedskills --skill net-zhinkgit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Embedded developers and testers often need to discover interfaces, capture packet traces, and analyze pcap files to diagnose connectivity, protocol, or interoperability issues, but that work is manual, error-prone, and interrupts development loops. This skill centralizes interface discovery, live capture, offline pcap analysis, connectivity checks, port scanning, and traffic statistics so AI or tooling can perform network debugging reliably.

Core Features & Use Cases

  • Interface discovery: list OS interfaces and map them to tshark capture indices for accurate capture selection.
  • Live capture: run timed captures with BPF/display filters and save in pcap/pcapng formats, with optional JSON Lines streaming.
  • Offline analysis: produce protocol distributions, conversations, endpoints, IO stats, and anomaly detection using tshark and capinfos.
  • Connectivity & scanning: ICMP/TCP ping, traceroute, concurrent port scanning with optional banner grabs for embedded targets.
  • Traffic statistics: timed IO/stat aggregation and protocol/endpoint summaries for validation and regression checks.
  • Use case: capture 30s of traffic from a device under test, analyze protocols and anomalies, then run a port scan against the device to identify exposed embedded services.

Quick Start

Capture 30 seconds of traffic on the target interface, save as trace.pcapng, and analyze protocols and anomalies in JSON output.

Frequently Asked Questions about net

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I capture network traffic from embedded devices for debugging?

To capture network traffic from embedded devices, you can run timed live captures using tshark with BPF or display filters, saving the output in pcap or pcapng formats for further analysis and connectivity diagnosis.

What is the best way to analyze offline pcap files for embedded firmware troubleshooting?

Analyzing offline pcap files for embedded firmware troubleshooting involves using tshark and capinfos to extract protocol distributions, conversations, IO statistics, and detect anomalies to identify connectivity or interoperability issues.

How do I discover available network interfaces and map them to tshark capture indices?

Discovering available network interfaces and mapping them to tshark capture indices is done through interface discovery, which lists OS interfaces and accurately matches them to their corresponding tshark capture selections.

Can I perform concurrent port scanning and banner grabs against embedded targets?

Yes, you can perform concurrent port scanning against embedded targets with optional banner grabs, alongside ICMP and TCP probing, to identify exposed embedded services and diagnose connectivity issues.

How do I get protocol distributions and traffic statistics from a pcap trace?

To get protocol distributions and traffic statistics from a pcap trace, the skill aggregates timed IO and traffic stats using tshark, generating protocol and endpoint summaries in JSON-structured outputs for validation and regression checks.

Does tshark work with JSON Lines streaming during a live network capture?

Yes, tshark supports JSON Lines streaming during live network captures, allowing you to run timed captures with BPF filters and output real-time traffic data alongside standard pcap or pcapng file formats.