skills.rest
BrownFineSecurity
BrownFineSecurityOFFICIAL
Explore all skills by this author →
WebsiteGitHub

netflows

Extract TCP and UDP flows from pcap files with DNS hostname resolution.

824|126|Updated Nov 17, 2025
Search Tags:#iot security#packet capture#traffic analysis#forensics#pcap#dns resolution#network flows
One-click install
npx skills add https://github.com/BrownFineSecurity/iothackbot --skill netflows
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: netflows
Source: https://github.com/BrownFineSecurity/iothackbot/tree/main/skills/netflows
Command: npx skills add https://github.com/BrownFineSecurity/iothackbot --skill netflows

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Analyzing packet captures to understand what external hosts an IoT device communicates with is tedious when done manually. This Skill automates the extraction of unique network flows from pcap/pcapng files and resolves IP addresses to hostnames using DNS responses found within the same capture.

Core Features & Use Cases

  • Flow Extraction: Enumerates unique TCP and UDP destination IP:port pairs from one or more packet capture files.
  • Automatic DNS Resolution: Builds a DNS mapping table from responses inside the capture to resolve IPs to hostnames without external lookups.
  • Source IP Filtering & Output Formats: Filter flows by a specific device IP and export results as colored text, JSON, or a minimal hostname:port list.
  • Use Case: During an IoT security assessment, capture traffic from a smart camera, then run netflows filtered by the camera's IP to enumerate every cloud service, telemetry endpoint, and potential C2 server it contacts.

Quick Start

Analyze the file iot-capture.pcap with netflows and show me all network destinations contacted by the device at 192.168.1.50.

Frequently Asked Questions about netflows

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract network flows from a pcap file?▼

Run netflows with the pcap file path as an argument, such as netflows capture.pcap. The tool lists unique TCP and UDP destination IP:port pairs and resolves IPs to hostnames using DNS responses found in the same capture.

How to identify what hosts an IoT device communicates with?▼

Capture the device's traffic into a pcap file, then run netflows with the --source-ip flag set to the device's IP address. The output summarizes every destination hostname and port the device contacted, including cloud services and telemetry endpoints.

Does netflows support pcapng files and multiple captures?▼

Yes, netflows accepts both pcap and pcapng formats. You can pass multiple capture files in a single command, and the tool will analyze flows across all of them together.

Why do some IP addresses show as unresolved in pcap analysis?▼

Netflows resolves hostnames only from DNS responses present within the same capture file. If the device did not perform a DNS lookup for an IP during the capture window, that IP appears as unresolved and may need external investigation.

Can I get pcap flow data as JSON for scripting?▼

Yes, use the --format json flag to get machine-readable output containing dns_mappings, tcp_flows, udp_flows, flow_summary, dns_queries, and total packet counts. A quiet format is also available for a minimal hostname:port list.

Related Skills

Explore More Software Engineering Skills→
zhinkgitzhinkgit
551

net

Capture and analyze network traffic for embedded devices with tshark.

Community
Advanced
AcczdyAcczdy
2

conducting-network-penetration-test

Automate authorized network penetration testing with Nmap NSE scripts and reporting.

Community
Advanced
UseAI-proUseAI-pro
70

network-watcher

Audit OpenClaw skill network requests for exfiltration and unauthorized API calls.

Official
Advanced
jcastillotxjcastillotx

Wireshark Network Traffic Analysis

Capture, filter, and inspect packets from live captures or PCAP files.

Community
Intermediate