skills.rest
SherifEldeeb
SherifEldeebCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

network-forensics

Analyze PCAP, PCAPNG, and NetFlow captures for forensic network investigations.

5|Updated Jan 12, 2026
Search Tags:#analyze#PCAP#threat-hunting#network-forensics#NetFlow#session-reconstruction#C2-detection
One-click install
npx skills add https://github.com/SherifEldeeb/agentskills --skill network-forensics
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: network-forensics
Source: https://github.com/SherifEldeeb/agentskills/tree/main/skills/forensics/network-forensics
Command: npx skills add https://github.com/SherifEldeeb/agentskills --skill network-forensics

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill enables security teams to analyze network captures and flows to identify exfiltration, command-and-control activity, lateral movement, and other post-compromise behaviors across PCAP, PCAPNG, and NetFlow data.

Core Features & Use Cases

  • PCAP/NetFlow analysis and session reconstruction to map network activity
  • Protocol analysis and threat detection for C2 communications, DNS tunneling, and data exfiltration
  • File extraction from network traffic and reconstruction of sessions for incident reporting
  • Quick scenarios: when investigating a suspected data breach, load the capture and generate a summary of endpoints, protocols, and anomalies

Quick Start

analyzer = PcapAnalyzer('/path/to/capture.pcap') stats = analyzer.get_statistics() reconstructor = SessionReconstructor(analyzer) sessions = reconstructor.get_tcp_sessions() http = HTTPAnalyzer(analyzer) requests = http.get_requests()

Frequently Asked Questions about network-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze PCAP files to detect command-and-control communications?▼

Analyze PCAP files to detect C2 communications by parsing network traffic captures to identify anomalies, map session reconstruction, and flag post-compromise behaviors like data exfiltration for incident reporting.

What is the best way to reconstruct TCP sessions from network traffic captures?▼

Reconstruct TCP sessions from network traffic captures by loading PCAP or PCAPNG files into a session reconstructor, which maps endpoints and protocols to rebuild the conversation flow for forensic investigations.

Can I extract files transferred over the network from PCAP data?▼

Yes, you can extract files from PCAP data during network forensics analysis. The process involves parsing the capture to reconstruct sessions and pull transferred files for incident reporting and data exfiltration investigations.

Do I need Python to perform network forensics on NetFlow data?▼

Yes, you need Python 3.9+ to perform network forensics on NetFlow data. The analysis utilizes optional libraries such as pyshark, scapy, dpkt, and zeek to parse captures and investigate lateral movement or C2 activity.

Does this support DNS tunneling detection and HTTP analysis?▼

Yes, this supports DNS tunneling detection and HTTP analysis. It applies protocol analysis to network captures to identify DNS tunneling, extract HTTP requests, and map anomalies for threat hunting and forensic investigations.

Related Skills

Explore More Data & Analytics Skills→
YukiIto1999YukiIto1999

analyzing-network-traffic-of-malware

Analyze malware network traffic PCAPs to identify C2 protocols and generate Suricata rules.

Community
Advanced
Q16GQ16G
83

log-analysis

Analyze multi-source security logs to identify threat indicators and enable threat hunting.

Community
Intermediate
refractionPOINTrefractionPOINT
29

threat-report-evaluation

Evaluate threat reports to extract IOCs and behaviors across LimaCharlie organizations.

Official
Advanced
YukiIto1999YukiIto1999

performing-network-traffic-analysis-with-zeek

Deploy Zeek to collect, parse, and analyze network traffic logs.

Community
Advanced