skills.rest
automateyournetwork
automateyournetworkCOMMUNITY
Explore all skills by this author →
Website𝕏@john_capobiancoGitHub

nsm-session-pivot

Pivot through Zeek session and protocol logs from packet captures to reconstruct network connections.

650|182|Updated Feb 19, 2026
Search Tags:#session analysis#network security#forensics#pcap#nsm#IDs#zeek
One-click install
npx skills add https://github.com/automateyournetwork/netclaw --skill nsm-session-pivot
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: nsm-session-pivot
Source: https://github.com/automateyournetwork/netclaw/tree/main/workspace/skills/nsm-session-pivot
Command: npx skills add https://github.com/automateyournetwork/netclaw --skill nsm-session-pivot

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Reconstructing what actually happened in a packet capture is error-prone: Zeek silently discards packets with invalid TCP checksums (common in captures from NICs with checksum offloading), producing missing protocol logs and wrong connection tables that look like real findings. This Skill provides a disciplined, read-only workflow for listing sessions, filtering by service, and following a connection uid across dns/http/ssl logs while always accounting for checksum posture.

Core Features & Use Cases

  • Session Reconstruction: Run nsm_analyze and nsm_sessions to enumerate connections, services, conn_state, and byte counts from a .pcap/.pcapng file.
  • Cross-Protocol Pivoting: Follow a connection uid from conn.log into dns, http, ssl, and weird logs for exact, non-heuristic correlation.
  • Checksum Posture Awareness: Every response carries zeek_posture (IGNORING_CHECKSUMS, PACKETS_DISCARDED, VALIDATING) so conclusions about absent traffic are honest.
  • Use Case: Given a Suricata alert from nsm-ids-triage, match its IP pair and port to a connection uid, pull the http log for that uid, and report the alert with full session context including duration, bytes, and conn_state.

Quick Start

Analyze the capture file incident.pcap, list its sessions, and follow the suspicious connection's uid into the http and dns logs.

Frequently Asked Questions about nsm-session-pivot

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I follow a connection across Zeek logs in a pcap file?▼

Run nsm_sessions to find the connection of interest and record its uid, then call nsm_protocol_log with log set to dns, http, or ssl and that uid. Every Zeek log shares the uid with conn.log, making the pivot exact rather than heuristic.

Why does Zeek show no http.log for my packet capture?▼

Zeek discards packets with invalid TCP checksums by default, which can eliminate entire protocol logs and corrupt conn.log. Captures from NICs with checksum offloading commonly trigger this; re-run with ignore_checksums=true before concluding traffic was absent.

Can this analyze live network traffic or sniff an interface?▼

No. The skill is strictly read-only and analyzes a .pcap or .pcapng file already on disk. Nothing sniffs an interface and no writes are performed.

How do I investigate a Suricata IDS alert with session context?▼

Filter nsm_sessions by the alert's service or scan for its IP pair, match on id.orig_h, id.resp_h, and id.resp_p to find the uid, then pull the relevant protocol log. Report the alert with duration, bytes each way, and conn_state such as S0 versus SF.

What does the weird.log tell me during an investigation?▼

weird.log records protocol anomalies Zeek could not classify, and many entries are benign. It is not an alert log, so treat it as supplementary context rather than detection output.

Related Skills

Explore More Software Engineering Skills→
automateyournetworkautomateyournetwork
627

cml-packet-capture

Capture network traffic on Cisco Modeling Labs links as pcap files.

Community
Intermediate
dgethingsdgethings

gait-session-tracking

Record GAIT session branches, turns, and audit logs for NetClaw operations.

Community
Advanced
xalgordxalgord
954

detecting-network-scanning-with-ids-signatures

Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures.

Community
Intermediate
AxxxxxxaaannAxxxxxxaaann

analyzing-network-flow-data-with-netflow

Detect anomalies, port scans, exfiltration, and C2 beaconing from NetFlow/IPFIX data.

Community
Intermediate