performing-network-forensics-with-wireshark

You can analyze PCAP captures to identify C2 beaconing and data exfiltration by using this Skill to extract DNS queries, HTTP requests, and TLS handshake data, then reconstruct TCP streams to reveal attacker activity patterns.

Yes, you can extract TLS certificate and SNI data from PCAPNG files for network forensics. The Skill parses TLS handshake messages to surface server name indications and certificate details as network indicators of compromise.

Yes, you need pyshark and tshark installed to reconstruct TCP streams from packet captures. The Skill requires Python with the pyshark library and Wireshark/tshark for underlying packet dissection and protocol decoding.

The best way to generate a network forensics report from raw packet statistics is to run this Skill on a PCAP file. It processes packet statistics to artifacts and outputs a human-readable report reconstructing the incident.

Extracting DNS queries from PCAP data helps reconstruct network incidents by revealing domain resolution requests made by compromised hosts. This identifies command and control infrastructure and tracks attacker communication channels.

A limitation of using pyshark for extracting network artifacts from large PCAP files is potential processing overhead. Performance depends on tshark dissection efficiency and available system memory when analyzing high-volume packet captures.