traffic-analysis

You can extract IOCs from a PCAP file by running an analysis script that parses packet captures to identify IPs, domains, and URLs. This process outputs structured JSON containing IOC candidates for rapid enrichment during incident response.

Automating network traffic analysis involves parsing packet captures to extract protocol distributions, IP and port activity, and DNS, HTTP, and TLS metadata. This generates a structured JSON report with basic statistics and network insights.

You do not strictly need tshark to analyze PCAP files. The tool relies on tshark for full feature extraction, including TLS SNI and JA3 fingerprints, but provides a Scapy-based fallback for environments without tshark installed.

Yes, you can extract TLS SNI and JA3 fingerprints from PCAP traffic. The analysis requires tshark to fully parse and extract this TLS info, outputting the metadata alongside protocol distributions and IP statistics in a JSON format.

From a PCAP file, you can generate network statistics including packet counts, capture duration, total bytes, protocol distribution, and IP and port analytics. These structured metrics support threat hunting and digital forensics workflows.

PCAP analysis may fail to extract HTTP and DNS queries if tshark is not installed in your environment. While tshark provides full feature extraction for DNS queries and HTTP requests, a Scapy-based fallback handles basic parsing when it is absent.