skills.rest
yaklang
yaklangOFFICIAL
Explore all skills by this author →
GitHub

traffic-analysis-pcap

Analyze PCAP network captures for malicious activity, credentials, and covert channels.

1.6k|204|Updated Apr 7, 2026
Search Tags:#packet-analysis#pcap#tshark#wireshark#network-forensics#tls-decryption#file-carving
One-click install
npx skills add https://github.com/yaklang/hack-skills --skill traffic-analysis-pcap
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: traffic-analysis-pcap
Source: https://github.com/yaklang/hack-skills/tree/main/skills/traffic-analysis-pcap
Command: npx skills add https://github.com/yaklang/hack-skills --skill traffic-analysis-pcap

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provides a structured, expert playbook to analyze network captures quickly and reliably, turning raw PCAPs into actionable evidence and investigator findings without guesswork.

Core Features & Use Cases

  • PCAP repair & preparation: recover corrupted captures, convert pcapng to pcap, and merge multiple files for unified analysis.
  • Protocol-focused triage: Wireshark and tshark filters and workflows for HTTP, DNS, TLS/HTTPS, FTP, SMTP, ICMP, USB HID, and WiFi handshakes to locate credentials, files, and covert channels.
  • Data extraction & tooling: file carving, NetworkMiner automation, TLS decryption using SSLKEYLOGFILE or server keys, and command-line tshark extraction for incident response, CTF forensics, and penetration testing.

Quick Start

Open capture.pcap in Wireshark or run tshark to list protocol hierarchy, extract HTTP objects and credentials, and search DNS for long subdomains or TXT records indicating tunneling.

Frequently Asked Questions about traffic-analysis-pcap

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract files from a pcap capture for incident response?▼

To extract files from a pcap, apply file carving tools like binwalk and foremost, or automate extraction using NetworkMiner and tshark command-line workflows to recover embedded objects and evidence.

What is the best way to decrypt TLS traffic in a network forensics pcap?▼

Decrypt TLS traffic in a pcap by supplying an SSLKEYLOGFILE or the server's private keys to tshark or Wireshark, enabling the analysis of encrypted HTTPS session contents for evidence.

How do I find credentials and covert channels in network traffic captures?▼

Find credentials and covert channels by applying protocol-focused tshark and Wireshark filters across HTTP, DNS, FTP, and SMTP, checking DNS TXT records or long subdomains for tunneling.

Can I analyze USB HID and WiFi handshakes using tshark filters?▼

Yes, you can analyze USB HID and WiFi handshakes by applying specific tshark and Wireshark-compatible filters to your pcap to locate keystrokes, credentials, and handshake evidence.

Do I need to repair corrupted pcapng files before protocol triage?▼

Repair corrupted captures and convert pcapng to pcap before protocol triage, merging multiple files for unified analysis to ensure accurate HTTP, DNS, and ICMP evidence extraction.

Why does my tshark extraction fail on malformed network captures?▼

Tshark extraction fails on malformed captures due to corruption or formatting errors; repair the pcap, convert pcapng formats, and merge files to restore structural integrity for parsing.

Related Skills

Explore More Software Engineering Skills→
YukiIto1999YukiIto1999

performing-network-forensics-with-wireshark

Analyzes PCAP captures to identify network indicators of compromise and extract artifacts using pyshark and Wireshark/tshark workflows.

Community
Advanced
StamusNetworksStamusNetworks
2

hunt

Analyze PCAP files and Suricata EVE JSON logs to detect malicious network activity.

Official
Advanced
kiwamizamuraikiwamizamurai
7

forensics

Extract hidden data and forensic artifacts from files using standard tools.

Community
Advanced
lNwNllNwNl
2

traffic-analysis-pcap

Analyze PCAP files with Wireshark/tshark to extract forensic evidence and indicators of compromise.

Community
Advanced