skills.rest
DorianGallo
DorianGalloCOMMUNITY
Explore all skills by this author →
GitHub

traffic-analysis-pcap

Repairs PCAPs and analyzes HTTP, DNS, TLS, FTP, SMTP, WiFi, ICMP via protocol-aware inspection and Wireshark filters.

5|2|Updated May 16, 2026
Search Tags:#pcap#tshark#wireshark#tls decryption#credential extraction#dns tunneling#network forensics
One-click install
npx skills add https://github.com/DorianGallo/hack-skills-local --skill traffic-analysis-pcap-doriangallo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: traffic-analysis-pcap
Source: https://github.com/DorianGallo/hack-skills-local/tree/main/skills/traffic-analysis-pcap
Command: npx skills add https://github.com/DorianGallo/hack-skills-local --skill traffic-analysis-pcap-doriangallo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Traffic analysis and PCAP forensics reduce the effort required to interpret network captures, recover hidden payloads, and extract actionable evidence such as credentials or exfiltration indicators.

Core Features & Use Cases

  • PCAP repair & conversion: Fix corrupted captures and convert PCAPNG to PCAP to enable downstream inspection.
  • Wireshark filtering & protocol deep dives: Quickly isolate relevant packets and analyze HTTP/DNS/TLS/FTP/SMTP/USB WiFi/ICMP behaviors.
  • Extraction workflows: Recover objects and credentials from application-layer streams and detect covert channels (e.g., DNS tunneling, ICMP/HTTP anomalies).
  • Tool-assisted analysis: Use NetworkMiner for automated extraction and use tshark command-line pipelines for reproducible, scriptable triage.

Quick Start

Use the traffic-analysis-pcap skill to analyze an uploaded capture file 'capture.pcap' by producing Wireshark filter ideas and tshark extraction commands to identify suspicious HTTP, DNS, TLS, and covert-channel indicators.

Frequently Asked Questions about traffic-analysis-pcap

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract credentials and hidden payloads from a PCAP file?▼

To extract credentials and hidden payloads from a PCAP file, apply protocol-aware inspection across HTTP, DNS, and SMTP streams, and use tool-assisted workflows like tshark pipelines or NetworkMiner for automated artifact recovery.

How does TLS decryption work when analyzing network captures?▼

TLS decryption in network captures works by applying SSLKEYLOGFILE or RSA keys within Wireshark or tshark workflows, allowing investigators to decrypt and inspect encrypted application-layer traffic for evidence.

Can I repair a corrupted PCAPNG file and convert it to PCAP for analysis?▼

Yes, you can repair corrupted captures and convert PCAPNG files to PCAP format to enable downstream inspection, ensuring compatibility with protocol-aware analysis tools and extraction workflows.

What is the best way to detect DNS tunneling and covert channels in network traffic?▼

Detecting DNS tunneling and covert channels involves isolating relevant packets using precise Wireshark display filters and analyzing protocol behaviors to identify anomalies across DNS, ICMP, and HTTP traffic.

Does this approach support analyzing USB HID and WiFi captures alongside standard network traffic?▼

Yes, protocol-aware inspection supports analyzing USB HID and WiFi captures alongside standard network traffic, fitting incident response triage, CTF-style forensics, and authorized security research scenarios.

Why do I need precise Wireshark display filters for network forensics?▼

Precise Wireshark display filters are needed for network forensics to quickly isolate relevant packets from large captures, enabling focused analysis of HTTP, DNS, TLS, FTP, and SMTP behaviors during incident triage.

Related Skills

Explore More Data & Analytics Skills→
automateyournetworkautomateyournetwork
627

packet-analysis

Analyze network packet captures with Packet Buddy MCP and tshark.

Community
Intermediate
DCx7C5DCx7C5

bmp-lsb-detect

Detect steganography in BMP images using statistical least-significant-bit analysis.

Community
Intermediate
sayseven7sayseven7
11

traffic-analysis-pcap

Analyze PCAP files to reconstruct network activity and extract evidence.

Community
Advanced
YukiIto1999YukiIto1999

performing-network-traffic-analysis-with-zeek

Deploy Zeek to collect, parse, and analyze network traffic logs.

Community
Advanced