skills.rest
lNwNl
lNwNlCOMMUNITY
Explore all skills by this author →
GitHub

traffic-analysis-pcap

Analyze PCAP files with Wireshark/tshark to extract forensic evidence and indicators of compromise.

2|Updated May 15, 2026
Search Tags:#pcap#tshark#wireshark#tls decryption#evidence extraction#dns tunneling#protocol forensics
One-click install
npx skills add https://github.com/lNwNl/Methodos --skill traffic-analysis-pcap-lnwnl
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: traffic-analysis-pcap
Source: https://github.com/lNwNl/Methodos/tree/main/docker/opencode/skills/traffic-analysis-pcap
Command: npx skills add https://github.com/lNwNl/Methodos --skill traffic-analysis-pcap-lnwnl

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps you analyze network captures and recover meaningful evidence when traffic is encrypted, corrupted, or hard to interpret, so you can quickly identify protocols, credentials, and suspicious behavior from PCAPs.

Core Features & Use Cases

  • PCAP Repair & Conversion: Recover from corrupted capture files and convert between PCAPNG and PCAP for downstream analysis.
  • Wireshark & tshark Forensics: Apply targeted filters for IP, protocol, TCP streams, HTTP/DNS/TLS/FTP/SMTP/ICMP/WiFi/USB, then export objects and extract fields via CLI.
  • Expert Evidence Extraction: Carve files from reassembled streams, harvest credentials, detect covert channels (e.g., DNS tunneling, ICMP/HTTP patterns), and support TLS decryption workflows using SSLKEYLOGFILE or RSA keys.
  • Use Case: Investigate a suspicious network session and determine whether an attacker used DNS tunneling for exfiltration by combining DNS heuristics with command-line extraction and follow-stream evidence.

Quick Start

Use the traffic-analysis-pcap skill to analyze the attached file 'capture.pcap' and produce a protocol-focused summary with the most relevant extracted artifacts (IPs/domains, DNS tunneling indicators, HTTP requests/responses, and any credential-bearing payloads).

Frequently Asked Questions about traffic-analysis-pcap

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract forensic evidence from a PCAP file containing encrypted traffic?▼

Extract forensic evidence from encrypted PCAP traffic by applying Wireshark display filters and using SSLKEYLOGFILE or RSA keys for TLS decryption to reveal protocol artifacts and credentials.

What is the best way to detect DNS tunneling and data exfiltration in network captures?▼

Detect DNS tunneling in network captures by applying DNS heuristics and command-line field extraction with tshark to identify suspicious query patterns and covert-channel exfiltration indicators.

How can I recover data from a corrupted PCAP or convert PCAPNG files for analysis?▼

Recover corrupted PCAP files and convert between PCAPNG and PCAP formats to repair damaged captures and prepare them for downstream protocol analysis and evidence extraction.

Can I use tshark command-line extraction to carve files and harvest credentials from reassembled TCP streams?▼

Use tshark command-line field extraction to carve files from reassembled TCP streams and harvest credentials from HTTP, FTP, and SMTP protocols within your PCAP captures.

Does this PCAP analysis approach support USB HID keyboard capture and WiFi WPA handshake analysis?▼

PCAP analysis supports USB HID keyboard capture and WiFi WPA handshake analysis by applying targeted protocol filters to extract keystroke artifacts and validate wireless authentication evidence.

How do I optimize Wireshark display filters for investigating suspicious ICMP covert channels?▼

Optimize Wireshark display filters for ICMP covert-channel detection by targeting specific protocol fields to isolate hidden data payloads and exfiltration patterns within network traffic.

Related Skills

Explore More Software Engineering Skills→
utsavthakurutsavthakur

traffic-analysis-pcap

Analyzes PCAP network traffic with Wireshark filters and protocol-specific forensics including TLS decryption and covert detection.

Community
Advanced
jmaglyjmagly
175

ioc-extraction

Extracts and classifies ICOs from investigatorial source files, mapping them to STIX 2.1 objects.

Community
Advanced
dapperdiversdapperdivers
1

ioc-distributor

Export and distribute validated IOCs across security platforms.

Community
Advanced
GhostPWNGhostPWN
4

Network Security & Traffic Analysis

Analyze PCAP files and firewall configurations to generate Suricata, Snort, and Zeek detection rules.

Official
Advanced