skills.rest
sayseven7
sayseven7COMMUNITY
Explore all skills by this author →
WebsiteGitHub

traffic-analysis-pcap

Analyze PCAP files to reconstruct network activity and extract evidence.

11|4|Updated Jun 7, 2026
Search Tags:#traffic analysis#pcap#tshark#wireshark#tls decryption#dns tunneling#network forensics
One-click install
npx skills add https://github.com/sayseven7/frameseven --skill traffic-analysis-pcap-sayseven7
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: traffic-analysis-pcap
Source: https://github.com/sayseven7/frameseven/tree/main/internal/mcp/skills/traffic-analysis-pcap
Command: npx skills add https://github.com/sayseven7/frameseven --skill traffic-analysis-pcap-sayseven7

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you investigate PCAP files when you need to understand what happened on a network, recover useful artifacts, and spot suspicious traffic patterns.

Core Features & Use Cases

  • Packet and stream analysis: Use Wireshark filters and follow-stream workflows to inspect HTTP, DNS, FTP, SMTP, TLS, USB HID, WiFi, and ICMP traffic.
  • Evidence extraction: Recover files, credentials, email content, payloads, and other artifacts from captured sessions.
  • Detection and triage: Identify covert channels, tunneling, exfiltration, and other anomalous patterns through protocol-specific heuristics.
  • Repair and decryption workflows: Fix damaged captures, convert between capture formats, and decrypt TLS traffic when key material is available.
  • Use Case: A security analyst receives a suspicious capture and uses this Skill to determine whether it contains credential theft, DNS tunneling, or file transfer evidence.

Quick Start

Use this skill to inspect the attached capture, identify the main protocols, and guide me through the fastest path to recover meaningful evidence.

Frequently Asked Questions about traffic-analysis-pcap

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze a pcap file to recover credentials and transferred files?▼

Analyzing a pcap file for evidence involves using Wireshark filters and follow-stream workflows to inspect HTTP, DNS, FTP, and SMTP traffic, enabling recovery of transferred files and credentials through export-object extraction.

What is the best way to detect DNS tunneling and covert channels in network traffic?▼

Detecting DNS tunneling in network traffic requires applying protocol-specific heuristics to packet captures to identify anomalous patterns, exfiltration, and hidden evidence across protocols like DNS and ICMP.

Can I decrypt TLS traffic in Wireshark if I have the session key material?▼

Yes, you can decrypt TLS traffic in Wireshark when key material is available. The decryption workflow applies provided key logs to reconstruct and inspect encrypted application layer payloads within the capture.

How do I repair a damaged packet capture before running tshark analysis?▼

Repairing a damaged packet capture involves fixing corrupted files and converting between capture formats to ensure structural integrity, enabling successful tshark command-line analysis and stream reconstruction.

Does this network forensics workflow support investigating USB and WiFi traffic?▼

Yes, this network forensics workflow supports investigating USB HID and WiFi traffic. It applies protocol-specific heuristics to packet captures to uncover hidden evidence and reconstruct device or wireless network activity.

Why use tshark command-line analysis instead of Wireshark for packet inspection?▼

Using tshark command-line analysis instead of Wireshark enables scripted, high-throughput extraction of artifacts and protocol filtering. It complements Wireshark by automating stream reconstruction and evidence triage across large captures.

Related Skills

Explore More Data & Analytics Skills→
jcastillotxjcastillotx

Wireshark Network Traffic Analysis

Capture, filter, and inspect packets from live captures or PCAP files.

Community
Intermediate
Patasse97Patasse97

incident-response

Classify security events into incident types with severity and escalation paths.

Community
Advanced
bbartlingbbartling
157

rules-crud-and-batch-run

Manage YAML fault detection rules and execute batch RuleRunner jobs.

Community
Intermediate
LeoWSY-hashblueLeoWSY-hashblue
3

dfir

Correlates EVTX, PCAP, memory, and MFT artifacts to reconstruct Windows incident timelines.

Community
Advanced