agentsclimarketplace
Sign in

Performing network traffic analysis with tshark

Skill Mikaru0Mystic/sectinel/arsenal/Anthropic-Cybersecurity-Skills/skills/performing-network-traffic-analysis-with-tshark

Automate network traffic analysis using tshark and pyshark for protocol statistics, suspicious flow detection, DNS anomaly identification, and IOC extraction from PCAP filesFrom its SKILL.md

Install
npx -y skills add Mikaru0Mystic/sectinel --skill performing-network-traffic-analysis-with-tshark

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 11 stars11 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.1 KB, 355 tokens by cl100k_base, as published. Nobody here has run it

Performing Network Traffic Analysis with TShark

Overview

This skill automates packet capture analysis using tshark (Wireshark CLI) and pyshark (Python wrapper). It extracts protocol distribution statistics, identifies suspicious network flows (port scans, beaconing, data exfiltration), extracts IOCs (IPs, domains, URLs), and detects DNS tunneling patterns from PCAP files.

When to Use

  • When conducting security assessments that involve performing network traffic analysis with tshark
  • When following incident response procedures for related security events
  • When performing scheduled security testing or auditing activities
  • When validating security controls through hands-on testing

Prerequisites

  • tshark (Wireshark CLI) installed and in PATH
  • Python 3.8+ with pyshark library
  • PCAP or PCAPNG capture file for analysis

Steps

  1. Extract Protocol Statistics — Generate protocol hierarchy and conversation statistics from the capture
  2. Identify Top Talkers — Rank source/destination IPs by volume and connection count
  3. Detect Suspicious Flows — Flag port scanning patterns, unusual port usage, and high-frequency connections
  4. Extract Network IOCs — Pull unique IPs, domains from DNS queries, and URLs from HTTP traffic
  5. Analyze DNS Traffic — Detect DNS tunneling via high-entropy subdomain queries and excessive TXT records
  6. Generate Analysis Report — Produce structured report with flow summaries and threat indicators

Expected Output

  • JSON report with protocol statistics and top talkers
  • Suspicious flow detections with severity ratings
  • Extracted IOCs (IPs, domains, URLs)
  • DNS anomaly analysis results

What ships with it: 3 files

21.3 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 326,852. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.