[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFWMS6EA9T4EJSXM1NVKXC":3,"skill-same:01M6AFWMS6EA9T4EJSXM1NVKXC":76},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":52,"commitSha":53,"skillDirectory":54,"forksCount":55,"repositoryHtmlUrl":56,"repositoryHomepageUrl":57,"ownerHtmlUrl":58,"ownerBlogUrl":59,"ownerDescription":60,"updatedAt":61,"install":62,"resources":75},"01M6AFWMS6EA9T4EJSXM1NVKXC","wireshark-analysis",null,"This skill should be used when the user asks to \"analyze network traffic with Wireshark\", \"capture packets for troubleshooting\", \"filter PCAP files\", \"follow TCP\u002FUDP streams\", \"detect network anomalies\", \"investigate suspicious traffic\", or \"perform protocol analysis\". It provides comprehensive techniques for network packet capture, filtering, and analysis using Wireshark.","davila7\u002Fclaude-code-templates","davila7","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6216945?v=4","01M6ADEWWFPS191NFM0Y1EX1JH","Daniel Avila","01M6ADJHGM78PHQRD3XZTFDVKK",33332,"MIT","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwireshark-analysis\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"Wireshark","analysis","wireshark analysis","filtering","when","for","techniques","traffic","streams","with","detect","filter","files","suspicious","analyze","investigate","pcap","network","tcp","protocol","2026-11-10 10:12:30",false,"---\nname: wireshark-analysis\ndescription: This skill should be used when the user asks to \"analyze network traffic with Wireshark\", \"capture packets for troubleshooting\", \"filter PCAP files\", \"follow TCP\u002FUDP streams\", \"detect network anomalies\", \"investigate suspicious traffic\", or \"perform protocol analysis\". It provides comprehensive techniques for network packet capture, filtering, and analysis using Wireshark.\nmetadata:\n  author: zebbern\n  version: \"1.1\"\n---\n\n# Wireshark Network Traffic Analysis\n\n## Purpose\n\nExecute comprehensive network traffic analysis using Wireshark to capture, filter, and examine network packets for security investigations, performance optimization, and troubleshooting. This skill enables systematic analysis of network protocols, detection of anomalies, and reconstruction of network conversations from PCAP files.\n\n## Inputs \u002F Prerequisites\n\n### Required Tools\n- Wireshark installed (Windows, macOS, or Linux)\n- Network interface with capture permissions\n- PCAP\u002FPCAPNG files for offline analysis\n- Administrator\u002Froot privileges for live capture\n\n### Technical Requirements\n- Understanding of network protocols (TCP, UDP, HTTP, DNS)\n- Familiarity with IP addressing and ports\n- Knowledge of OSI model layers\n- Understanding of common attack patterns\n\n### Use Cases\n- Network troubleshooting and connectivity issues\n- Security incident investigation\n- Malware traffic analysis\n- Performance monitoring and optimization\n- Protocol learning and education\n\n## Outputs \u002F Deliverables\n\n### Primary Outputs\n- Filtered packet captures for specific traffic\n- Reconstructed communication streams\n- Traffic statistics and visualizations\n- Evidence documentation for incidents\n\n## Core Workflow\n\n### Phase 1: Capturing Network Traffic\n\n#### Start Live Capture\nBegin capturing packets on network interface:\n\n```\n1. Launch Wireshark\n2. Select network interface from main screen\n3. Click shark fin icon or double-click interface\n4. Capture begins immediately\n```\n\n#### Capture Controls\n| Action | Shortcut | Description |\n|--------|----------|-------------|\n| Start\u002FStop Capture | Ctrl+E | Toggle capture on\u002Foff |\n| Restart Capture | Ctrl+R | Stop and start new capture |\n| Open PCAP File | Ctrl+O | Load existing capture file |\n| Save Capture | Ctrl+S | Save current capture |\n\n#### Capture Filters\nApply filters before capture to limit data collection:\n\n```\n# Capture only specific host\nhost 192.168.1.100\n\n# Capture specific port\nport 80\n\n# Capture specific network\nnet 192.168.1.0\u002F24\n\n# Exclude specific traffic\nnot arp\n\n# Combine filters\nhost 192.168.1.100 and port 443\n```\n\n### Phase 2: Display Filters\n\n#### Basic Filter Syntax\nFilter captured packets for analysis:\n\n```\n# IP address filters\nip.addr == 192.168.1.1              # All traffic to\u002Ffrom IP\nip.src == 192.168.1.1               # Source IP only\nip.dst == 192.168.1.1               # Destination IP only\n\n# Port filters\ntcp.port == 80                       # TCP port 80\nudp.port == 53                       # UDP port 53\ntcp.dstport == 443                   # Destination port 443\ntcp.srcport == 22                    # Source port 22\n```\n\n#### Protocol Filters\nFilter by specific protocols:\n\n```\n# Common protocols\nhttp                                  # HTTP traffic\nhttps or ssl or tls                   # Encrypted web traffic\ndns                                   # DNS queries and responses\nftp                                   # FTP traffic\nssh                                   # SSH traffic\nicmp                                  # Ping\u002FICMP traffic\narp                                   # ARP requests\u002Fresponses\ndhcp                                  # DHCP traffic\nsmb or smb2                          # SMB file sharing\n```\n\n#### TCP Flag Filters\nIdentify specific connection states:\n\n```\ntcp.flags.syn == 1                   # SYN packets (connection attempts)\ntcp.flags.ack == 1                   # ACK packets\ntcp.flags.fin == 1                   # FIN packets (connection close)\ntcp.flags.reset == 1                 # RST packets (connection reset)\ntcp.flags.syn == 1 && tcp.flags.ack == 0  # SYN-only (initial connection)\n```\n\n#### Content Filters\nSearch for specific content:\n\n```\nframe contains \"password\"            # Packets containing string\nhttp.request.uri contains \"login\"    # HTTP URIs with string\ntcp contains \"GET\"                   # TCP packets with string\n```\n\n#### Analysis Filters\nIdentify potential issues:\n\n```\ntcp.analysis.retransmission          # TCP retransmissions\ntcp.analysis.duplicate_ack           # Duplicate ACKs\ntcp.analysis.zero_window             # Zero window (flow control)\ntcp.analysis.flags                   # Packets with issues\ndns.flags.rcode != 0                 # DNS errors\n```\n\n#### Combining Filters\nUse logical operators for complex queries:\n\n```\n# AND operator\nip.addr == 192.168.1.1 && tcp.port == 80\n\n# OR operator\ndns || http\n\n# NOT operator\n!(arp || icmp)\n\n# Complex combinations\n(ip.src == 192.168.1.1 || ip.src == 192.168.1.2) && tcp.port == 443\n```\n\n### Phase 3: Following Streams\n\n#### TCP Stream Reconstruction\nView complete TCP conversation:\n\n```\n1. Right-click on any TCP packet\n2. Select Follow > TCP Stream\n3. View reconstructed conversation\n4. Toggle between ASCII, Hex, Raw views\n5. Filter to show only this stream\n```\n\n#### Stream Types\n| Stream | Access | Use Case |\n|--------|--------|----------|\n| TCP Stream | Follow > TCP Stream | Web, file transfers, any TCP |\n| UDP Stream | Follow > UDP Stream | DNS, VoIP, streaming |\n| HTTP Stream | Follow > HTTP Stream | Web content, headers |\n| TLS Stream | Follow > TLS Stream | Encrypted traffic (if keys available) |\n\n#### Stream Analysis Tips\n- Review request\u002Fresponse pairs\n- Identify transmitted files or data\n- Look for credentials in plaintext\n- Note unusual patterns or commands\n\n### Phase 4: Statistical Analysis\n\n#### Protocol Hierarchy\nView protocol distribution:\n\n```\nStatistics > Protocol Hierarchy\n\nShows:\n- Percentage of each protocol\n- Packet counts\n- Bytes transferred\n- Protocol breakdown tree\n```\n\n#### Conversations\nAnalyze communication pairs:\n\n```\nStatistics > Conversations\n\nTabs:\n- Ethernet: MAC address pairs\n- IPv4\u002FIPv6: IP address pairs\n- TCP: Connection details (ports, bytes, packets)\n- UDP: Datagram exchanges\n```\n\n#### Endpoints\nView active network participants:\n\n```\nStatistics > Endpoints\n\nShows:\n- All source\u002Fdestination addresses\n- Packet and byte counts\n- Geographic information (if enabled)\n```\n\n#### Flow Graph\nVisualize packet sequence:\n\n```\nStatistics > Flow Graph\n\nOptions:\n- All packets or displayed only\n- Standard or TCP flow\n- Shows packet timing and direction\n```\n\n#### I\u002FO Graphs\nPlot traffic over time:\n\n```\nStatistics > I\u002FO Graph\n\nFeatures:\n- Packets per second\n- Bytes per second\n- Custom filter graphs\n- Multiple graph overlays\n```\n\n### Phase 5: Security Analysis\n\n#### Detect Port Scanning\nIdentify reconnaissance activity:\n\n```\n# SYN scan detection (many ports, same source)\nip.src == SUSPECT_IP && tcp.flags.syn == 1\n\n# Review Statistics > Conversations for anomalies\n# Look for single source hitting many destination ports\n```\n\n#### Identify Suspicious Traffic\nFilter for anomalies:\n\n```\n# Traffic to unusual ports\ntcp.dstport > 1024 && tcp.dstport \u003C 49152\n\n# Traffic outside trusted network\n!(ip.addr == 192.168.1.0\u002F24)\n\n# Unusual DNS queries\ndns.qry.name contains \"suspicious-domain\"\n\n# Large data transfers\nframe.len > 1400\n```\n\n#### ARP Spoofing Detection\nIdentify ARP attacks:\n\n```\n# Duplicate ARP responses\narp.duplicate-address-frame\n\n# ARP traffic analysis\narp\n\n# Look for:\n# - Multiple MACs for same IP\n# - Gratuitous ARP floods\n# - Unusual ARP patterns\n```\n\n#### Examine Downloads\nAnalyze file transfers:\n\n```\n# HTTP file downloads\nhttp.request.method == \"GET\" && http contains \"Content-Disposition\"\n\n# Follow HTTP Stream to view file content\n# Use File > Export Objects > HTTP to extract files\n```\n\n#### DNS Analysis\nInvestigate DNS activity:\n\n```\n# All DNS traffic\ndns\n\n# DNS queries only\ndns.flags.response == 0\n\n# DNS responses only\ndns.flags.response == 1\n\n# Failed DNS lookups\ndns.flags.rcode != 0\n\n# Specific domain queries\ndns.qry.name contains \"domain.com\"\n```\n\n### Phase 6: Expert Information\n\n#### Access Expert Analysis\nView Wireshark's automated findings:\n\n```\nAnalyze > Expert Information\n\nCategories:\n- Errors: Critical issues\n- Warnings: Potential problems\n- Notes: Informational items\n- Chats: Normal conversation events\n```\n\n#### Common Expert Findings\n| Finding | Meaning | Action |\n|---------|---------|--------|\n| TCP Retransmission | Packet resent | Check for packet loss |\n| Duplicate ACK | Possible loss | Investigate network path |\n| Zero Window | Buffer full | Check receiver performance |\n| RST | Connection reset | Check for blocks\u002Ferrors |\n| Out-of-Order | Packets reordered | Usually normal, excessive is issue |\n\n## Quick Reference\n\n### Keyboard Shortcuts\n| Action | Shortcut |\n|--------|----------|\n| Open file | Ctrl+O |\n| Save file | Ctrl+S |\n| Start\u002FStop capture | Ctrl+E |\n| Find packet | Ctrl+F |\n| Go to packet | Ctrl+G |\n| Next packet | ↓ |\n| Previous packet | ↑ |\n| First packet | Ctrl+Home |\n| Last packet | Ctrl+End |\n| Apply filter | Enter |\n| Clear filter | Ctrl+Shift+X |\n\n### Common Filter Reference\n```\n# Web traffic\nhttp || https\n\n# Email\nsmtp || pop || imap\n\n# File sharing  \nsmb || smb2 || ftp\n\n# Authentication\nldap || kerberos\n\n# Network management\nsnmp || icmp\n\n# Encrypted\ntls || ssl\n```\n\n### Export Options\n```\nFile > Export Specified Packets    # Save filtered subset\nFile > Export Objects > HTTP       # Extract HTTP files\nFile > Export Packet Dissections   # Export as text\u002FCSV\n```\n\n## Constraints and Guardrails\n\n### Operational Boundaries\n- Capture only authorized network traffic\n- Handle captured data according to privacy policies\n- Avoid capturing sensitive credentials unnecessarily\n- Properly secure PCAP files containing sensitive data\n\n### Technical Limitations\n- Large captures consume significant memory\n- Encrypted traffic content not visible without keys\n- High-speed networks may drop packets\n- Some protocols require plugins for full decoding\n\n### Best Practices\n- Use capture filters to limit data collection\n- Save captures regularly during long sessions\n- Use display filters rather than deleting packets\n- Document analysis findings and methodology\n\n## Examples\n\n### Example 1: HTTP Credential Analysis\n\n**Scenario**: Investigate potential plaintext credential transmission\n\n```\n1. Filter: http.request.method == \"POST\"\n2. Look for login forms\n3. Follow HTTP Stream\n4. Search for username\u002Fpassword parameters\n```\n\n**Finding**: Credentials transmitted in cleartext form data.\n\n### Example 2: Malware C2 Detection\n\n**Scenario**: Identify command and control traffic\n\n```\n1. Filter: dns\n2. Look for unusual query patterns\n3. Check for high-frequency beaconing\n4. Identify domains with random-looking names\n5. Filter: ip.dst == SUSPICIOUS_IP\n6. Analyze traffic patterns\n```\n\n**Indicators**:\n- Regular timing intervals\n- Encoded\u002Fencrypted payloads\n- Unusual ports or protocols\n\n### Example 3: Network Troubleshooting\n\n**Scenario**: Diagnose slow web application\n\n```\n1. Filter: ip.addr == WEB_SERVER\n2. Check Statistics > Service Response Time\n3. Filter: tcp.analysis.retransmission\n4. Review I\u002FO Graph for patterns\n5. Check for high latency or packet loss\n```\n\n**Finding**: TCP retransmissions indicating network congestion.\n\n## Troubleshooting\n\n### No Packets Captured\n- Verify correct interface selected\n- Check for admin\u002Froot permissions\n- Confirm network adapter is active\n- Disable promiscuous mode if issues persist\n\n### Filter Not Working\n- Verify filter syntax (red = error)\n- Check for typos in field names\n- Use Expression button for valid fields\n- Clear filter and rebuild incrementally\n\n### Performance Issues\n- Use capture filters to limit traffic\n- Split large captures into smaller files\n- Disable name resolution during capture\n- Close unnecessary protocol dissectors\n\n### Cannot Decrypt TLS\u002FSSL\n- Obtain server private key\n- Configure at Edit > Preferences > Protocols > TLS\n- For ephemeral keys, capture pre-master secret from browser\n- Some modern ciphers cannot be decrypted passively\n","# Wireshark Network Traffic Analysis\n\n## Purpose\n\nExecute comprehensive network traffic analysis using Wireshark to capture, filter, and examine network packets for security investigations, performance optimization, and troubleshooting. This skill enables systematic analysis of network protocols, detection of anomalies, and reconstruction of network conversations from PCAP files.\n\n## Inputs \u002F Prerequisites\n\n### Required Tools\n- Wireshark installed (Windows, macOS, or Linux)\n- Network interface with capture permissions\n- PCAP\u002FPCAPNG files for offline analysis\n- Administrator\u002Froot privileges for live capture\n\n### Technical Requirements\n- Understanding of network protocols (TCP, UDP, HTTP, DNS)\n- Familiarity with IP addressing and ports\n- Knowledge of OSI model layers\n- Understanding of common attack patterns\n\n### Use Cases\n- Network troubleshooting and connectivity issues\n- Security incident investigation\n- Malware traffic analysis\n- Performance monitoring and optimization\n- Protocol learning and education\n\n## Outputs \u002F Deliverables\n\n### Primary Outputs\n- Filtered packet captures for specific traffic\n- Reconstructed communication streams\n- Traffic statistics and visualizations\n- Evidence documentation for incidents\n\n## Core Workflow\n\n### Phase 1: Capturing Network Traffic\n\n#### Start Live Capture\nBegin capturing packets on network interface:\n\n```\n1. Launch Wireshark\n2. Select network interface from main screen\n3. Click shark fin icon or double-click interface\n4. Capture begins immediately\n```\n\n#### Capture Controls\n| Action | Shortcut | Description |\n|--------|----------|-------------|\n| Start\u002FStop Capture | Ctrl+E | Toggle capture on\u002Foff |\n| Restart Capture | Ctrl+R | Stop and start new capture |\n| Open PCAP File | Ctrl+O | Load existing capture file |\n| Save Capture | Ctrl+S | Save current capture |\n\n#### Capture Filters\nApply filters before capture to limit data collection:\n\n```\n# Capture only specific host\nhost 192.168.1.100\n\n# Capture specific port\nport 80\n\n# Capture specific network\nnet 192.168.1.0\u002F24\n\n# Exclude specific traffic\nnot arp\n\n# Combine filters\nhost 192.168.1.100 and port 443\n```\n\n### Phase 2: Display Filters\n\n#### Basic Filter Syntax\nFilter captured packets for analysis:\n\n```\n# IP address filters\nip.addr == 192.168.1.1              # All traffic to\u002Ffrom IP\nip.src == 192.168.1.1               # Source IP only\nip.dst == 192.168.1.1               # Destination IP only\n\n# Port filters\ntcp.port == 80                       # TCP port 80\nudp.port == 53                       # UDP port 53\ntcp.dstport == 443                   # Destination port 443\ntcp.srcport == 22                    # Source port 22\n```\n\n#### Protocol Filters\nFilter by specific protocols:\n\n```\n# Common protocols\nhttp                                  # HTTP traffic\nhttps or ssl or tls                   # Encrypted web traffic\ndns                                   # DNS queries and responses\nftp                                   # FTP traffic\nssh                                   # SSH traffic\nicmp                                  # Ping\u002FICMP traffic\narp                                   # ARP requests\u002Fresponses\ndhcp                                  # DHCP traffic\nsmb or smb2                          # SMB file sharing\n```\n\n#### TCP Flag Filters\nIdentify specific connection states:\n\n```\ntcp.flags.syn == 1                   # SYN packets (connection attempts)\ntcp.flags.ack == 1                   # ACK packets\ntcp.flags.fin == 1                   # FIN packets (connection close)\ntcp.flags.reset == 1                 # RST packets (connection reset)\ntcp.flags.syn == 1 && tcp.flags.ack == 0  # SYN-only (initial connection)\n```\n\n#### Content Filters\nSearch for specific content:\n\n```\nframe contains \"password\"            # Packets containing string\nhttp.request.uri contains \"login\"    # HTTP URIs with string\ntcp contains \"GET\"                   # TCP packets with string\n```\n\n#### Analysis Filters\nIdentify potential issues:\n\n```\ntcp.analysis.retransmission          # TCP retransmissions\ntcp.analysis.duplicate_ack           # Duplicate ACKs\ntcp.analysis.zero_window             # Zero window (flow control)\ntcp.analysis.flags                   # Packets with issues\ndns.flags.rcode != 0                 # DNS errors\n```\n\n#### Combining Filters\nUse logical operators for complex queries:\n\n```\n# AND operator\nip.addr == 192.168.1.1 && tcp.port == 80\n\n# OR operator\ndns || http\n\n# NOT operator\n!(arp || icmp)\n\n# Complex combinations\n(ip.src == 192.168.1.1 || ip.src == 192.168.1.2) && tcp.port == 443\n```\n\n### Phase 3: Following Streams\n\n#### TCP Stream Reconstruction\nView complete TCP conversation:\n\n```\n1. Right-click on any TCP packet\n2. Select Follow > TCP Stream\n3. View reconstructed conversation\n4. Toggle between ASCII, Hex, Raw views\n5. Filter to show only this stream\n```\n\n#### Stream Types\n| Stream | Access | Use Case |\n|--------|--------|----------|\n| TCP Stream | Follow > TCP Stream | Web, file transfers, any TCP |\n| UDP Stream | Follow > UDP Stream | DNS, VoIP, streaming |\n| HTTP Stream | Follow > HTTP Stream | Web content, headers |\n| TLS Stream | Follow > TLS Stream | Encrypted traffic (if keys available) |\n\n#### Stream Analysis Tips\n- Review request\u002Fresponse pairs\n- Identify transmitted files or data\n- Look for credentials in plaintext\n- Note unusual patterns or commands\n\n### Phase 4: Statistical Analysis\n\n#### Protocol Hierarchy\nView protocol distribution:\n\n```\nStatistics > Protocol Hierarchy\n\nShows:\n- Percentage of each protocol\n- Packet counts\n- Bytes transferred\n- Protocol breakdown tree\n```\n\n#### Conversations\nAnalyze communication pairs:\n\n```\nStatistics > Conversations\n\nTabs:\n- Ethernet: MAC address pairs\n- IPv4\u002FIPv6: IP address pairs\n- TCP: Connection details (ports, bytes, packets)\n- UDP: Datagram exchanges\n```\n\n#### Endpoints\nView active network participants:\n\n```\nStatistics > Endpoints\n\nShows:\n- All source\u002Fdestination addresses\n- Packet and byte counts\n- Geographic information (if enabled)\n```\n\n#### Flow Graph\nVisualize packet sequence:\n\n```\nStatistics > Flow Graph\n\nOptions:\n- All packets or displayed only\n- Standard or TCP flow\n- Shows packet timing and direction\n```\n\n#### I\u002FO Graphs\nPlot traffic over time:\n\n```\nStatistics > I\u002FO Graph\n\nFeatures:\n- Packets per second\n- Bytes per second\n- Custom filter graphs\n- Multiple graph overlays\n```\n\n### Phase 5: Security Analysis\n\n#### Detect Port Scanning\nIdentify reconnaissance activity:\n\n```\n# SYN scan detection (many ports, same source)\nip.src == SUSPECT_IP && tcp.flags.syn == 1\n\n# Review Statistics > Conversations for anomalies\n# Look for single source hitting many destination ports\n```\n\n#### Identify Suspicious Traffic\nFilter for anomalies:\n\n```\n# Traffic to unusual ports\ntcp.dstport > 1024 && tcp.dstport \u003C 49152\n\n# Traffic outside trusted network\n!(ip.addr == 192.168.1.0\u002F24)\n\n# Unusual DNS queries\ndns.qry.name contains \"suspicious-domain\"\n\n# Large data transfers\nframe.len > 1400\n```\n\n#### ARP Spoofing Detection\nIdentify ARP attacks:\n\n```\n# Duplicate ARP responses\narp.duplicate-address-frame\n\n# ARP traffic analysis\narp\n\n# Look for:\n# - Multiple MACs for same IP\n# - Gratuitous ARP floods\n# - Unusual ARP patterns\n```\n\n#### Examine Downloads\nAnalyze file transfers:\n\n```\n# HTTP file downloads\nhttp.request.method == \"GET\" && http contains \"Content-Disposition\"\n\n# Follow HTTP Stream to view file content\n# Use File > Export Objects > HTTP to extract files\n```\n\n#### DNS Analysis\nInvestigate DNS activity:\n\n```\n# All DNS traffic\ndns\n\n# DNS queries only\ndns.flags.response == 0\n\n# DNS responses only\ndns.flags.response == 1\n\n# Failed DNS lookups\ndns.flags.rcode != 0\n\n# Specific domain queries\ndns.qry.name contains \"domain.com\"\n```\n\n### Phase 6: Expert Information\n\n#### Access Expert Analysis\nView Wireshark's automated findings:\n\n```\nAnalyze > Expert Information\n\nCategories:\n- Errors: Critical issues\n- Warnings: Potential problems\n- Notes: Informational items\n- Chats: Normal conversation events\n```\n\n#### Common Expert Findings\n| Finding | Meaning | Action |\n|---------|---------|--------|\n| TCP Retransmission | Packet resent | Check for packet loss |\n| Duplicate ACK | Possible loss | Investigate network path |\n| Zero Window | Buffer full | Check receiver performance |\n| RST | Connection reset | Check for blocks\u002Ferrors |\n| Out-of-Order | Packets reordered | Usually normal, excessive is issue |\n\n## Quick Reference\n\n### Keyboard Shortcuts\n| Action | Shortcut |\n|--------|----------|\n| Open file | Ctrl+O |\n| Save file | Ctrl+S |\n| Start\u002FStop capture | Ctrl+E |\n| Find packet | Ctrl+F |\n| Go to packet | Ctrl+G |\n| Next packet | ↓ |\n| Previous packet | ↑ |\n| First packet | Ctrl+Home |\n| Last packet | Ctrl+End |\n| Apply filter | Enter |\n| Clear filter | Ctrl+Shift+X |\n\n### Common Filter Reference\n```\n# Web traffic\nhttp || https\n\n# Email\nsmtp || pop || imap\n\n# File sharing  \nsmb || smb2 || ftp\n\n# Authentication\nldap || kerberos\n\n# Network management\nsnmp || icmp\n\n# Encrypted\ntls || ssl\n```\n\n### Export Options\n```\nFile > Export Specified Packets    # Save filtered subset\nFile > Export Objects > HTTP       # Extract HTTP files\nFile > Export Packet Dissections   # Export as text\u002FCSV\n```\n\n## Constraints and Guardrails\n\n### Operational Boundaries\n- Capture only authorized network traffic\n- Handle captured data according to privacy policies\n- Avoid capturing sensitive credentials unnecessarily\n- Properly secure PCAP files containing sensitive data\n\n### Technical Limitations\n- Large captures consume significant memory\n- Encrypted traffic content not visible without keys\n- High-speed networks may drop packets\n- Some protocols require plugins for full decoding\n\n### Best Practices\n- Use capture filters to limit data collection\n- Save captures regularly during long sessions\n- Use display filters rather than deleting packets\n- Document analysis findings and methodology\n\n## Examples\n\n### Example 1: HTTP Credential Analysis\n\n**Scenario**: Investigate potential plaintext credential transmission\n\n```\n1. Filter: http.request.method == \"POST\"\n2. Look for login forms\n3. Follow HTTP Stream\n4. Search for username\u002Fpassword parameters\n```\n\n**Finding**: Credentials transmitted in cleartext form data.\n\n### Example 2: Malware C2 Detection\n\n**Scenario**: Identify command and control traffic\n\n```\n1. Filter: dns\n2. Look for unusual query patterns\n3. Check for high-frequency beaconing\n4. Identify domains with random-looking names\n5. Filter: ip.dst == SUSPICIOUS_IP\n6. Analyze traffic patterns\n```\n\n**Indicators**:\n- Regular timing intervals\n- Encoded\u002Fencrypted payloads\n- Unusual ports or protocols\n\n### Example 3: Network Troubleshooting\n\n**Scenario**: Diagnose slow web application\n\n```\n1. Filter: ip.addr == WEB_SERVER\n2. Check Statistics > Service Response Time\n3. Filter: tcp.analysis.retransmission\n4. Review I\u002FO Graph for patterns\n5. Check for high latency or packet loss\n```\n\n**Finding**: TCP retransmissions indicating network congestion.\n\n## Troubleshooting\n\n### No Packets Captured\n- Verify correct interface selected\n- Check for admin\u002Froot permissions\n- Confirm network adapter is active\n- Disable promiscuous mode if issues persist\n\n### Filter Not Working\n- Verify filter syntax (red = error)\n- Check for typos in field names\n- Use Expression button for valid fields\n- Clear filter and rebuild incrementally\n\n### Performance Issues\n- Use capture filters to limit traffic\n- Split large captures into smaller files\n- Disable name resolution during capture\n- Close unnecessary protocol dissectors\n\n### Cannot Decrypt TLS\u002FSSL\n- Obtain server private key\n- Configure at Edit > Preferences > Protocols > TLS\n- For ephemeral keys, capture pre-master secret from browser\n- Some modern ciphers cannot be decrypted passively\n",{"name":5,"metadata":49,"description":7},{"author":50,"version":51},"zebbern","1.1","main","2b749c82b5d11fac39d9a6e021ce3f5b8a541bd1","cli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwireshark-analysis",3911,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates","https:\u002F\u002Faitmpl.com","https:\u002F\u002Fgithub.com\u002Fdavila7","https:\u002F\u002Fdanielavila.me","Building AI dev tools with LLMs","2026-11-11 21:38:31",{"source":8,"skillName":5,"commands":63,"prompt":73,"zipAvailable":74},[64,67,70],{"tool":65,"command":66},"npx","npx skills add davila7\u002Fclaude-code-templates --skill wireshark-analysis",{"tool":68,"command":69},"bunx","bunx skills add davila7\u002Fclaude-code-templates --skill wireshark-analysis",{"tool":71,"command":72},"pnpm","pnpm dlx skills add davila7\u002Fclaude-code-templates --skill wireshark-analysis","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwireshark-analysis\u002FSKILL.md",true,[],[77,102,129,162,197,221],{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":84,"publishedAt":44},"01M70NHBTQ8BV0A2SCAZXEPHCX","wealthville-pool-scoring","Score DeFi liquidity pools before providing liquidity. Returns a 0-100 pool score and an Enter\u002FHold\u002FExit\u002FReduce\u002FAvoid verdict with calibrated confidence for ~68,800 Solana pools and 575 EVM pools, plus a public miss-inclusive track record. Use when asked whether a pool is worth LPing into, which pools look best right now, or how accurate the scores have actually been.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fweb-data\u002Fwealthville-pool-scoring\u002FSKILL.md",[83],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[85,86,87,88,89,29,90,91,92,28,93,33,94,95,96,97,98,99,100,101],"scoring","pool","wealthville pool scoring","liquidity","which","exit","now","use","reduce","record","track","verdict","evm","solana","how","public","look",{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":109,"publishedAt":44},"01M70MB6VR8ERJ4EM8D5KHBMEV","technical-debt-auditor","Scans a codebase and produces a quantified technical debt report with a prioritized remediation plan. Analyzes dead code, TODO\u002FFIXME\u002FHACK markers, dependency staleness, complexity hotspots, code duplication signals, test coverage gaps, unused exports, and outdated patterns. Use this skill when the user asks to audit their codebase for tech debt, wants a health check of their code quality, says things like \"where should I focus refactoring\", \"find code smells\", \"audit my codebase\", \"what technical debt do we have\", \"prioritize cleanup work\", or asks about code quality metrics. Also trigger when the user mentions \"code rot\", \"legacy cleanup\", \"refactoring priorities\", or wants to understand the overall health of a project before a major effort. Trigger even if the user doesn't say \"technical debt\" explicitly — any request to systematically assess code quality and identify improvement priorities belongs here.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Ftechnical-debt-auditor\u002FSKILL.md",[108],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[110,111,112,113,114,115,116,117,118,119,120,28,121,122,123,124,125,126,127,128],"technical debt","debt","technical","technical debt auditor","auditor","coverage","complexity","markers","project","cleanup","unused","code","todo","work","plan","focus","signals","audit","dependency",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":144,"publishedAt":44},"01M70KPYH9QNHCNME5GJQGE22K","readonly-sql-guard","Make an agent's database access provably read-only. Use when an agent runs caller-supplied SQL against a production\u002FERP\u002Fanalytics database (a \"query\" MCP tool, text-to-SQL, an admin console), or when reviewing DB-access code for write\u002FDDL\u002Fside-effect\u002Ftransaction-escape risks. Checks what a statement CALLS, not just its shape.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdatabase\u002Freadonly-sql-guard\u002FSKILL.md",[135,138,139],{"categoryNo":136,"categoryName":137,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":140,"categoryName":141,"taxonomyType":142,"taxonomyTypeDesc":143},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[145,146,147,148,149,150,151,29,152,153,154,155,156,157,158,92,159,160,28,161],"readonly","guard","sql guard","sql","readonly sql guard","erp","effect","read-only","db","just","tool","calls","only","MCP","access","database","query",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":166,"licenseFileUrl":167,"sourceHtmlUrl":168,"categories":169,"keywords":173,"publishedAt":44},"01M6AFY6F7CC2BBZP1QD6VTNVC","web-artifacts-builder","Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn\u002Fui). Use for complex artifacts requiring state management, routing, or shadcn\u002Fui components - not for simple single-file HTML\u002FJSX artifacts.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FSKILL.md",[170],{"categoryNo":171,"categoryName":172,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",[174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,29,196],"artifacts builder","web","web artifacts builder","artifacts","builder","state","routing","state management","component","css","frontend","ui","Tools","file","components","shadcn","react","Tailwind","suite","jsx","html","single-file","ui components",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":166,"licenseFileUrl":201,"sourceHtmlUrl":202,"categories":203,"keywords":208,"publishedAt":44},"01M6AFWF33SFV9Z3SF4PEEE4BF","webapp-testing","Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FSKILL.md",[204,207],{"categoryNo":205,"categoryName":206,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":171,"categoryName":172,"taxonomyType":21,"taxonomyTypeDesc":22},[209,210,211,212,213,175,214,184,185,215,216,217,218,29,219,33,220],"webapp testing","testing","webapp","browser","playwright","applications","debugging","toolkit","logs","screenshots","local","behavior",{"skillNo":222,"name":223,"nameZh":6,"description":224,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":166,"licenseFileUrl":225,"sourceHtmlUrl":226,"categories":227,"keywords":235,"publishedAt":44},"01M6AF67Q67JJJ5V51JR2P52KA","discernment-nudge","After you give a substantive answer or draft that the user may act on — advice or recommendations, drafted artifacts such as goals, plans, pitches, proposals, or emails, estimates or projections, analysis or interpretation of data, factual claims they may rely on, or a multi-step argument — invoke this skill BEFORE finalizing your reply and then, if it applies, append 2-3 short follow-up questions, each tied to something specific in what you just produced, that help the user check key facts, probe the reasoning or assumptions, and notice missing context. Do this at most once per conversation. Skip it when the user asked a trivial how-to or simple lookup, wants a purely educational explanation, asked you only to format, convert, or assemble a file from content they provided, is writing code they will run, is doing creative writing or casual chat, or already asked you to double-check, cite, or review — the skill file explains these boundaries and the exact output format.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fdiscernment-nudge\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fdiscernment-nudge\u002FSKILL.md",[228,231,232],{"categoryNo":229,"categoryName":230,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":233,"categoryName":234,"taxonomyType":142,"taxonomyTypeDesc":143},"01JBSEEDCAT000000000000036","内容创作者",[236,237,238,239,240,241,242,243,177,244,187,121,245,246,247,248,249,157,250,28,251,25,252,253,254,99,255],"discernment nudge","nudge","interpretation","help","run","reasoning","data","writing","lookup","content","review","conversation","short","up","invoke","you","claims","argument","assemble","recommendations"]