[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EK05E4FADTT5MBNGN5VC98":3,"skill-same:01M6EK05E4FADTT5MBNGN5VC98":125},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":74,"commitSha":75,"skillDirectory":76,"forksCount":77,"repositoryHtmlUrl":78,"repositoryHomepageUrl":79,"ownerHtmlUrl":80,"ownerBlogUrl":6,"ownerDescription":81,"updatedAt":82,"install":83,"resources":96},"01M6EK05E4FADTT5MBNGN5VC98","analysis-tshark",null,"Network protocol analyzer and packet capture tool for traffic analysis, security investigations, and forensic examination using Wireshark's command-line interface. Use when: (1) Analyzing network traffic for security incidents and malware detection, (2) Capturing and filtering packets for forensic analysis, (3) Extracting credentials and sensitive data from network captures, (4) Investigating network anomalies and attack patterns, (5) Validating encryption and security controls, (6) Performing protocol analysis for vulnerability research.","ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",66,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fanalysis-tshark\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"analysis tshark","tshark","analysis","credentials","org","line","man","malware detection","command","wiki","vulnerability","gmail","NIST","encryption","data","network","analyzing","MITRE-ATT&CK","malware","security","2026-11-10 10:12:30",false,"---\nname: analysis-tshark\ndescription: >\n  Network protocol analyzer and packet capture tool for traffic analysis, security investigations,\n  and forensic examination using Wireshark's command-line interface. Use when: (1) Analyzing network\n  traffic for security incidents and malware detection, (2) Capturing and filtering packets for\n  forensic analysis, (3) Extracting credentials and sensitive data from network captures, (4)\n  Investigating network anomalies and attack patterns, (5) Validating encryption and security\n  controls, (6) Performing protocol analysis for vulnerability research.\nversion: 0.1.0\nmaintainer: sirappsec@gmail.com\ncategory: offsec\ntags: [packet-capture, network-analysis, forensics, tshark, wireshark, traffic-analysis]\nframeworks: [MITRE-ATT&CK, NIST]\ndependencies:\n  packages: [tshark, wireshark]\n  tools: [tcpdump, python3]\nreferences:\n  - https:\u002F\u002Fwww.wireshark.org\u002Fdocs\u002Fman-pages\u002Ftshark.html\n  - https:\u002F\u002Fwiki.wireshark.org\u002FDisplayFilters\n  - https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1040\u002F\n---\n\n# TShark Network Protocol Analyzer\n\n## Overview\n\nTShark is the command-line network protocol analyzer from the Wireshark project. It provides powerful packet capture and analysis capabilities for security investigations, forensic analysis, and network troubleshooting. This skill covers authorized security operations including traffic analysis, credential extraction, malware detection, and forensic examination.\n\n**IMPORTANT**: Network packet capture may expose sensitive information and must only be conducted with proper authorization. Ensure legal compliance and privacy considerations before capturing network traffic.\n\n## Quick Start\n\nBasic packet capture and analysis:\n\n```bash\n# Capture packets on interface\nsudo tshark -i eth0\n\n# Capture 100 packets and save to file\nsudo tshark -i eth0 -c 100 -w capture.pcap\n\n# Read and analyze capture file\ntshark -r capture.pcap\n\n# Apply display filter\ntshark -r capture.pcap -Y \"http.request.method == GET\"\n\n# Extract HTTP objects\ntshark -r capture.pcap --export-objects http,extracted_files\u002F\n```\n\n## Core Workflow\n\n### Network Analysis Workflow\n\nProgress:\n[ ] 1. Verify authorization for packet capture\n[ ] 2. Identify target interface and capture requirements\n[ ] 3. Capture network traffic with appropriate filters\n[ ] 4. Analyze captured packets for security indicators\n[ ] 5. Extract artifacts (files, credentials, sessions)\n[ ] 6. Document findings and security implications\n[ ] 7. Securely handle and store capture files\n[ ] 8. Clean up sensitive data per retention policy\n\nWork through each step systematically. Check off completed items.\n\n### 1. Authorization Verification\n\n**CRITICAL**: Before any packet capture:\n- Confirm written authorization for network monitoring\n- Verify legal compliance (wiretapping laws, privacy regulations)\n- Understand data handling and retention requirements\n- Document scope of capture (interfaces, duration, filters)\n- Ensure secure storage for captured data\n\n### 2. Interface Discovery\n\nIdentify available network interfaces:\n\n```bash\n# List all interfaces\ntshark -D\n\n# List with interface details\nsudo tshark -D\n\n# Capture on specific interface\nsudo tshark -i eth0\nsudo tshark -i wlan0\n\n# Capture on any interface\nsudo tshark -i any\n\n# Capture on multiple interfaces\nsudo tshark -i eth0 -i wlan0\n```\n\n**Interface types**:\n- **eth0\u002Fens33**: Ethernet interface\n- **wlan0**: Wireless interface\n- **lo**: Loopback interface\n- **any**: All interfaces (Linux only)\n- **mon0**: Monitor mode interface (wireless)\n\n### 3. Basic Packet Capture\n\nCapture network traffic:\n\n```bash\n# Capture indefinitely (Ctrl+C to stop)\nsudo tshark -i eth0\n\n# Capture specific number of packets\nsudo tshark -i eth0 -c 1000\n\n# Capture for specific duration (seconds)\nsudo tshark -i eth0 -a duration:60\n\n# Capture to file\nsudo tshark -i eth0 -w capture.pcap\n\n# Capture with ring buffer (rotate files)\nsudo tshark -i eth0 -w capture.pcap -b filesize:100000 -b files:5\n```\n\n**Capture options**:\n- `-c \u003Ccount>`: Capture packet count\n- `-a duration:\u003Csec>`: Auto-stop after duration\n- `-w \u003Cfile>`: Write to file\n- `-b filesize:\u003CKB>`: Rotate at file size\n- `-b files:\u003Cnum>`: Keep N ring buffer files\n\n### 4. Capture Filters\n\nApply BPF (Berkeley Packet Filter) during capture for efficiency:\n\n```bash\n# Capture only HTTP traffic\nsudo tshark -i eth0 -f \"tcp port 80\"\n\n# Capture specific host\nsudo tshark -i eth0 -f \"host 192.168.1.100\"\n\n# Capture subnet\nsudo tshark -i eth0 -f \"net 192.168.1.0\u002F24\"\n\n# Capture multiple ports\nsudo tshark -i eth0 -f \"tcp port 80 or tcp port 443\"\n\n# Exclude specific traffic\nsudo tshark -i eth0 -f \"not port 22\"\n\n# Capture SYN packets only\nsudo tshark -i eth0 -f \"tcp[tcpflags] & tcp-syn != 0\"\n```\n\n**Common capture filters**:\n- `host \u003Cip>`: Traffic to\u002Ffrom IP\n- `net \u003Ccidr>`: Traffic to\u002Ffrom network\n- `port \u003Cport>`: Specific port\n- `tcp|udp|icmp`: Protocol type\n- `src|dst`: Direction filter\n- `and|or|not`: Logical operators\n\n### 5. Display Filters\n\nAnalyze captured traffic with Wireshark display filters:\n\n```bash\n# HTTP requests only\ntshark -r capture.pcap -Y \"http.request\"\n\n# HTTP responses\ntshark -r capture.pcap -Y \"http.response\"\n\n# DNS queries\ntshark -r capture.pcap -Y \"dns.flags.response == 0\"\n\n# TLS handshakes\ntshark -r capture.pcap -Y \"tls.handshake.type == 1\"\n\n# Suspicious traffic patterns\ntshark -r capture.pcap -Y \"tcp.flags.syn==1 and tcp.flags.ack==0\"\n\n# Failed connections\ntshark -r capture.pcap -Y \"tcp.flags.reset==1\"\n```\n\n**Advanced display filters**:\n\n```bash\n# HTTP POST requests with credentials\ntshark -r capture.pcap -Y \"http.request.method == POST and (http contains \\\"password\\\" or http contains \\\"username\\\")\"\n\n# SMB file transfers\ntshark -r capture.pcap -Y \"smb2.cmd == 8 or smb2.cmd == 9\"\n\n# Suspicious User-Agents\ntshark -r capture.pcap -Y \"http.user_agent contains \\\"python\\\" or http.user_agent contains \\\"curl\\\"\"\n\n# Large data transfers\ntshark -r capture.pcap -Y \"tcp.len > 1400\"\n\n# Beaconing detection (periodic traffic)\ntshark -r capture.pcap -Y \"http\" -T fields -e frame.time_relative -e ip.dst\n```\n\n### 6. Protocol Analysis\n\nAnalyze specific protocols:\n\n**HTTP\u002FHTTPS Analysis**:\n\n```bash\n# Extract HTTP requests\ntshark -r capture.pcap -Y \"http.request\" -T fields -e ip.src -e http.host -e http.request.uri\n\n# Extract HTTP User-Agents\ntshark -r capture.pcap -Y \"http.user_agent\" -T fields -e ip.src -e http.user_agent\n\n# HTTP status codes\ntshark -r capture.pcap -Y \"http.response\" -T fields -e ip.src -e http.response.code\n\n# Extract HTTP cookies\ntshark -r capture.pcap -Y \"http.cookie\" -T fields -e ip.src -e http.cookie\n```\n\n**DNS Analysis**:\n\n```bash\n# DNS queries\ntshark -r capture.pcap -Y \"dns.flags.response == 0\" -T fields -e ip.src -e dns.qry.name\n\n# DNS responses\ntshark -r capture.pcap -Y \"dns.flags.response == 1\" -T fields -e dns.qry.name -e dns.a\n\n# DNS tunneling detection (long domain names)\ntshark -r capture.pcap -Y \"dns\" -T fields -e dns.qry.name | awk 'length > 50'\n\n# DNS query types\ntshark -r capture.pcap -Y \"dns\" -T fields -e dns.qry.type -e dns.qry.name\n```\n\n**TLS\u002FSSL Analysis**:\n\n```bash\n# TLS handshakes\ntshark -r capture.pcap -Y \"tls.handshake.type == 1\" -T fields -e ip.src -e ip.dst -e tls.handshake.extensions_server_name\n\n# TLS certificates\ntshark -r capture.pcap -Y \"tls.handshake.certificate\" -T fields -e tls.handshake.certificate\n\n# SSL\u002FTLS versions\ntshark -r capture.pcap -Y \"tls\" -T fields -e tls.record.version\n\n# Weak cipher suites\ntshark -r capture.pcap -Y \"tls.handshake.ciphersuite\" -T fields -e tls.handshake.ciphersuite\n```\n\n**SMB\u002FCIFS Analysis**:\n\n```bash\n# SMB file access\ntshark -r capture.pcap -Y \"smb2\" -T fields -e ip.src -e smb2.filename\n\n# SMB authentication\ntshark -r capture.pcap -Y \"ntlmssp\" -T fields -e ip.src -e ntlmssp.auth.username\n\n# SMB commands\ntshark -r capture.pcap -Y \"smb2\" -T fields -e smb2.cmd\n```\n\n### 7. Credential Extraction\n\nExtract credentials from network traffic (authorized forensics only):\n\n**HTTP Basic Authentication**:\n\n```bash\n# Extract HTTP Basic Auth credentials\ntshark -r capture.pcap -Y \"http.authbasic\" -T fields -e ip.src -e http.authbasic\n\n# Decode Base64 credentials\ntshark -r capture.pcap -Y \"http.authorization\" -T fields -e http.authorization | base64 -d\n```\n\n**FTP Credentials**:\n\n```bash\n# Extract FTP usernames\ntshark -r capture.pcap -Y \"ftp.request.command == USER\" -T fields -e ip.src -e ftp.request.arg\n\n# Extract FTP passwords\ntshark -r capture.pcap -Y \"ftp.request.command == PASS\" -T fields -e ip.src -e ftp.request.arg\n```\n\n**NTLM\u002FKerberos**:\n\n```bash\n# Extract NTLM hashes\ntshark -r capture.pcap -Y \"ntlmssp.auth.ntlmv2response\" -T fields -e ntlmssp.auth.username -e ntlmssp.auth.domain -e ntlmssp.auth.ntlmv2response\n\n# Kerberos tickets\ntshark -r capture.pcap -Y \"kerberos.CNameString\" -T fields -e kerberos.CNameString -e kerberos.realm\n```\n\n**Email Credentials**:\n\n```bash\n# SMTP authentication\ntshark -r capture.pcap -Y \"smtp.req.command == AUTH\" -T fields -e ip.src\n\n# POP3 credentials\ntshark -r capture.pcap -Y \"pop.request.command == USER or pop.request.command == PASS\" -T fields -e pop.request.parameter\n\n# IMAP credentials\ntshark -r capture.pcap -Y \"imap.request contains \\\"LOGIN\\\"\" -T fields -e imap.request\n```\n\n### 8. File Extraction\n\nExtract files from packet captures:\n\n```bash\n# Export HTTP objects\ntshark -r capture.pcap --export-objects http,extracted_http\u002F\n\n# Export SMB objects\ntshark -r capture.pcap --export-objects smb,extracted_smb\u002F\n\n# Export DICOM objects\ntshark -r capture.pcap --export-objects dicom,extracted_dicom\u002F\n\n# Export IMF (email) objects\ntshark -r capture.pcap --export-objects imf,extracted_email\u002F\n```\n\n**Manual file reconstruction**:\n\n```bash\n# Extract file data from HTTP response\ntshark -r capture.pcap -Y \"http.response and http.content_type contains \\\"application\u002Fpdf\\\"\" -T fields -e data.data | xxd -r -p > extracted_file.pdf\n\n# Reassemble TCP stream\ntshark -r capture.pcap -q -z follow,tcp,ascii,\u003Cstream-number>\n```\n\n### 9. Malware Detection\n\nIdentify malicious network activity:\n\n```bash\n# Detect common C2 beaconing patterns\ntshark -r capture.pcap -Y \"http\" -T fields -e frame.time_relative -e ip.dst -e http.host | sort | uniq -c | sort -rn\n\n# Suspicious DNS queries (DGA domains)\ntshark -r capture.pcap -Y \"dns.qry.name\" -T fields -e dns.qry.name | awk -F'.' '{print $(NF-1)\".\"$NF}' | sort | uniq -c | sort -rn\n\n# Detect port scanning\ntshark -r capture.pcap -Y \"tcp.flags.syn==1 and tcp.flags.ack==0\" -T fields -e ip.src -e ip.dst -e tcp.dstport | sort | uniq -c | sort -rn\n\n# Detect data exfiltration (large uploads)\ntshark -r capture.pcap -Y \"http.request.method == POST\" -T fields -e ip.src -e http.content_length | awk '$2 > 1000000'\n\n# Suspicious executable downloads\ntshark -r capture.pcap -Y \"http.response and (http.content_type contains \\\"application\u002Fexe\\\" or http.content_type contains \\\"application\u002Fx-dosexec\\\")\"\n```\n\n### 10. Statistics and Reporting\n\nGenerate traffic statistics:\n\n```bash\n# Protocol hierarchy\ntshark -r capture.pcap -q -z io,phs\n\n# Conversation statistics\ntshark -r capture.pcap -q -z conv,tcp\ntshark -r capture.pcap -q -z conv,udp\ntshark -r capture.pcap -q -z conv,ip\n\n# HTTP statistics\ntshark -r capture.pcap -q -z http,tree\n\n# DNS statistics\ntshark -r capture.pcap -q -z dns,tree\n\n# Endpoints\ntshark -r capture.pcap -q -z endpoints,tcp\ntshark -r capture.pcap -q -z endpoints,udp\n\n# Expert info (warnings\u002Ferrors)\ntshark -r capture.pcap -q -z expert\n```\n\n## Security Considerations\n\n### Authorization & Legal Compliance\n\n- **Written Authorization**: Obtain explicit permission for network monitoring\n- **Privacy Laws**: Comply with wiretapping and privacy regulations (GDPR, CCPA, ECPA)\n- **Data Minimization**: Capture only necessary traffic for investigation\n- **Credential Handling**: Treat extracted credentials as highly sensitive\n- **Retention Policy**: Follow data retention and secure deletion requirements\n\n### Operational Security\n\n- **Encrypted Storage**: Encrypt capture files at rest\n- **Access Control**: Restrict access to packet captures\n- **Secure Transfer**: Use encrypted channels for capture file transfer\n- **Anonymization**: Remove or redact PII when sharing captures\n- **Chain of Custody**: Maintain forensic integrity for legal proceedings\n\n### Audit Logging\n\nDocument all packet capture activities:\n- Capture start and end timestamps\n- Interface(s) captured\n- Capture filters applied\n- File names and storage locations\n- Personnel who accessed captures\n- Purpose of capture and investigation findings\n- Secure deletion timestamps\n\n### Compliance\n\n- **MITRE ATT&CK**: T1040 (Network Sniffing)\n- **NIST CSF**: DE.AE (Detection Processes - Anomalies and Events)\n- **PCI-DSS**: Network security monitoring requirements\n- **ISO 27001**: A.12.4 Logging and monitoring\n- **GDPR**: Data protection and privacy requirements\n\n## Common Patterns\n\n### Pattern 1: Incident Response Investigation\n\n```bash\n# Capture traffic during incident\nsudo tshark -i eth0 -w incident_$(date +%Y%m%d_%H%M%S).pcap -a duration:300\n\n# Analyze for lateral movement\ntshark -r incident.pcap -Y \"smb2 or rdp or ssh\" -T fields -e ip.src -e ip.dst\n\n# Identify C2 communication\ntshark -r incident.pcap -Y \"http or dns\" -T fields -e ip.dst -e http.host -e dns.qry.name\n\n# Extract IOCs\ntshark -r incident.pcap -Y \"ip.dst\" -T fields -e ip.dst | sort -u > ioc_ips.txt\ntshark -r incident.pcap -Y \"dns.qry.name\" -T fields -e dns.qry.name | sort -u > ioc_domains.txt\n```\n\n### Pattern 2: Malware Traffic Analysis\n\n```bash\n# Capture malware sandbox traffic\nsudo tshark -i eth0 -w malware_traffic.pcap\n\n# Extract C2 indicators\ntshark -r malware_traffic.pcap -Y \"http.host\" -T fields -e ip.src -e http.host -e http.user_agent\n\n# Identify DNS tunneling\ntshark -r malware_traffic.pcap -Y \"dns\" -T fields -e dns.qry.name | awk 'length > 50'\n\n# Extract downloaded payloads\ntshark -r malware_traffic.pcap --export-objects http,malware_artifacts\u002F\n\n# Analyze encryption\u002Fencoding\ntshark -r malware_traffic.pcap -Y \"http.request.method == POST\" -T fields -e data.data\n```\n\n### Pattern 3: Credential Harvesting Detection\n\n```bash\n# Monitor for credential transmission\nsudo tshark -i eth0 -Y \"(http.authorization or ftp or pop or imap) and not tls\" -T fields -e ip.src -e ip.dst\n\n# Extract all HTTP POST data\ntshark -r capture.pcap -Y \"http.request.method == POST\" -T fields -e http.file_data > post_data.txt\n\n# Search for password keywords\ntshark -r capture.pcap -Y \"http contains \\\"password\\\" or http contains \\\"passwd\\\"\" -T fields -e ip.src -e http.request.uri\n\n# NTLM hash extraction\ntshark -r capture.pcap -Y \"ntlmssp.auth.ntlmv2response\" -T fields -e ntlmssp.auth.username -e ntlmssp.auth.domain -e ntlmssp.auth.ntlmv2response > ntlm_hashes.txt\n```\n\n### Pattern 4: Network Forensics\n\n```bash\n# Reconstruct HTTP conversation\ntshark -r capture.pcap -q -z follow,http,ascii,0\n\n# Timeline analysis\ntshark -r capture.pcap -T fields -e frame.time -e ip.src -e ip.dst -e tcp.dstport\n\n# Identify file transfers\ntshark -r capture.pcap -Y \"http.content_type contains \\\"application\u002F\\\" or ftp-data\" -T fields -e frame.number -e http.content_type\n\n# Geolocation of connections (requires GeoIP)\ntshark -r capture.pcap -T fields -e ip.src -e ip.dst -e ip.geoip.src_country -e ip.geoip.dst_country\n```\n\n### Pattern 5: Wireless Security Assessment\n\n```bash\n# Capture wireless traffic (monitor mode required)\nsudo tshark -i mon0 -w wireless_capture.pcap\n\n# Identify wireless networks\ntshark -r wireless_capture.pcap -Y \"wlan.fc.type_subtype == 0x08\" -T fields -e wlan.ssid -e wlan.bssid\n\n# Detect deauth attacks\ntshark -r wireless_capture.pcap -Y \"wlan.fc.type_subtype == 0x0c\"\n\n# WPA handshake capture\ntshark -r wireless_capture.pcap -Y \"eapol\"\n\n# Client probing activity\ntshark -r wireless_capture.pcap -Y \"wlan.fc.type_subtype == 0x04\" -T fields -e wlan.sa -e wlan.ssid\n```\n\n## Integration Points\n\n### SIEM Integration\n\nExport packet analysis to SIEM platforms:\n\n```bash\n# Export to JSON for Splunk\u002FELK\ntshark -r capture.pcap -T ek > packets.json\n\n# Export specific fields in JSON\ntshark -r capture.pcap -Y \"http\" -T json -e ip.src -e ip.dst -e http.host -e http.request.uri\n\n# CSV export for analysis\ntshark -r capture.pcap -T fields -E separator=, -e frame.time -e ip.src -e ip.dst -e tcp.dstport > packets.csv\n```\n\n### Scripting and Automation\n\n```bash\n#!\u002Fbin\u002Fbash\n# continuous_monitor.sh - Continuous network monitoring\n\nINTERFACE=\"eth0\"\nALERT_FILTER=\"http contains \\\"cmd.exe\\\" or dns.qry.name contains \\\".tk\\\" or dns.qry.name contains \\\".xyz\\\"\"\n\nsudo tshark -i $INTERFACE -Y \"$ALERT_FILTER\" -T fields -e frame.time -e ip.src -e ip.dst -e http.host -e dns.qry.name | \\\nwhile read line; do\n  echo \"[ALERT] $(date): $line\" | tee -a security_alerts.log\n  # Trigger incident response workflow\n  echo \"$line\" | mail -s \"Security Alert\" soc@company.com\ndone\n```\n\n## Troubleshooting\n\n### Issue: \"Permission denied\" when capturing\n\n**Solutions**:\n```bash\n# Run with sudo\nsudo tshark -i eth0\n\n# Or add user to wireshark group (Linux)\nsudo usermod -a -G wireshark $USER\nsudo setcap cap_net_raw,cap_net_admin+eip \u002Fusr\u002Fbin\u002Ftshark\n\n# Logout and login for group changes to take effect\n```\n\n### Issue: \"No interfaces found\"\n\n**Solutions**:\n```bash\n# Verify tshark installation\ntshark --version\n\n# List interfaces with sudo\nsudo tshark -D\n\n# Check interface status\nip link show\nifconfig -a\n```\n\n### Issue: Capture file is huge\n\n**Solutions**:\n```bash\n# Use capture filters to reduce size\nsudo tshark -i eth0 -f \"not port 22\" -w capture.pcap\n\n# Use ring buffer\nsudo tshark -i eth0 -w capture.pcap -b filesize:100000 -b files:5\n\n# Limit packet size (snaplen)\nsudo tshark -i eth0 -s 128 -w capture.pcap\n```\n\n### Issue: Cannot decrypt TLS traffic\n\n**Solutions**:\n```bash\n# Provide SSL key log file (requires SSLKEYLOGFILE environment variable)\ntshark -r capture.pcap -o tls.keylog_file:sslkeys.log -Y \"http\"\n\n# Use pre-master secret\ntshark -r capture.pcap -o tls.keys_list:192.168.1.100,443,http,\u002Fpath\u002Fto\u002Fserver.key\n```\n\n## Defensive Considerations\n\nOrganizations should protect against unauthorized packet capture:\n\n- **Network Segmentation**: Reduce exposure to packet sniffing\n- **Encryption**: Use TLS\u002FSSL to protect sensitive data in transit\n- **Switch Security**: Enable port security and DHCP snooping\n- **Wireless Security**: Use WPA3, disable broadcast SSID\n- **Intrusion Detection**: Monitor for promiscuous mode interfaces\n- **Physical Security**: Protect network infrastructure from tap devices\n\nDetect packet capture activity:\n- Monitor for promiscuous mode network interfaces\n- Detect ARP spoofing and MAC flooding attacks\n- Audit administrative access to network devices\n- Monitor for unusual outbound data transfers\n- Deploy network access control (802.1X)\n\n## References\n\n- [TShark Man Page](https:\u002F\u002Fwww.wireshark.org\u002Fdocs\u002Fman-pages\u002Ftshark.html)\n- [Wireshark Display Filters](https:\u002F\u002Fwiki.wireshark.org\u002FDisplayFilters)\n- [MITRE ATT&CK: Network Sniffing](https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1040\u002F)\n- [NIST SP 800-92: Guide to Computer Security Log Management](https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fdetail\u002Fsp\u002F800-92\u002Ffinal)\n- [Practical Packet Analysis Book](https:\u002F\u002Fnostarch.com\u002Fpacketanalysis3)\n","# TShark Network Protocol Analyzer\n\n## Overview\n\nTShark is the command-line network protocol analyzer from the Wireshark project. It provides powerful packet capture and analysis capabilities for security investigations, forensic analysis, and network troubleshooting. This skill covers authorized security operations including traffic analysis, credential extraction, malware detection, and forensic examination.\n\n**IMPORTANT**: Network packet capture may expose sensitive information and must only be conducted with proper authorization. Ensure legal compliance and privacy considerations before capturing network traffic.\n\n## Quick Start\n\nBasic packet capture and analysis:\n\n```bash\n# Capture packets on interface\nsudo tshark -i eth0\n\n# Capture 100 packets and save to file\nsudo tshark -i eth0 -c 100 -w capture.pcap\n\n# Read and analyze capture file\ntshark -r capture.pcap\n\n# Apply display filter\ntshark -r capture.pcap -Y \"http.request.method == GET\"\n\n# Extract HTTP objects\ntshark -r capture.pcap --export-objects http,extracted_files\u002F\n```\n\n## Core Workflow\n\n### Network Analysis Workflow\n\nProgress:\n[ ] 1. Verify authorization for packet capture\n[ ] 2. Identify target interface and capture requirements\n[ ] 3. Capture network traffic with appropriate filters\n[ ] 4. Analyze captured packets for security indicators\n[ ] 5. Extract artifacts (files, credentials, sessions)\n[ ] 6. Document findings and security implications\n[ ] 7. Securely handle and store capture files\n[ ] 8. Clean up sensitive data per retention policy\n\nWork through each step systematically. Check off completed items.\n\n### 1. Authorization Verification\n\n**CRITICAL**: Before any packet capture:\n- Confirm written authorization for network monitoring\n- Verify legal compliance (wiretapping laws, privacy regulations)\n- Understand data handling and retention requirements\n- Document scope of capture (interfaces, duration, filters)\n- Ensure secure storage for captured data\n\n### 2. Interface Discovery\n\nIdentify available network interfaces:\n\n```bash\n# List all interfaces\ntshark -D\n\n# List with interface details\nsudo tshark -D\n\n# Capture on specific interface\nsudo tshark -i eth0\nsudo tshark -i wlan0\n\n# Capture on any interface\nsudo tshark -i any\n\n# Capture on multiple interfaces\nsudo tshark -i eth0 -i wlan0\n```\n\n**Interface types**:\n- **eth0\u002Fens33**: Ethernet interface\n- **wlan0**: Wireless interface\n- **lo**: Loopback interface\n- **any**: All interfaces (Linux only)\n- **mon0**: Monitor mode interface (wireless)\n\n### 3. Basic Packet Capture\n\nCapture network traffic:\n\n```bash\n# Capture indefinitely (Ctrl+C to stop)\nsudo tshark -i eth0\n\n# Capture specific number of packets\nsudo tshark -i eth0 -c 1000\n\n# Capture for specific duration (seconds)\nsudo tshark -i eth0 -a duration:60\n\n# Capture to file\nsudo tshark -i eth0 -w capture.pcap\n\n# Capture with ring buffer (rotate files)\nsudo tshark -i eth0 -w capture.pcap -b filesize:100000 -b files:5\n```\n\n**Capture options**:\n- `-c \u003Ccount>`: Capture packet count\n- `-a duration:\u003Csec>`: Auto-stop after duration\n- `-w \u003Cfile>`: Write to file\n- `-b filesize:\u003CKB>`: Rotate at file size\n- `-b files:\u003Cnum>`: Keep N ring buffer files\n\n### 4. Capture Filters\n\nApply BPF (Berkeley Packet Filter) during capture for efficiency:\n\n```bash\n# Capture only HTTP traffic\nsudo tshark -i eth0 -f \"tcp port 80\"\n\n# Capture specific host\nsudo tshark -i eth0 -f \"host 192.168.1.100\"\n\n# Capture subnet\nsudo tshark -i eth0 -f \"net 192.168.1.0\u002F24\"\n\n# Capture multiple ports\nsudo tshark -i eth0 -f \"tcp port 80 or tcp port 443\"\n\n# Exclude specific traffic\nsudo tshark -i eth0 -f \"not port 22\"\n\n# Capture SYN packets only\nsudo tshark -i eth0 -f \"tcp[tcpflags] & tcp-syn != 0\"\n```\n\n**Common capture filters**:\n- `host \u003Cip>`: Traffic to\u002Ffrom IP\n- `net \u003Ccidr>`: Traffic to\u002Ffrom network\n- `port \u003Cport>`: Specific port\n- `tcp|udp|icmp`: Protocol type\n- `src|dst`: Direction filter\n- `and|or|not`: Logical operators\n\n### 5. Display Filters\n\nAnalyze captured traffic with Wireshark display filters:\n\n```bash\n# HTTP requests only\ntshark -r capture.pcap -Y \"http.request\"\n\n# HTTP responses\ntshark -r capture.pcap -Y \"http.response\"\n\n# DNS queries\ntshark -r capture.pcap -Y \"dns.flags.response == 0\"\n\n# TLS handshakes\ntshark -r capture.pcap -Y \"tls.handshake.type == 1\"\n\n# Suspicious traffic patterns\ntshark -r capture.pcap -Y \"tcp.flags.syn==1 and tcp.flags.ack==0\"\n\n# Failed connections\ntshark -r capture.pcap -Y \"tcp.flags.reset==1\"\n```\n\n**Advanced display filters**:\n\n```bash\n# HTTP POST requests with credentials\ntshark -r capture.pcap -Y \"http.request.method == POST and (http contains \\\"password\\\" or http contains \\\"username\\\")\"\n\n# SMB file transfers\ntshark -r capture.pcap -Y \"smb2.cmd == 8 or smb2.cmd == 9\"\n\n# Suspicious User-Agents\ntshark -r capture.pcap -Y \"http.user_agent contains \\\"python\\\" or http.user_agent contains \\\"curl\\\"\"\n\n# Large data transfers\ntshark -r capture.pcap -Y \"tcp.len > 1400\"\n\n# Beaconing detection (periodic traffic)\ntshark -r capture.pcap -Y \"http\" -T fields -e frame.time_relative -e ip.dst\n```\n\n### 6. Protocol Analysis\n\nAnalyze specific protocols:\n\n**HTTP\u002FHTTPS Analysis**:\n\n```bash\n# Extract HTTP requests\ntshark -r capture.pcap -Y \"http.request\" -T fields -e ip.src -e http.host -e http.request.uri\n\n# Extract HTTP User-Agents\ntshark -r capture.pcap -Y \"http.user_agent\" -T fields -e ip.src -e http.user_agent\n\n# HTTP status codes\ntshark -r capture.pcap -Y \"http.response\" -T fields -e ip.src -e http.response.code\n\n# Extract HTTP cookies\ntshark -r capture.pcap -Y \"http.cookie\" -T fields -e ip.src -e http.cookie\n```\n\n**DNS Analysis**:\n\n```bash\n# DNS queries\ntshark -r capture.pcap -Y \"dns.flags.response == 0\" -T fields -e ip.src -e dns.qry.name\n\n# DNS responses\ntshark -r capture.pcap -Y \"dns.flags.response == 1\" -T fields -e dns.qry.name -e dns.a\n\n# DNS tunneling detection (long domain names)\ntshark -r capture.pcap -Y \"dns\" -T fields -e dns.qry.name | awk 'length > 50'\n\n# DNS query types\ntshark -r capture.pcap -Y \"dns\" -T fields -e dns.qry.type -e dns.qry.name\n```\n\n**TLS\u002FSSL Analysis**:\n\n```bash\n# TLS handshakes\ntshark -r capture.pcap -Y \"tls.handshake.type == 1\" -T fields -e ip.src -e ip.dst -e tls.handshake.extensions_server_name\n\n# TLS certificates\ntshark -r capture.pcap -Y \"tls.handshake.certificate\" -T fields -e tls.handshake.certificate\n\n# SSL\u002FTLS versions\ntshark -r capture.pcap -Y \"tls\" -T fields -e tls.record.version\n\n# Weak cipher suites\ntshark -r capture.pcap -Y \"tls.handshake.ciphersuite\" -T fields -e tls.handshake.ciphersuite\n```\n\n**SMB\u002FCIFS Analysis**:\n\n```bash\n# SMB file access\ntshark -r capture.pcap -Y \"smb2\" -T fields -e ip.src -e smb2.filename\n\n# SMB authentication\ntshark -r capture.pcap -Y \"ntlmssp\" -T fields -e ip.src -e ntlmssp.auth.username\n\n# SMB commands\ntshark -r capture.pcap -Y \"smb2\" -T fields -e smb2.cmd\n```\n\n### 7. Credential Extraction\n\nExtract credentials from network traffic (authorized forensics only):\n\n**HTTP Basic Authentication**:\n\n```bash\n# Extract HTTP Basic Auth credentials\ntshark -r capture.pcap -Y \"http.authbasic\" -T fields -e ip.src -e http.authbasic\n\n# Decode Base64 credentials\ntshark -r capture.pcap -Y \"http.authorization\" -T fields -e http.authorization | base64 -d\n```\n\n**FTP Credentials**:\n\n```bash\n# Extract FTP usernames\ntshark -r capture.pcap -Y \"ftp.request.command == USER\" -T fields -e ip.src -e ftp.request.arg\n\n# Extract FTP passwords\ntshark -r capture.pcap -Y \"ftp.request.command == PASS\" -T fields -e ip.src -e ftp.request.arg\n```\n\n**NTLM\u002FKerberos**:\n\n```bash\n# Extract NTLM hashes\ntshark -r capture.pcap -Y \"ntlmssp.auth.ntlmv2response\" -T fields -e ntlmssp.auth.username -e ntlmssp.auth.domain -e ntlmssp.auth.ntlmv2response\n\n# Kerberos tickets\ntshark -r capture.pcap -Y \"kerberos.CNameString\" -T fields -e kerberos.CNameString -e kerberos.realm\n```\n\n**Email Credentials**:\n\n```bash\n# SMTP authentication\ntshark -r capture.pcap -Y \"smtp.req.command == AUTH\" -T fields -e ip.src\n\n# POP3 credentials\ntshark -r capture.pcap -Y \"pop.request.command == USER or pop.request.command == PASS\" -T fields -e pop.request.parameter\n\n# IMAP credentials\ntshark -r capture.pcap -Y \"imap.request contains \\\"LOGIN\\\"\" -T fields -e imap.request\n```\n\n### 8. File Extraction\n\nExtract files from packet captures:\n\n```bash\n# Export HTTP objects\ntshark -r capture.pcap --export-objects http,extracted_http\u002F\n\n# Export SMB objects\ntshark -r capture.pcap --export-objects smb,extracted_smb\u002F\n\n# Export DICOM objects\ntshark -r capture.pcap --export-objects dicom,extracted_dicom\u002F\n\n# Export IMF (email) objects\ntshark -r capture.pcap --export-objects imf,extracted_email\u002F\n```\n\n**Manual file reconstruction**:\n\n```bash\n# Extract file data from HTTP response\ntshark -r capture.pcap -Y \"http.response and http.content_type contains \\\"application\u002Fpdf\\\"\" -T fields -e data.data | xxd -r -p > extracted_file.pdf\n\n# Reassemble TCP stream\ntshark -r capture.pcap -q -z follow,tcp,ascii,\u003Cstream-number>\n```\n\n### 9. Malware Detection\n\nIdentify malicious network activity:\n\n```bash\n# Detect common C2 beaconing patterns\ntshark -r capture.pcap -Y \"http\" -T fields -e frame.time_relative -e ip.dst -e http.host | sort | uniq -c | sort -rn\n\n# Suspicious DNS queries (DGA domains)\ntshark -r capture.pcap -Y \"dns.qry.name\" -T fields -e dns.qry.name | awk -F'.' '{print $(NF-1)\".\"$NF}' | sort | uniq -c | sort -rn\n\n# Detect port scanning\ntshark -r capture.pcap -Y \"tcp.flags.syn==1 and tcp.flags.ack==0\" -T fields -e ip.src -e ip.dst -e tcp.dstport | sort | uniq -c | sort -rn\n\n# Detect data exfiltration (large uploads)\ntshark -r capture.pcap -Y \"http.request.method == POST\" -T fields -e ip.src -e http.content_length | awk '$2 > 1000000'\n\n# Suspicious executable downloads\ntshark -r capture.pcap -Y \"http.response and (http.content_type contains \\\"application\u002Fexe\\\" or http.content_type contains \\\"application\u002Fx-dosexec\\\")\"\n```\n\n### 10. Statistics and Reporting\n\nGenerate traffic statistics:\n\n```bash\n# Protocol hierarchy\ntshark -r capture.pcap -q -z io,phs\n\n# Conversation statistics\ntshark -r capture.pcap -q -z conv,tcp\ntshark -r capture.pcap -q -z conv,udp\ntshark -r capture.pcap -q -z conv,ip\n\n# HTTP statistics\ntshark -r capture.pcap -q -z http,tree\n\n# DNS statistics\ntshark -r capture.pcap -q -z dns,tree\n\n# Endpoints\ntshark -r capture.pcap -q -z endpoints,tcp\ntshark -r capture.pcap -q -z endpoints,udp\n\n# Expert info (warnings\u002Ferrors)\ntshark -r capture.pcap -q -z expert\n```\n\n## Security Considerations\n\n### Authorization & Legal Compliance\n\n- **Written Authorization**: Obtain explicit permission for network monitoring\n- **Privacy Laws**: Comply with wiretapping and privacy regulations (GDPR, CCPA, ECPA)\n- **Data Minimization**: Capture only necessary traffic for investigation\n- **Credential Handling**: Treat extracted credentials as highly sensitive\n- **Retention Policy**: Follow data retention and secure deletion requirements\n\n### Operational Security\n\n- **Encrypted Storage**: Encrypt capture files at rest\n- **Access Control**: Restrict access to packet captures\n- **Secure Transfer**: Use encrypted channels for capture file transfer\n- **Anonymization**: Remove or redact PII when sharing captures\n- **Chain of Custody**: Maintain forensic integrity for legal proceedings\n\n### Audit Logging\n\nDocument all packet capture activities:\n- Capture start and end timestamps\n- Interface(s) captured\n- Capture filters applied\n- File names and storage locations\n- Personnel who accessed captures\n- Purpose of capture and investigation findings\n- Secure deletion timestamps\n\n### Compliance\n\n- **MITRE ATT&CK**: T1040 (Network Sniffing)\n- **NIST CSF**: DE.AE (Detection Processes - Anomalies and Events)\n- **PCI-DSS**: Network security monitoring requirements\n- **ISO 27001**: A.12.4 Logging and monitoring\n- **GDPR**: Data protection and privacy requirements\n\n## Common Patterns\n\n### Pattern 1: Incident Response Investigation\n\n```bash\n# Capture traffic during incident\nsudo tshark -i eth0 -w incident_$(date +%Y%m%d_%H%M%S).pcap -a duration:300\n\n# Analyze for lateral movement\ntshark -r incident.pcap -Y \"smb2 or rdp or ssh\" -T fields -e ip.src -e ip.dst\n\n# Identify C2 communication\ntshark -r incident.pcap -Y \"http or dns\" -T fields -e ip.dst -e http.host -e dns.qry.name\n\n# Extract IOCs\ntshark -r incident.pcap -Y \"ip.dst\" -T fields -e ip.dst | sort -u > ioc_ips.txt\ntshark -r incident.pcap -Y \"dns.qry.name\" -T fields -e dns.qry.name | sort -u > ioc_domains.txt\n```\n\n### Pattern 2: Malware Traffic Analysis\n\n```bash\n# Capture malware sandbox traffic\nsudo tshark -i eth0 -w malware_traffic.pcap\n\n# Extract C2 indicators\ntshark -r malware_traffic.pcap -Y \"http.host\" -T fields -e ip.src -e http.host -e http.user_agent\n\n# Identify DNS tunneling\ntshark -r malware_traffic.pcap -Y \"dns\" -T fields -e dns.qry.name | awk 'length > 50'\n\n# Extract downloaded payloads\ntshark -r malware_traffic.pcap --export-objects http,malware_artifacts\u002F\n\n# Analyze encryption\u002Fencoding\ntshark -r malware_traffic.pcap -Y \"http.request.method == POST\" -T fields -e data.data\n```\n\n### Pattern 3: Credential Harvesting Detection\n\n```bash\n# Monitor for credential transmission\nsudo tshark -i eth0 -Y \"(http.authorization or ftp or pop or imap) and not tls\" -T fields -e ip.src -e ip.dst\n\n# Extract all HTTP POST data\ntshark -r capture.pcap -Y \"http.request.method == POST\" -T fields -e http.file_data > post_data.txt\n\n# Search for password keywords\ntshark -r capture.pcap -Y \"http contains \\\"password\\\" or http contains \\\"passwd\\\"\" -T fields -e ip.src -e http.request.uri\n\n# NTLM hash extraction\ntshark -r capture.pcap -Y \"ntlmssp.auth.ntlmv2response\" -T fields -e ntlmssp.auth.username -e ntlmssp.auth.domain -e ntlmssp.auth.ntlmv2response > ntlm_hashes.txt\n```\n\n### Pattern 4: Network Forensics\n\n```bash\n# Reconstruct HTTP conversation\ntshark -r capture.pcap -q -z follow,http,ascii,0\n\n# Timeline analysis\ntshark -r capture.pcap -T fields -e frame.time -e ip.src -e ip.dst -e tcp.dstport\n\n# Identify file transfers\ntshark -r capture.pcap -Y \"http.content_type contains \\\"application\u002F\\\" or ftp-data\" -T fields -e frame.number -e http.content_type\n\n# Geolocation of connections (requires GeoIP)\ntshark -r capture.pcap -T fields -e ip.src -e ip.dst -e ip.geoip.src_country -e ip.geoip.dst_country\n```\n\n### Pattern 5: Wireless Security Assessment\n\n```bash\n# Capture wireless traffic (monitor mode required)\nsudo tshark -i mon0 -w wireless_capture.pcap\n\n# Identify wireless networks\ntshark -r wireless_capture.pcap -Y \"wlan.fc.type_subtype == 0x08\" -T fields -e wlan.ssid -e wlan.bssid\n\n# Detect deauth attacks\ntshark -r wireless_capture.pcap -Y \"wlan.fc.type_subtype == 0x0c\"\n\n# WPA handshake capture\ntshark -r wireless_capture.pcap -Y \"eapol\"\n\n# Client probing activity\ntshark -r wireless_capture.pcap -Y \"wlan.fc.type_subtype == 0x04\" -T fields -e wlan.sa -e wlan.ssid\n```\n\n## Integration Points\n\n### SIEM Integration\n\nExport packet analysis to SIEM platforms:\n\n```bash\n# Export to JSON for Splunk\u002FELK\ntshark -r capture.pcap -T ek > packets.json\n\n# Export specific fields in JSON\ntshark -r capture.pcap -Y \"http\" -T json -e ip.src -e ip.dst -e http.host -e http.request.uri\n\n# CSV export for analysis\ntshark -r capture.pcap -T fields -E separator=, -e frame.time -e ip.src -e ip.dst -e tcp.dstport > packets.csv\n```\n\n### Scripting and Automation\n\n```bash\n#!\u002Fbin\u002Fbash\n# continuous_monitor.sh - Continuous network monitoring\n\nINTERFACE=\"eth0\"\nALERT_FILTER=\"http contains \\\"cmd.exe\\\" or dns.qry.name contains \\\".tk\\\" or dns.qry.name contains \\\".xyz\\\"\"\n\nsudo tshark -i $INTERFACE -Y \"$ALERT_FILTER\" -T fields -e frame.time -e ip.src -e ip.dst -e http.host -e dns.qry.name | \\\nwhile read line; do\n  echo \"[ALERT] $(date): $line\" | tee -a security_alerts.log\n  # Trigger incident response workflow\n  echo \"$line\" | mail -s \"Security Alert\" soc@company.com\ndone\n```\n\n## Troubleshooting\n\n### Issue: \"Permission denied\" when capturing\n\n**Solutions**:\n```bash\n# Run with sudo\nsudo tshark -i eth0\n\n# Or add user to wireshark group (Linux)\nsudo usermod -a -G wireshark $USER\nsudo setcap cap_net_raw,cap_net_admin+eip \u002Fusr\u002Fbin\u002Ftshark\n\n# Logout and login for group changes to take effect\n```\n\n### Issue: \"No interfaces found\"\n\n**Solutions**:\n```bash\n# Verify tshark installation\ntshark --version\n\n# List interfaces with sudo\nsudo tshark -D\n\n# Check interface status\nip link show\nifconfig -a\n```\n\n### Issue: Capture file is huge\n\n**Solutions**:\n```bash\n# Use capture filters to reduce size\nsudo tshark -i eth0 -f \"not port 22\" -w capture.pcap\n\n# Use ring buffer\nsudo tshark -i eth0 -w capture.pcap -b filesize:100000 -b files:5\n\n# Limit packet size (snaplen)\nsudo tshark -i eth0 -s 128 -w capture.pcap\n```\n\n### Issue: Cannot decrypt TLS traffic\n\n**Solutions**:\n```bash\n# Provide SSL key log file (requires SSLKEYLOGFILE environment variable)\ntshark -r capture.pcap -o tls.keylog_file:sslkeys.log -Y \"http\"\n\n# Use pre-master secret\ntshark -r capture.pcap -o tls.keys_list:192.168.1.100,443,http,\u002Fpath\u002Fto\u002Fserver.key\n```\n\n## Defensive Considerations\n\nOrganizations should protect against unauthorized packet capture:\n\n- **Network Segmentation**: Reduce exposure to packet sniffing\n- **Encryption**: Use TLS\u002FSSL to protect sensitive data in transit\n- **Switch Security**: Enable port security and DHCP snooping\n- **Wireless Security**: Use WPA3, disable broadcast SSID\n- **Intrusion Detection**: Monitor for promiscuous mode interfaces\n- **Physical Security**: Protect network infrastructure from tap devices\n\nDetect packet capture activity:\n- Monitor for promiscuous mode network interfaces\n- Detect ARP spoofing and MAC flooding attacks\n- Audit administrative access to network devices\n- Monitor for unusual outbound data transfers\n- Deploy network access control (802.1X)\n\n## References\n\n- [TShark Man Page](https:\u002F\u002Fwww.wireshark.org\u002Fdocs\u002Fman-pages\u002Ftshark.html)\n- [Wireshark Display Filters](https:\u002F\u002Fwiki.wireshark.org\u002FDisplayFilters)\n- [MITRE ATT&CK: Network Sniffing](https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1040\u002F)\n- [NIST SP 800-92: Guide to Computer Security Log Management](https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fdetail\u002Fsp\u002F800-92\u002Ffinal)\n- [Practical Packet Analysis Book](https:\u002F\u002Fnostarch.com\u002Fpacketanalysis3)\n",{"name":5,"tags":54,"version":60,"category":61,"frameworks":62,"maintainer":63,"references":64,"description":68,"dependencies":69},[55,56,57,30,58,59],"packet-capture","network-analysis","forensics","wireshark","traffic-analysis","0.1.0","offsec",[46,41],"sirappsec@gmail.com",[65,66,67],"https:\u002F\u002Fwww.wireshark.org\u002Fdocs\u002Fman-pages\u002Ftshark.html","https:\u002F\u002Fwiki.wireshark.org\u002FDisplayFilters","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1040\u002F","Network protocol analyzer and packet capture tool for traffic analysis, security investigations, and forensic examination using Wireshark's command-line interface. Use when: (1) Analyzing network traffic for security incidents and malware detection, (2) Capturing and filtering packets for forensic analysis, (3) Extracting credentials and sensitive data from network captures, (4) Investigating network anomalies and attack patterns, (5) Validating encryption and security controls, (6) Performing protocol analysis for vulnerability research.\n",{"tools":70,"packages":73},[71,72],"tcpdump","python3",[30,58],"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fanalysis-tshark",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":8,"skillName":5,"commands":84,"prompt":94,"zipAvailable":95},[85,88,91],{"tool":86,"command":87},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill analysis-tshark",{"tool":89,"command":90},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill analysis-tshark",{"tool":92,"command":93},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill analysis-tshark","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fanalysis-tshark\u002FSKILL.md",true,[97,103,107,113,117,121],{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"assets\u002Fci-config-template.yml","ASSET","资产文件",11105,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fanalysis-tshark\u002Fassets\u002Fci-config-template.yml",{"path":104,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":105,"sourceHtmlUrl":106},"assets\u002Frule-template.yaml",11044,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fanalysis-tshark\u002Fassets\u002Frule-template.yaml",{"path":108,"resourceType":109,"resourceTypeDesc":110,"sizeBytes":111,"sourceHtmlUrl":112},"README.md","REFERENCE","参考文档",1253,"https:\u002F\u002Fgithub.com\u002Fai-agent-manager\u002Fagent-manager\u002Fblob\u002Fmain\u002Fmocks\u002Fagents\u002F0.1.1\u002Freact-component-generator\u002FREADME.md",{"path":114,"resourceType":109,"resourceTypeDesc":110,"sizeBytes":115,"sourceHtmlUrl":116},"references\u002FEXAMPLE.md",15672,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fanalysis-tshark\u002Freferences\u002FEXAMPLE.md",{"path":118,"resourceType":109,"resourceTypeDesc":110,"sizeBytes":119,"sourceHtmlUrl":120},"references\u002FWORKFLOW_CHECKLIST.md",8390,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fanalysis-tshark\u002Freferences\u002FWORKFLOW_CHECKLIST.md",{"path":122,"resourceType":109,"resourceTypeDesc":110,"sizeBytes":123,"sourceHtmlUrl":124},"skill-report.json",37522,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fagentsecops\u002Fanalysis-tshark\u002Fskill-report.json",[126,136,146,155,161,168],{"skillNo":127,"name":128,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":132,"publishedAt":49},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[131],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[133,134,135],"model","model hierarchy","model hierarchy skill",{"skillNo":137,"name":138,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":142,"publishedAt":49},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[141],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[143,144,145],"MCP","zoom","zoom mcp",{"skillNo":147,"name":148,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":151,"publishedAt":49},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[152,153,154,144],"sdk","zoom apps sdk","apps",{"skillNo":156,"name":157,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":160,"publishedAt":49},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[157],{"skillNo":162,"name":163,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":167,"publishedAt":49},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[166],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[163],{"skillNo":169,"name":170,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":173,"publishedAt":49},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[170]]