[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ESPSDCJ5PXV33KCFG536RC":3,"skill-same:01M6ESPSDCJ5PXV33KCFG536RC":112},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":14,"repositoryHtmlUrl":68,"repositoryHomepageUrl":69,"ownerHtmlUrl":70,"ownerBlogUrl":6,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M6ESPSDCJ5PXV33KCFG536RC","analyzing-network-traffic-with-wireshark",null,"Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and support incident response investigations on authorized network segments.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-network-traffic-with-wireshark\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"with","analyzing","network","analyzing network traffic with wireshark","Wireshark","pcap","de","incident","patterns","cm","analysis","traffic-analysis","malicious","packet-analysis","data","issues","support","incident response","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: analyzing-network-traffic-with-wireshark\ndescription: 'Captures and analyzes network packet data using Wireshark and tshark\n  to identify malicious traffic patterns, diagnose protocol issues, extract artifacts,\n  and support incident response investigations on authorized network segments.\n\n  '\ndomain: cybersecurity\nsubdomain: network-security\ntags:\n- network-security\n- wireshark\n- packet-analysis\n- traffic-analysis\n- pcap\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-03\n- PR.DS-02\nmitre_attack:\n- T1040\n- T1071\n- T1557\n- T1046\n---\n# Analyzing Network Traffic with Wireshark\n\n## When to Use\n\n- Investigating suspected network intrusions by examining packet-level evidence of command-and-control traffic, data exfiltration, or lateral movement\n- Diagnosing network performance issues such as retransmissions, fragmentation, or DNS resolution failures\n- Analyzing malware communication patterns by capturing traffic from sandboxed or isolated hosts\n- Validating firewall and IDS rules by confirming what traffic is actually traversing network segments\n- Extracting files, credentials, or indicators of compromise from captured network sessions\n\n**Do not use** to capture traffic on networks without authorization, to intercept private communications without legal authority, or as a substitute for full-featured SIEM platforms in production monitoring.\n\n## Prerequisites\n\n- Wireshark 4.0+ and tshark command-line utility installed\n- Root\u002Fsudo privileges or membership in the `wireshark` group for live packet capture\n- Network interface access (physical NIC, span port, or network tap) to the monitored segment\n- Sufficient disk space for packet capture files (estimate 1 GB per minute on busy gigabit links)\n- Familiarity with TCP\u002FIP protocols, HTTP, DNS, TLS, and SMB at the packet level\n\n## Workflow\n\n### Step 1: Configure Capture Environment\n\nSet up the capture interface and filters to target relevant traffic:\n\n```bash\n# List available interfaces\ntshark -D\n\n# Start capture on eth0 with a capture filter to limit scope\ntshark -i eth0 -f \"host 10.10.5.23 and (port 80 or port 443 or port 445)\" -w \u002Ftmp\u002Fcapture.pcapng\n\n# Capture with ring buffer to manage disk usage (10 files, 100MB each)\ntshark -i eth0 -b filesize:102400 -b files:10 -w \u002Ftmp\u002Frolling_capture.pcapng\n\n# Capture on multiple interfaces simultaneously\ntshark -i eth0 -i eth1 -w \u002Ftmp\u002Fmulti_interface.pcapng\n```\n\nFor Wireshark GUI, set capture filter in the Capture Options dialog before starting.\n\n### Step 2: Apply Display Filters for Targeted Analysis\n\n```bash\n# Filter HTTP traffic containing suspicious user agents\ntshark -r capture.pcapng -Y \"http.user_agent contains \\\"curl\\\" or http.user_agent contains \\\"Wget\\\"\"\n\n# Find DNS queries to suspicious TLDs\ntshark -r capture.pcapng -Y \"dns.qry.name contains \\\".xyz\\\" or dns.qry.name contains \\\".top\\\" or dns.qry.name contains \\\".tk\\\"\"\n\n# Identify TCP retransmissions indicating network issues\ntshark -r capture.pcapng -Y \"tcp.analysis.retransmission\"\n\n# Filter SMB traffic for lateral movement detection\ntshark -r capture.pcapng -Y \"smb2.cmd == 5 or smb2.cmd == 3\" -T fields -e ip.src -e ip.dst -e smb2.filename\n\n# Find cleartext credential transmission\ntshark -r capture.pcapng -Y \"ftp.request.command == \\\"PASS\\\" or http.authbasic\"\n\n# Detect beaconing patterns (regular interval connections)\ntshark -r capture.pcapng -Y \"ip.dst == 203.0.113.50\" -T fields -e frame.time_relative -e ip.src -e tcp.dstport\n```\n\n### Step 3: Protocol-Specific Deep Analysis\n\n```bash\n# Follow a TCP stream to reconstruct a conversation\ntshark -r capture.pcapng -q -z follow,tcp,ascii,0\n\n# Analyze HTTP request\u002Fresponse pairs\ntshark -r capture.pcapng -Y \"http\" -T fields -e frame.time -e ip.src -e ip.dst -e http.request.method -e http.request.uri -e http.response.code\n\n# Extract DNS query\u002Fresponse statistics\ntshark -r capture.pcapng -q -z dns,tree\n\n# Analyze TLS handshakes for weak cipher suites\ntshark -r capture.pcapng -Y \"tls.handshake.type == 2\" -T fields -e ip.src -e ip.dst -e tls.handshake.ciphersuite\n\n# SMB file access enumeration\ntshark -r capture.pcapng -Y \"smb2\" -T fields -e frame.time -e ip.src -e ip.dst -e smb2.filename -e smb2.cmd\n```\n\n### Step 4: Extract Artifacts and IOCs\n\n```bash\n# Export HTTP objects (files transferred over HTTP)\ntshark -r capture.pcapng --export-objects http,\u002Ftmp\u002Fhttp_objects\u002F\n\n# Export SMB objects (files transferred over SMB)\ntshark -r capture.pcapng --export-objects smb,\u002Ftmp\u002Fsmb_objects\u002F\n\n# Extract all unique destination IPs for threat intelligence lookup\ntshark -r capture.pcapng -T fields -e ip.dst | sort -u > unique_dest_ips.txt\n\n# Extract SSL\u002FTLS certificate information\ntshark -r capture.pcapng -Y \"tls.handshake.type == 11\" -T fields -e x509sat.uTF8String -e x509ce.dNSName\n\n# Extract all URLs accessed\ntshark -r capture.pcapng -Y \"http.request\" -T fields -e http.host -e http.request.uri | sort -u > urls.txt\n\n# Hash extracted files for IOC matching\nfind \u002Ftmp\u002Fhttp_objects\u002F -type f -exec sha256sum {} \\; > extracted_file_hashes.txt\n```\n\n### Step 5: Statistical Analysis and Anomaly Detection\n\n```bash\n# Protocol hierarchy statistics\ntshark -r capture.pcapng -q -z io,phs\n\n# Conversation statistics sorted by bytes\ntshark -r capture.pcapng -q -z conv,tcp -z conv,udp\n\n# Identify top talkers\ntshark -r capture.pcapng -q -z endpoints,ip\n\n# IO graph data (packets per second)\ntshark -r capture.pcapng -q -z io,stat,1,\"COUNT(frame) frame\"\n\n# Detect port scanning patterns\ntshark -r capture.pcapng -Y \"tcp.flags.syn == 1 and tcp.flags.ack == 0\" -T fields -e ip.src -e tcp.dstport | sort | uniq -c | sort -rn | head -20\n```\n\n### Step 6: Generate Reports and Export Evidence\n\n```bash\n# Export filtered packets to a new PCAP for evidence preservation\ntshark -r capture.pcapng -Y \"ip.addr == 10.10.5.23 and tcp.port == 4444\" -w evidence_c2_traffic.pcapng\n\n# Generate packet summary in CSV format\ntshark -r capture.pcapng -T fields -E header=y -E separator=, -e frame.number -e frame.time -e ip.src -e ip.dst -e ip.proto -e tcp.srcport -e tcp.dstport -e frame.len > traffic_summary.csv\n\n# Create PDML (XML) output for programmatic analysis\ntshark -r capture.pcapng -T pdml > capture_analysis.xml\n\n# Calculate capture file hash for chain of custody\nsha256sum capture.pcapng > capture_hash.txt\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Capture Filter (BPF)** | Berkeley Packet Filter syntax applied at capture time to limit which packets are recorded, reducing file size and improving performance |\n| **Display Filter** | Wireshark-specific filter syntax applied to already-captured packets for focused analysis without altering the capture file |\n| **PCAPNG** | Next-generation packet capture format supporting multiple interfaces, name resolution, annotations, and metadata in a single file |\n| **TCP Stream** | Reassembled sequence of TCP segments representing a complete bidirectional conversation between two endpoints |\n| **Protocol Dissector** | Wireshark module that decodes a specific protocol's fields and structure, enabling deep inspection of packet contents |\n| **IO Graph** | Time-series visualization of packet or byte rates over the capture duration, useful for identifying traffic spikes or beaconing |\n\n## Tools & Systems\n\n- **Wireshark 4.0+**: GUI-based packet analyzer with protocol dissectors for 3,000+ protocols, stream reassembly, and export capabilities\n- **tshark**: Command-line version of Wireshark for headless capture, batch processing, and scripted analysis pipelines\n- **tcpdump**: Lightweight packet capture tool for quick captures on remote systems without GUI dependencies\n- **mergecap**: Wireshark utility for combining multiple capture files into a single PCAP for unified analysis\n- **editcap**: Wireshark utility for splitting, filtering, and converting between capture file formats\n\n## Common Scenarios\n\n### Scenario: Investigating Suspected Data Exfiltration via DNS Tunneling\n\n**Context**: The SOC team detected unusually high DNS query volumes from a workstation (10.10.3.45) to an external domain. The SIEM alert flagged DNS queries averaging 200 per minute compared to the baseline of 15. A packet capture was initiated from the network tap on the workstation's VLAN.\n\n**Approach**:\n1. Capture traffic from the workstation's subnet using `tshark -i eth2 -f \"host 10.10.3.45 and port 53\" -w dns_exfil_investigation.pcapng`\n2. Analyze DNS query patterns: `tshark -r dns_exfil_investigation.pcapng -Y \"dns.qry.name contains \\\"suspect-domain.xyz\\\"\" -T fields -e frame.time -e dns.qry.name`\n3. Examine subdomain labels for encoded data (long base64-like subdomains indicate tunneling): `tshark -r dns_exfil_investigation.pcapng -Y \"dns.qry.type == 16\" -T fields -e dns.qry.name -e dns.txt`\n4. Calculate data volume by summing query name lengths to estimate exfiltration bandwidth\n5. Extract unique query names and decode base64 subdomains to recover exfiltrated content\n6. Export evidence packets to a separate PCAP and generate SHA-256 hash for chain of custody\n\n**Pitfalls**:\n- Capturing unfiltered traffic on a busy network and running out of disk space before collecting relevant data\n- Using display filters instead of capture filters, resulting in massive files that are slow to process\n- Overlooking encrypted DNS (DoH\u002FDoT) traffic that bypasses traditional DNS capture on port 53\n- Failing to establish packet capture hash and chain of custody documentation for forensic evidence\n\n## Output Format\n\n```\n## Traffic Analysis Report\n\n**Case ID**: IR-2024-0847\n**Capture File**: dns_exfil_investigation.pcapng\n**SHA-256**: a3f2b8c1d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1\n**Duration**: 2024-03-15 14:00:00 to 14:45:00 UTC\n**Source Interface**: eth2 (VLAN 30 span port)\n\n### Findings\n\n**1. DNS Tunneling Confirmed**\n- Source: 10.10.3.45\n- Destination DNS: 8.8.8.8 (forwarded to ns1.suspect-domain.xyz)\n- Query volume: 9,247 queries in 45 minutes (205\u002Fmin vs 15\u002Fmin baseline)\n- Average subdomain label length: 63 characters (base64-encoded data)\n- Estimated data exfiltrated: ~2.3 MB via TXT record responses\n\n**2. Indicators of Compromise**\n- Domain: suspect-domain.xyz (registered 3 days prior)\n- Nameserver: ns1.suspect-domain.xyz (203.0.113.50)\n- Query pattern: TXT record requests with base64-encoded subdomains\n- Response pattern: TXT records containing base64-encoded payloads\n```\n","# Analyzing Network Traffic with Wireshark\n\n## When to Use\n\n- Investigating suspected network intrusions by examining packet-level evidence of command-and-control traffic, data exfiltration, or lateral movement\n- Diagnosing network performance issues such as retransmissions, fragmentation, or DNS resolution failures\n- Analyzing malware communication patterns by capturing traffic from sandboxed or isolated hosts\n- Validating firewall and IDS rules by confirming what traffic is actually traversing network segments\n- Extracting files, credentials, or indicators of compromise from captured network sessions\n\n**Do not use** to capture traffic on networks without authorization, to intercept private communications without legal authority, or as a substitute for full-featured SIEM platforms in production monitoring.\n\n## Prerequisites\n\n- Wireshark 4.0+ and tshark command-line utility installed\n- Root\u002Fsudo privileges or membership in the `wireshark` group for live packet capture\n- Network interface access (physical NIC, span port, or network tap) to the monitored segment\n- Sufficient disk space for packet capture files (estimate 1 GB per minute on busy gigabit links)\n- Familiarity with TCP\u002FIP protocols, HTTP, DNS, TLS, and SMB at the packet level\n\n## Workflow\n\n### Step 1: Configure Capture Environment\n\nSet up the capture interface and filters to target relevant traffic:\n\n```bash\n# List available interfaces\ntshark -D\n\n# Start capture on eth0 with a capture filter to limit scope\ntshark -i eth0 -f \"host 10.10.5.23 and (port 80 or port 443 or port 445)\" -w \u002Ftmp\u002Fcapture.pcapng\n\n# Capture with ring buffer to manage disk usage (10 files, 100MB each)\ntshark -i eth0 -b filesize:102400 -b files:10 -w \u002Ftmp\u002Frolling_capture.pcapng\n\n# Capture on multiple interfaces simultaneously\ntshark -i eth0 -i eth1 -w \u002Ftmp\u002Fmulti_interface.pcapng\n```\n\nFor Wireshark GUI, set capture filter in the Capture Options dialog before starting.\n\n### Step 2: Apply Display Filters for Targeted Analysis\n\n```bash\n# Filter HTTP traffic containing suspicious user agents\ntshark -r capture.pcapng -Y \"http.user_agent contains \\\"curl\\\" or http.user_agent contains \\\"Wget\\\"\"\n\n# Find DNS queries to suspicious TLDs\ntshark -r capture.pcapng -Y \"dns.qry.name contains \\\".xyz\\\" or dns.qry.name contains \\\".top\\\" or dns.qry.name contains \\\".tk\\\"\"\n\n# Identify TCP retransmissions indicating network issues\ntshark -r capture.pcapng -Y \"tcp.analysis.retransmission\"\n\n# Filter SMB traffic for lateral movement detection\ntshark -r capture.pcapng -Y \"smb2.cmd == 5 or smb2.cmd == 3\" -T fields -e ip.src -e ip.dst -e smb2.filename\n\n# Find cleartext credential transmission\ntshark -r capture.pcapng -Y \"ftp.request.command == \\\"PASS\\\" or http.authbasic\"\n\n# Detect beaconing patterns (regular interval connections)\ntshark -r capture.pcapng -Y \"ip.dst == 203.0.113.50\" -T fields -e frame.time_relative -e ip.src -e tcp.dstport\n```\n\n### Step 3: Protocol-Specific Deep Analysis\n\n```bash\n# Follow a TCP stream to reconstruct a conversation\ntshark -r capture.pcapng -q -z follow,tcp,ascii,0\n\n# Analyze HTTP request\u002Fresponse pairs\ntshark -r capture.pcapng -Y \"http\" -T fields -e frame.time -e ip.src -e ip.dst -e http.request.method -e http.request.uri -e http.response.code\n\n# Extract DNS query\u002Fresponse statistics\ntshark -r capture.pcapng -q -z dns,tree\n\n# Analyze TLS handshakes for weak cipher suites\ntshark -r capture.pcapng -Y \"tls.handshake.type == 2\" -T fields -e ip.src -e ip.dst -e tls.handshake.ciphersuite\n\n# SMB file access enumeration\ntshark -r capture.pcapng -Y \"smb2\" -T fields -e frame.time -e ip.src -e ip.dst -e smb2.filename -e smb2.cmd\n```\n\n### Step 4: Extract Artifacts and IOCs\n\n```bash\n# Export HTTP objects (files transferred over HTTP)\ntshark -r capture.pcapng --export-objects http,\u002Ftmp\u002Fhttp_objects\u002F\n\n# Export SMB objects (files transferred over SMB)\ntshark -r capture.pcapng --export-objects smb,\u002Ftmp\u002Fsmb_objects\u002F\n\n# Extract all unique destination IPs for threat intelligence lookup\ntshark -r capture.pcapng -T fields -e ip.dst | sort -u > unique_dest_ips.txt\n\n# Extract SSL\u002FTLS certificate information\ntshark -r capture.pcapng -Y \"tls.handshake.type == 11\" -T fields -e x509sat.uTF8String -e x509ce.dNSName\n\n# Extract all URLs accessed\ntshark -r capture.pcapng -Y \"http.request\" -T fields -e http.host -e http.request.uri | sort -u > urls.txt\n\n# Hash extracted files for IOC matching\nfind \u002Ftmp\u002Fhttp_objects\u002F -type f -exec sha256sum {} \\; > extracted_file_hashes.txt\n```\n\n### Step 5: Statistical Analysis and Anomaly Detection\n\n```bash\n# Protocol hierarchy statistics\ntshark -r capture.pcapng -q -z io,phs\n\n# Conversation statistics sorted by bytes\ntshark -r capture.pcapng -q -z conv,tcp -z conv,udp\n\n# Identify top talkers\ntshark -r capture.pcapng -q -z endpoints,ip\n\n# IO graph data (packets per second)\ntshark -r capture.pcapng -q -z io,stat,1,\"COUNT(frame) frame\"\n\n# Detect port scanning patterns\ntshark -r capture.pcapng -Y \"tcp.flags.syn == 1 and tcp.flags.ack == 0\" -T fields -e ip.src -e tcp.dstport | sort | uniq -c | sort -rn | head -20\n```\n\n### Step 6: Generate Reports and Export Evidence\n\n```bash\n# Export filtered packets to a new PCAP for evidence preservation\ntshark -r capture.pcapng -Y \"ip.addr == 10.10.5.23 and tcp.port == 4444\" -w evidence_c2_traffic.pcapng\n\n# Generate packet summary in CSV format\ntshark -r capture.pcapng -T fields -E header=y -E separator=, -e frame.number -e frame.time -e ip.src -e ip.dst -e ip.proto -e tcp.srcport -e tcp.dstport -e frame.len > traffic_summary.csv\n\n# Create PDML (XML) output for programmatic analysis\ntshark -r capture.pcapng -T pdml > capture_analysis.xml\n\n# Calculate capture file hash for chain of custody\nsha256sum capture.pcapng > capture_hash.txt\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Capture Filter (BPF)** | Berkeley Packet Filter syntax applied at capture time to limit which packets are recorded, reducing file size and improving performance |\n| **Display Filter** | Wireshark-specific filter syntax applied to already-captured packets for focused analysis without altering the capture file |\n| **PCAPNG** | Next-generation packet capture format supporting multiple interfaces, name resolution, annotations, and metadata in a single file |\n| **TCP Stream** | Reassembled sequence of TCP segments representing a complete bidirectional conversation between two endpoints |\n| **Protocol Dissector** | Wireshark module that decodes a specific protocol's fields and structure, enabling deep inspection of packet contents |\n| **IO Graph** | Time-series visualization of packet or byte rates over the capture duration, useful for identifying traffic spikes or beaconing |\n\n## Tools & Systems\n\n- **Wireshark 4.0+**: GUI-based packet analyzer with protocol dissectors for 3,000+ protocols, stream reassembly, and export capabilities\n- **tshark**: Command-line version of Wireshark for headless capture, batch processing, and scripted analysis pipelines\n- **tcpdump**: Lightweight packet capture tool for quick captures on remote systems without GUI dependencies\n- **mergecap**: Wireshark utility for combining multiple capture files into a single PCAP for unified analysis\n- **editcap**: Wireshark utility for splitting, filtering, and converting between capture file formats\n\n## Common Scenarios\n\n### Scenario: Investigating Suspected Data Exfiltration via DNS Tunneling\n\n**Context**: The SOC team detected unusually high DNS query volumes from a workstation (10.10.3.45) to an external domain. The SIEM alert flagged DNS queries averaging 200 per minute compared to the baseline of 15. A packet capture was initiated from the network tap on the workstation's VLAN.\n\n**Approach**:\n1. Capture traffic from the workstation's subnet using `tshark -i eth2 -f \"host 10.10.3.45 and port 53\" -w dns_exfil_investigation.pcapng`\n2. Analyze DNS query patterns: `tshark -r dns_exfil_investigation.pcapng -Y \"dns.qry.name contains \\\"suspect-domain.xyz\\\"\" -T fields -e frame.time -e dns.qry.name`\n3. Examine subdomain labels for encoded data (long base64-like subdomains indicate tunneling): `tshark -r dns_exfil_investigation.pcapng -Y \"dns.qry.type == 16\" -T fields -e dns.qry.name -e dns.txt`\n4. Calculate data volume by summing query name lengths to estimate exfiltration bandwidth\n5. Extract unique query names and decode base64 subdomains to recover exfiltrated content\n6. Export evidence packets to a separate PCAP and generate SHA-256 hash for chain of custody\n\n**Pitfalls**:\n- Capturing unfiltered traffic on a busy network and running out of disk space before collecting relevant data\n- Using display filters instead of capture filters, resulting in massive files that are slow to process\n- Overlooking encrypted DNS (DoH\u002FDoT) traffic that bypasses traditional DNS capture on port 53\n- Failing to establish packet capture hash and chain of custody documentation for forensic evidence\n\n## Output Format\n\n```\n## Traffic Analysis Report\n\n**Case ID**: IR-2024-0847\n**Capture File**: dns_exfil_investigation.pcapng\n**SHA-256**: a3f2b8c1d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1\n**Duration**: 2024-03-15 14:00:00 to 14:45:00 UTC\n**Source Interface**: eth2 (VLAN 30 span port)\n\n### Findings\n\n**1. DNS Tunneling Confirmed**\n- Source: 10.10.3.45\n- Destination DNS: 8.8.8.8 (forwarded to ns1.suspect-domain.xyz)\n- Query volume: 9,247 queries in 45 minutes (205\u002Fmin vs 15\u002Fmin baseline)\n- Average subdomain label length: 63 characters (base64-encoded data)\n- Estimated data exfiltrated: ~2.3 MB via TXT record responses\n\n**2. Indicators of Compromise**\n- Domain: suspect-domain.xyz (registered 3 days prior)\n- Nameserver: ns1.suspect-domain.xyz (203.0.113.50)\n- Query pattern: TXT record requests with base64-encoded subdomains\n- Response pattern: TXT records containing base64-encoded payloads\n```\n",{"name":5,"tags":49,"author":52,"domain":42,"license":15,"version":53,"nist_csf":54,"subdomain":50,"description":59,"mitre_attack":60},[50,51,37,35,29],"network-security","wireshark","mahipal","1.0",[55,56,57,58],"PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02","Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and support incident response investigations on authorized network segments.\n",[61,62,63,64],"T1040","T1071","T1557","T1046","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fanalyzing-network-traffic-with-wireshark","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill analyzing-network-traffic-with-wireshark",{"tool":79,"command":80},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill analyzing-network-traffic-with-wireshark",{"tool":82,"command":83},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill analyzing-network-traffic-with-wireshark","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-network-traffic-with-wireshark\u002FSKILL.md",true,[87,93,98,102,106],{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"agents\u002Fopenai.yaml","REFERENCE","参考文档",137,"https:\u002F\u002Fgithub.com\u002Fmamahoos\u002Fdot-files\u002Fblob\u002Fmain\u002Fhome\u002F.cursor\u002Fskills\u002Fask-matt\u002Fagents\u002Fopenai.yaml",{"path":94,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-network-traffic-with-wireshark\u002FLICENSE",{"path":99,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":100,"sourceHtmlUrl":101},"PHASE-BOUNDARIES.md",4249,"https:\u002F\u002Fgithub.com\u002Fmamahoos\u002Fdot-files\u002Fblob\u002Fmain\u002Fhome\u002F.cursor\u002Fskills\u002Fask-matt\u002FPHASE-BOUNDARIES.md",{"path":103,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md",2971,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-network-traffic-with-wireshark\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":110,"sourceHtmlUrl":111},"scripts\u002Fagent.py","SCRIPT","脚本",7448,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-network-traffic-with-wireshark\u002Fscripts\u002Fagent.py",[113,153,162,171,193,218],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":134,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[120,123,126,129],{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":127,"categoryName":128,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":130,"categoryName":131,"taxonomyType":132,"taxonomyTypeDesc":133},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[115,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,24],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube",{"skillNo":154,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":161,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[157,158,159,160],{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":127,"categoryName":128,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":130,"categoryName":131,"taxonomyType":132,"taxonomyTypeDesc":133},[115,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,24],{"skillNo":163,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":170,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[166,167,168,169],{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":127,"categoryName":128,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":130,"categoryName":131,"taxonomyType":132,"taxonomyTypeDesc":133},[115,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,24],{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":177,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[178,179,180,181,182,183,184,185,186,187,188,189,190,191,192],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":194,"name":195,"nameZh":6,"description":196,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":197,"categories":198,"keywords":200,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[199],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[201,202,203,204,205,206,34,207,208,209,210,146,147,211,212,213,214,215,216,217],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":219,"name":220,"nameZh":6,"description":221,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":222,"categories":223,"keywords":234,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[224,227,230,231],{"categoryNo":225,"categoryName":226,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":228,"categoryName":229,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":232,"categoryName":233,"taxonomyType":132,"taxonomyTypeDesc":133},"01JBSEEDCAT000000000000036","内容创作者",[235,236,237,238,239,240,241,242,143,243,146,147,148,244,245,246,247,248,192,249],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]