[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EVZBWS2WJ20SRAFS1SV9V2":3,"skill-same:01M6EVZBWS2WJ20SRAFS1SV9V2":102},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":63,"commitSha":64,"skillDirectory":65,"forksCount":14,"repositoryHtmlUrl":66,"repositoryHomepageUrl":67,"ownerHtmlUrl":68,"ownerBlogUrl":6,"ownerDescription":69,"updatedAt":70,"install":71,"resources":84},"01M6EVZBWS2WJ20SRAFS1SV9V2","performing-network-traffic-analysis-with-tshark",null,"Automate network traffic analysis using tshark and pyshark for protocol statistics, suspicious flow detection, DNS anomaly identification, and IOC extraction from PCAP files","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-network-traffic-analysis-with-tshark\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"tshark","with","traffic analysis","performing network traffic analysis with tshark","analysis","network","network-forensics","Wireshark","network-security","dns","suspicious","ioc","ioc extraction","cm","files","statistics","id","identification","pr","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-network-traffic-analysis-with-tshark\ndescription: Automate network traffic analysis using tshark and pyshark for protocol\n  statistics, suspicious flow detection, DNS anomaly identification, and IOC extraction\n  from PCAP files\ndomain: cybersecurity\nsubdomain: network-security\ntags:\n- tshark\n- pyshark\n- pcap\n- packet-analysis\n- network-forensics\n- wireshark\n- traffic-analysis\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-03\n- PR.DS-02\nmitre_attack:\n- T1046\n- T1040\n- T1557\n- T1071\n- T1005\n---\n\n# Performing Network Traffic Analysis with TShark\n\n## Overview\n\nThis skill automates packet capture analysis using tshark (Wireshark CLI) and pyshark (Python wrapper). It extracts protocol distribution statistics, identifies suspicious network flows (port scans, beaconing, data exfiltration), extracts IOCs (IPs, domains, URLs), and detects DNS tunneling patterns from PCAP files.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing network traffic analysis with tshark\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- tshark (Wireshark CLI) installed and in PATH\n- Python 3.8+ with pyshark library\n- PCAP or PCAPNG capture file for analysis\n\n## Steps\n\n1. **Extract Protocol Statistics** — Generate protocol hierarchy and conversation statistics from the capture\n2. **Identify Top Talkers** — Rank source\u002Fdestination IPs by volume and connection count\n3. **Detect Suspicious Flows** — Flag port scanning patterns, unusual port usage, and high-frequency connections\n4. **Extract Network IOCs** — Pull unique IPs, domains from DNS queries, and URLs from HTTP traffic\n5. **Analyze DNS Traffic** — Detect DNS tunneling via high-entropy subdomain queries and excessive TXT records\n6. **Generate Analysis Report** — Produce structured report with flow summaries and threat indicators\n\n## Expected Output\n\n- JSON report with protocol statistics and top talkers\n- Suspicious flow detections with severity ratings\n- Extracted IOCs (IPs, domains, URLs)\n- DNS anomaly analysis results\n","# Performing Network Traffic Analysis with TShark\n\n## Overview\n\nThis skill automates packet capture analysis using tshark (Wireshark CLI) and pyshark (Python wrapper). It extracts protocol distribution statistics, identifies suspicious network flows (port scans, beaconing, data exfiltration), extracts IOCs (IPs, domains, URLs), and detects DNS tunneling patterns from PCAP files.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing network traffic analysis with tshark\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- tshark (Wireshark CLI) installed and in PATH\n- Python 3.8+ with pyshark library\n- PCAP or PCAPNG capture file for analysis\n\n## Steps\n\n1. **Extract Protocol Statistics** — Generate protocol hierarchy and conversation statistics from the capture\n2. **Identify Top Talkers** — Rank source\u002Fdestination IPs by volume and connection count\n3. **Detect Suspicious Flows** — Flag port scanning patterns, unusual port usage, and high-frequency connections\n4. **Extract Network IOCs** — Pull unique IPs, domains from DNS queries, and URLs from HTTP traffic\n5. **Analyze DNS Traffic** — Detect DNS tunneling via high-entropy subdomain queries and excessive TXT records\n6. **Generate Analysis Report** — Produce structured report with flow summaries and threat indicators\n\n## Expected Output\n\n- JSON report with protocol statistics and top talkers\n- Suspicious flow detections with severity ratings\n- Extracted IOCs (IPs, domains, URLs)\n- DNS anomaly analysis results\n",{"name":5,"tags":44,"author":50,"domain":38,"license":15,"version":51,"nist_csf":52,"subdomain":27,"description":7,"mitre_attack":57},[19,45,46,47,25,48,49],"pyshark","pcap","packet-analysis","wireshark","traffic-analysis","mahipal","1.0",[53,54,55,56],"PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02",[58,59,60,61,62],"T1046","T1040","T1557","T1071","T1005","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fperforming-network-traffic-analysis-with-tshark","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":83},[73,76,79],{"tool":74,"command":75},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill performing-network-traffic-analysis-with-tshark",{"tool":77,"command":78},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill performing-network-traffic-analysis-with-tshark",{"tool":80,"command":81},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill performing-network-traffic-analysis-with-tshark","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-network-traffic-analysis-with-tshark\u002FSKILL.md",true,[85,90,96],{"path":86,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-network-traffic-analysis-with-tshark\u002FLICENSE",{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Fapi-reference.md","REFERENCE","参考文档",2117,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-network-traffic-analysis-with-tshark\u002Freferences\u002Fapi-reference.md",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"scripts\u002Fagent.py","SCRIPT","脚本",8391,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-network-traffic-analysis-with-tshark\u002Fscripts\u002Fagent.py",[103,144,153,162,184,211],{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":126,"publishedAt":39},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[110,115,118,121],{"categoryNo":111,"categoryName":112,"taxonomyType":113,"taxonomyTypeDesc":114},"01JBSEEDCAT000000000000002","文档处理","SCENARIO","使用场景",{"categoryNo":116,"categoryName":117,"taxonomyType":113,"taxonomyTypeDesc":114},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":119,"categoryName":120,"taxonomyType":113,"taxonomyTypeDesc":114},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":122,"categoryName":123,"taxonomyType":124,"taxonomyTypeDesc":125},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[105,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,33,143,20],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","youtube",{"skillNo":145,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":152,"publishedAt":39},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[148,149,150,151],{"categoryNo":111,"categoryName":112,"taxonomyType":113,"taxonomyTypeDesc":114},{"categoryNo":116,"categoryName":117,"taxonomyType":113,"taxonomyTypeDesc":114},{"categoryNo":119,"categoryName":120,"taxonomyType":113,"taxonomyTypeDesc":114},{"categoryNo":122,"categoryName":123,"taxonomyType":124,"taxonomyTypeDesc":125},[105,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,33,143,20],{"skillNo":154,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":161,"publishedAt":39},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[157,158,159,160],{"categoryNo":111,"categoryName":112,"taxonomyType":113,"taxonomyTypeDesc":114},{"categoryNo":116,"categoryName":117,"taxonomyType":113,"taxonomyTypeDesc":114},{"categoryNo":119,"categoryName":120,"taxonomyType":113,"taxonomyTypeDesc":114},{"categoryNo":122,"categoryName":123,"taxonomyType":124,"taxonomyTypeDesc":125},[105,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,33,143,20],{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":168,"publishedAt":39},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[169,170,171,172,173,174,175,176,177,178,179,180,181,182,183],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":193,"publishedAt":39},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[190],{"categoryNo":191,"categoryName":192,"taxonomyType":113,"taxonomyTypeDesc":114},"01JBSEEDCAT000000000000023","Skill与智能体开发",[194,195,196,197,198,199,23,200,201,202,203,138,139,204,205,206,207,208,209,210],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":212,"name":213,"nameZh":6,"description":214,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":107,"licenseFileUrl":6,"sourceHtmlUrl":215,"categories":216,"keywords":227,"publishedAt":39},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[217,220,223,224],{"categoryNo":218,"categoryName":219,"taxonomyType":113,"taxonomyTypeDesc":114},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":221,"categoryName":222,"taxonomyType":113,"taxonomyTypeDesc":114},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":191,"categoryName":192,"taxonomyType":113,"taxonomyTypeDesc":114},{"categoryNo":225,"categoryName":226,"taxonomyType":124,"taxonomyTypeDesc":125},"01JBSEEDCAT000000000000036","内容创作者",[228,229,230,231,232,233,234,235,135,236,138,139,140,237,238,239,240,241,183,242],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]