mcpField
P
performing-network-traffic-analysis-with-tshark

performing-network-traffic-analysis-with-tshark

github.com/mukul975Security35.2k112 installsUpdated 8w ago
Repository

About performing-network-traffic-analysis-with-tshark

A skill for analyzing network captures with tshark and pyshark, intended for security assessments and incident response. It extracts traffic statistics and IOCs while checking for suspicious connections and signs of DNS tunneling.

Key features

  1. 01Summarize protocols and conversations
  2. 02Rank hosts by traffic and connections
  3. 03Detect scans and unusual connection patterns
  4. 04Extract IPs, domains, and URLs
  5. 05Identify signs of DNS tunneling
  6. 06Generate structured analysis reports

Use cases

  1. 01Analyze PCAP files during incident response
  2. 02Review captured traffic from security assessments
  3. 03Identify suspicious outbound traffic and transfers
  4. 04Summarize DNS anomalies and network IOCs

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill performing-network-traffic-analysis-with-tshark

After installing, type/performing-network-traffic-analysis-with-tsharkin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

LICENSE
references/
api-reference.md
scripts/
agent.py

Details

From the project README

Performing Network Traffic Analysis with TShark

Overview

This skill automates packet capture analysis using tshark (Wireshark CLI) and pyshark (Python wrapper). It extracts protocol distribution statistics, identifies suspicious network flows (port scans, beaconing, data exfiltration), extracts IOCs (IPs, domains, URLs), and detects DNS tunneling patterns from PCAP files.

When to Use

  • When conducting security assessments that involve performing network traffic analysis with tshark
  • When following incident response procedures for related security events
  • When performing scheduled security testing or auditing activities
  • When validating security controls through hands-on testing

Prerequisites

  • tshark (Wireshark CLI) installed and in PATH
  • Python 3.8+ with pyshark library
  • PCAP or PCAPNG capture file for analysis

Steps

  1. Extract Protocol Statistics — Generate protocol hierarchy and conversation statistics from the capture
  2. Identify Top Talkers — Rank source/destination IPs by volume and connection count
  3. Detect Suspicious Flows — Flag port scanning patterns, unusual port usage, and high-frequency connections
  4. Extract Network IOCs — Pull unique IPs, domains from DNS queries, and URLs from HTTP traffic
  5. Analyze DNS Traffic — Detect DNS tunneling via high-entropy subdomain queries and excessive TXT records
  6. Generate Analysis Report — Produce structured report with flow summaries and threat indicators

Expected Output

  • JSON report with protocol statistics and top talkers
  • Suspicious flow detections with severity ratings
  • Extracted IOCs (IPs, domains, URLs)
  • DNS anomaly analysis results

Comments

Markdown supported