mcpField
W
wireshark-analysis

wireshark-analysis

github.com/sickn33Security48.7k212 installsUpdated today
Repository

About wireshark-analysis

wireshark-analysis is a skill for examining network traffic with Wireshark, aimed at troubleshooting and security investigations. It outlines filtering, protocol analysis, and documenting findings, with guidance on authorized capture and sensitive data handling.

Key features

  1. 01Inspect traffic with filters
  2. 02Analyze plaintext HTTP credentials
  3. 03Identify malware C2 traffic
  4. 04Diagnose latency and TCP retransmissions
  5. 05Follow capture and data-protection practices

Use cases

  1. 01Investigate plaintext credentials in HTTP requests
  2. 02Find DNS beacons and suspicious domains
  3. 03Troubleshoot slow web applications

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/sickn33/agentic-awesome-skills --skill wireshark-analysis

After installing, type/wireshark-analysisin Claude Code to confirm it loaded.

Bundled filesreferences/detailed-guide.md

Details

From the project README

Wireshark Network Traffic Analysis

Detailed Guide

Read the detailed guide before executing this skill. It retains the complete procedure and reference material. Treat its safety, prerequisites, and validation requirements as mandatory. For focused work, load the relevant sections; for end-to-end work, read the guide completely.

Constraints and Guardrails

Operational Boundaries
  • Capture only authorized network traffic
  • Handle captured data according to privacy policies
  • Avoid capturing sensitive credentials unnecessarily
  • Properly secure PCAP files containing sensitive data
Technical Limitations
  • Large captures consume significant memory
  • Encrypted traffic content not visible without keys
  • High-speed networks may drop packets
  • Some protocols require plugins for full decoding
Best Practices
  • Use capture filters to limit data collection
  • Save captures regularly during long sessions
  • Use display filters rather than deleting packets
  • Document analysis findings and methodology

Examples

Example 1: HTTP Credential Analysis

Scenario: Investigate potential plaintext credential transmission

1. Filter: http.request.method == "POST"
2. Look for login forms
3. Follow HTTP Stream
4. Search for username/password parameters

Finding: Credentials transmitted in cleartext form data.

Example 2: Malware C2 Detection

Scenario: Identify command and control traffic

1. Filter: dns
2. Look for unusual query patterns
3. Check for high-frequency beaconing
4. Identify domains with random-looking names
5. Filter: ip.dst == SUSPICIOUS_IP
6. Analyze traffic patterns

Indicators:

  • Regular timing intervals
  • Encoded/encrypted payloads
  • Unusual ports or protocols
Example 3: Network Troubleshooting

Scenario: Diagnose slow web application

1. Filter: ip.addr == WEB_SERVER
2. Check Statistics > Service Response Time
3. Filter: tcp.analysis.retransmission
4. Review I/O Graph for patterns
5. Check for high latency or packet loss

Finding: TCP retransmissions indicating network congestion.

When to Use

This skill is applicable to execute the workflow or actions described in the overview.

Comments

Markdown supported