Traffic Analysis Pcap

This is a comprehensive PCAP analysis reference that covers the full forensics workflow, from repairing corrupted captures to extracting credentials and detecting covert channels. You get battle-tested Wireshark filters, protocol-specific analysis techniques for HTTP/DNS/FTP/SMTP/USB/WiFi, and practical tshark command lines for scripting. The USB HID keyboard decoding section and DNS tunneling detection heuristics are especially useful since those patterns aren't obvious from documentation alone. Load this when you're analyzing network captures for CTFs, incident response, or malware traffic analysis. It's structured as a quick reference rather than a tutorial, so you can jump straight to the protocol or technique you need.

skills.sh installs: 3.9K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill traffic-analysis-pcap --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Traffic Analysis & PCAP — Expert Analysis Playbook

AI LOAD INSTRUCTION: Expert traffic analysis and PCAP forensics techniques. Covers PCAP repair, Wireshark essential filters, protocol-specific analysis (HTTP, HTTPS/TLS, DNS, FTP, SMTP, USB HID, WiFi, ICMP), data extraction (file carving, credential harvesting, covert channels), NetworkMiner, and tshark CLI analysis. Base models miss USB keyboard decode patterns, DNS tunneling detection heuristics, and TLS decryption workflows.

0. RELATED ROUTING

Before going deep, consider loading:

memory-forensics-volatility for correlating memory artifacts with network traffic
steganography-techniques for analyzing files extracted from traffic captures
network-protocol-attacks for understanding attack patterns visible in captures
reverse-shell-techniques for identifying shell traffic in captures