Traffic analysis and PCAP forensics playbook. Use when analyzing network captures including Wireshark filters, protocol analysis (HTTP/DNS/FTP/SMTP/USB/WiFi), data extraction, covert channel detection, PCAP repair, TLS decryption, and tshark command-line analysis.

SKILL: Traffic Analysis & PCAP — Expert Analysis Playbook AI LOAD INSTRUCTION : Expert traffic analysis and PCAP forensics techniques. Covers PCAP repair, Wireshark essential filters, protocol specific analysis (HTTP, HTTPS/TLS, DNS, FTP, SMTP, USB HID, WiFi, ICMP), data extraction (file carving, credential harvesting, covert channels), NetworkMiner, and tshark CLI analysis. Base models miss USB keyboard decode patterns, DNS tunneling detection heuristics, and TLS decryption workflows. 0. RELATED ROUTING Before going deep, consider loading: [memory forensics volatility](../memory forensics volatility/SKILL.md) for correlating memory artifacts with network traffic [steganography techniques](../steganography techniques/SKILL.md) for analyzing files extracted from traffic captures [network protocol attacks](../network protocol attacks/SKILL.md) for understanding attack patterns visible in captures [reverse shell techniques](../reverse shell techniques/SKILL.md) for identifying shell traffic in captures 1. PCAP REPAIR 2. WIRESHARK ESSENTIAL FILTERS IP / Host Filters Protocol Filters TCP / Stream HTTP DNS TLS Content Search 3. PROTOCOL ANALYSIS HTTP — Follow Stream & Extract HTTPS / TLS Decryption DNS — Tunneling Detection FTP — Credential & File Extraction SMTP — Email Content Extraction USB — Keyboard HID Capture Decode WiFi — WPA Handshake ICMP — Data Exfiltration 4. DATA EXTRACTION File Carving Credential Harvesting Covert Channel Detection Indicators: DNS with long subdomains, ICMP with large payloads, HTTP with encoded headers, regular beacon intervals (C2). Use tshark q z io,stat,1 and z conv,tcp for statistical anomaly detection. 5. NETWORKMINER 6. TSHARK COMMAND LINE ANALYSIS 7. DECISION TREE

traffic-analysis-pcap