Automate network traffic analysis using tshark (Wireshark CLI) and pyshark to compute protocol distribution statistics, detect suspicious flows such as port scans and beaconing, extract IOCs (IPs, domains, URLs), and identify DNS tunneling patterns from PCAP files. Use when scripted or repeatable analysis of packet captures is needed rather than interactive inspection.
Start a fresh conversation. Replace the highlighted placeholders.
Use performing-network-traffic-analysis-with-tshark to analyze [PCAP file] and produce a structured report of protocol distribution, top talkers, suspicious flows, extracted IOCs, and DNS-tunneling indicators; tshark and Python with pyshark must be available.
Required inputs
[PCAP file]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: performing-network-traffic-analysis-with-tsharkdescription: Automate network traffic analysis using tshark (Wireshark CLI) and pyshark to compute protocol distribution statistics, detect suspicious flows such as port scans and beaconing, extract IOCs (IPs, domains, URLs), and identify DNS tunneling patterns from PCAP files. Use when scripted or repeatable analysis of packet captures is needed rather than interactive inspection.domain: cybersecuritysubdomain: network-securitytags: - tshark- pyshark- pcap- packet-analysis- network-forensics- wireshark- traffic-analysisversion: '1.0'author: mahipallicense: Apache-2.0nist_csf: - PR.IR-01- DE.CM-01- ID.AM-03- PR.DS-02mitre_attack: - T1046- T1040- T1557- T1071- T1005
Performing Network Traffic Analysis with TShark
Overview
This skill automates packet capture analysis using tshark (Wireshark CLI) and pyshark (Python wrapper). It extracts protocol distribution statistics, identifies suspicious network flows (port scans, beaconing, data exfiltration), extracts IOCs (IPs, domains, URLs), and detects DNS tunneling patterns from PCAP files.
When to Use
When conducting security assessments that involve performing network traffic analysis with tshark
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Prerequisites
tshark (Wireshark CLI) installed and in PATH
Python 3.8+ with pyshark library
PCAP or PCAPNG capture file for analysis
Steps
Extract Protocol Statistics — Generate protocol hierarchy and conversation statistics from the capture
Identify Top Talkers — Rank source/destination IPs by volume and connection count
Detect Suspicious Flows — Flag port scanning patterns, unusual port usage, and high-frequency connections
Extract Network IOCs — Pull unique IPs, domains from DNS queries, and URLs from HTTP traffic
Analyze DNS Traffic — Detect DNS tunneling via high-entropy subdomain queries and excessive TXT records
Generate Analysis Report — Produce structured report with flow summaries and threat indicators
Expected Output
JSON report with protocol statistics and top talkers