Traffic analysis and PCAP forensics playbook. Use when analyzing network captures including Wireshark filters, protocol analysis (HTTP/DNS/FTP/SMTP/USB/WiFi), data extraction, covert channel detection, PCAP repair, TLS decryption, and tshark command-line analysis.
Detected risks:
A hands-on playbook for network capture and PCAP forensics, aimed at analysts working through packet captures during investigations, incident response, or capture-the-flag challenges. It gathers practical techniques that base models tend to miss - USB keyboard decode patterns, DNS tunneling heuristics, and TLS decryption workflows - into a single reference.
Coverage begins with recovering damaged captures using tools such as pcapfix, editcap (to convert pcapng to pcap), and mergecap, along with the magic-byte signatures that identify capture formats. From there it lays out an extensive catalog of Wireshark display filters: host and subnet matching, protocol selectors, TCP stream following, and targeted HTTP, DNS, and TLS filters, plus raw-frame content searches for strings like credentials or CTF flag markers. Protocol-specific sections walk through following and exporting HTTP conversations, decrypting HTTPS either from an SSLKEYLOGFILE of browser pre-master secrets or a server RSA private key, spotting DNS tunneling by subdomain length and TXT-record volume, harvesting plaintext FTP and SMTP credentials, reconstructing email attachments, decoding USB HID keyboard keystrokes from 8-byte interrupt transfers, cracking WPA handshakes, and detecting ICMP-based exfiltration.
The final sections address data extraction - carving files from reassembled streams with Wireshark's Export Objects, binwalk, and foremost - and credential harvesting across plaintext and NTLM authentication. Throughout, tshark command-line one-liners accompany the GUI steps so extraction can be scripted. Cross-references point to companion skills for memory forensics, steganography, network protocol attacks, and reverse-shell identification when findings need correlation beyond the capture itself. Reach for it whenever a task centers on interpreting or extracting evidence from network traffic rather than generating it.
It documents pcapfix to repair corrupted captures, editcap to convert pcapng to pcap, and mergecap to combine multiple files, along with the magic-byte signatures that identify each capture format.
Yes. Two methods are covered: pointing Wireshark at an SSLKEYLOGFILE of browser pre-master secrets, or supplying a server RSA private key, which only works for RSA key exchange.
It lists heuristics such as unusually long subdomains, high volumes of TXT queries and responses, base32/base64-like subdomain strings, and high query frequency from one host, with filters like dns.qry.name.len > 50.
Yes. It shows how to filter USB HID keyboard interrupt transfers, extract the 8-byte capdata with tshark, and map HID keycodes back to typed text.
Beyond Wireshark it uses tshark for scripted extraction, plus pcapfix, editcap, mergecap, binwalk, foremost, NetworkMiner, and hcxpcapngtool with hashcat for WiFi handshake cracking.
Quick Setup:
.claude/skills/Repository
yaklang/hack-skills