[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADR33RA6YSAYYBHDZ7KFK4":3,"skill-same:01M6ADR33RA6YSAYYBHDZ7KFK4":112},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":63,"commitSha":64,"skillDirectory":65,"forksCount":66,"repositoryHtmlUrl":67,"repositoryHomepageUrl":68,"ownerHtmlUrl":69,"ownerBlogUrl":70,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M6ADR33RA6YSAYYBHDZ7KFK4","analyzing-network-traffic-with-wireshark",null,"Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and support incident response investigations on authorized network segments.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-network-traffic-with-wireshark\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"analyzing network traffic with wireshark","Wireshark","network","analyzing","issues","network-security","traffic-analysis","pcap","packet-analysis","data","malicious","protocol","artifacts","pr","diagnose","support","incident response","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: analyzing-network-traffic-with-wireshark\ndescription: 'Captures and analyzes network packet data using Wireshark and tshark\n  to identify malicious traffic patterns, diagnose protocol issues, extract artifacts,\n  and support incident response investigations on authorized network segments.\n\n  '\ndomain: cybersecurity\nsubdomain: network-security\ntags:\n- network-security\n- wireshark\n- packet-analysis\n- traffic-analysis\n- pcap\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-03\n- PR.DS-02\nmitre_attack:\n- T1040\n- T1071\n- T1557\n- T1046\n---\n# Analyzing Network Traffic with Wireshark\n\n## When to Use\n\n- Investigating suspected network intrusions by examining packet-level evidence of command-and-control traffic, data exfiltration, or lateral movement\n- Diagnosing network performance issues such as retransmissions, fragmentation, or DNS resolution failures\n- Analyzing malware communication patterns by capturing traffic from sandboxed or isolated hosts\n- Validating firewall and IDS rules by confirming what traffic is actually traversing network segments\n- Extracting files, credentials, or indicators of compromise from captured network sessions\n\n**Do not use** to capture traffic on networks without authorization, to intercept private communications without legal authority, or as a substitute for full-featured SIEM platforms in production monitoring.\n\n## Prerequisites\n\n- Wireshark 4.0+ and tshark command-line utility installed\n- Root\u002Fsudo privileges or membership in the `wireshark` group for live packet capture\n- Network interface access (physical NIC, span port, or network tap) to the monitored segment\n- Sufficient disk space for packet capture files (estimate 1 GB per minute on busy gigabit links)\n- Familiarity with TCP\u002FIP protocols, HTTP, DNS, TLS, and SMB at the packet level\n\n## Workflow\n\n### Step 1: Configure Capture Environment\n\nSet up the capture interface and filters to target relevant traffic:\n\n```bash\n# List available interfaces\ntshark -D\n\n# Start capture on eth0 with a capture filter to limit scope\ntshark -i eth0 -f \"host 10.10.5.23 and (port 80 or port 443 or port 445)\" -w \u002Ftmp\u002Fcapture.pcapng\n\n# Capture with ring buffer to manage disk usage (10 files, 100MB each)\ntshark -i eth0 -b filesize:102400 -b files:10 -w \u002Ftmp\u002Frolling_capture.pcapng\n\n# Capture on multiple interfaces simultaneously\ntshark -i eth0 -i eth1 -w \u002Ftmp\u002Fmulti_interface.pcapng\n```\n\nFor Wireshark GUI, set capture filter in the Capture Options dialog before starting.\n\n### Step 2: Apply Display Filters for Targeted Analysis\n\n```bash\n# Filter HTTP traffic containing suspicious user agents\ntshark -r capture.pcapng -Y \"http.user_agent contains \\\"curl\\\" or http.user_agent contains \\\"Wget\\\"\"\n\n# Find DNS queries to suspicious TLDs\ntshark -r capture.pcapng -Y \"dns.qry.name contains \\\".xyz\\\" or dns.qry.name contains \\\".top\\\" or dns.qry.name contains \\\".tk\\\"\"\n\n# Identify TCP retransmissions indicating network issues\ntshark -r capture.pcapng -Y \"tcp.analysis.retransmission\"\n\n# Filter SMB traffic for lateral movement detection\ntshark -r capture.pcapng -Y \"smb2.cmd == 5 or smb2.cmd == 3\" -T fields -e ip.src -e ip.dst -e smb2.filename\n\n# Find cleartext credential transmission\ntshark -r capture.pcapng -Y \"ftp.request.command == \\\"PASS\\\" or http.authbasic\"\n\n# Detect beaconing patterns (regular interval connections)\ntshark -r capture.pcapng -Y \"ip.dst == 203.0.113.50\" -T fields -e frame.time_relative -e ip.src -e tcp.dstport\n```\n\n### Step 3: Protocol-Specific Deep Analysis\n\n```bash\n# Follow a TCP stream to reconstruct a conversation\ntshark -r capture.pcapng -q -z follow,tcp,ascii,0\n\n# Analyze HTTP request\u002Fresponse pairs\ntshark -r capture.pcapng -Y \"http\" -T fields -e frame.time -e ip.src -e ip.dst -e http.request.method -e http.request.uri -e http.response.code\n\n# Extract DNS query\u002Fresponse statistics\ntshark -r capture.pcapng -q -z dns,tree\n\n# Analyze TLS handshakes for weak cipher suites\ntshark -r capture.pcapng -Y \"tls.handshake.type == 2\" -T fields -e ip.src -e ip.dst -e tls.handshake.ciphersuite\n\n# SMB file access enumeration\ntshark -r capture.pcapng -Y \"smb2\" -T fields -e frame.time -e ip.src -e ip.dst -e smb2.filename -e smb2.cmd\n```\n\n### Step 4: Extract Artifacts and IOCs\n\n```bash\n# Export HTTP objects (files transferred over HTTP)\ntshark -r capture.pcapng --export-objects http,\u002Ftmp\u002Fhttp_objects\u002F\n\n# Export SMB objects (files transferred over SMB)\ntshark -r capture.pcapng --export-objects smb,\u002Ftmp\u002Fsmb_objects\u002F\n\n# Extract all unique destination IPs for threat intelligence lookup\ntshark -r capture.pcapng -T fields -e ip.dst | sort -u > unique_dest_ips.txt\n\n# Extract SSL\u002FTLS certificate information\ntshark -r capture.pcapng -Y \"tls.handshake.type == 11\" -T fields -e x509sat.uTF8String -e x509ce.dNSName\n\n# Extract all URLs accessed\ntshark -r capture.pcapng -Y \"http.request\" -T fields -e http.host -e http.request.uri | sort -u > urls.txt\n\n# Hash extracted files for IOC matching\nfind \u002Ftmp\u002Fhttp_objects\u002F -type f -exec sha256sum {} \\; > extracted_file_hashes.txt\n```\n\n### Step 5: Statistical Analysis and Anomaly Detection\n\n```bash\n# Protocol hierarchy statistics\ntshark -r capture.pcapng -q -z io,phs\n\n# Conversation statistics sorted by bytes\ntshark -r capture.pcapng -q -z conv,tcp -z conv,udp\n\n# Identify top talkers\ntshark -r capture.pcapng -q -z endpoints,ip\n\n# IO graph data (packets per second)\ntshark -r capture.pcapng -q -z io,stat,1,\"COUNT(frame) frame\"\n\n# Detect port scanning patterns\ntshark -r capture.pcapng -Y \"tcp.flags.syn == 1 and tcp.flags.ack == 0\" -T fields -e ip.src -e tcp.dstport | sort | uniq -c | sort -rn | head -20\n```\n\n### Step 6: Generate Reports and Export Evidence\n\n```bash\n# Export filtered packets to a new PCAP for evidence preservation\ntshark -r capture.pcapng -Y \"ip.addr == 10.10.5.23 and tcp.port == 4444\" -w evidence_c2_traffic.pcapng\n\n# Generate packet summary in CSV format\ntshark -r capture.pcapng -T fields -E header=y -E separator=, -e frame.number -e frame.time -e ip.src -e ip.dst -e ip.proto -e tcp.srcport -e tcp.dstport -e frame.len > traffic_summary.csv\n\n# Create PDML (XML) output for programmatic analysis\ntshark -r capture.pcapng -T pdml > capture_analysis.xml\n\n# Calculate capture file hash for chain of custody\nsha256sum capture.pcapng > capture_hash.txt\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Capture Filter (BPF)** | Berkeley Packet Filter syntax applied at capture time to limit which packets are recorded, reducing file size and improving performance |\n| **Display Filter** | Wireshark-specific filter syntax applied to already-captured packets for focused analysis without altering the capture file |\n| **PCAPNG** | Next-generation packet capture format supporting multiple interfaces, name resolution, annotations, and metadata in a single file |\n| **TCP Stream** | Reassembled sequence of TCP segments representing a complete bidirectional conversation between two endpoints |\n| **Protocol Dissector** | Wireshark module that decodes a specific protocol's fields and structure, enabling deep inspection of packet contents |\n| **IO Graph** | Time-series visualization of packet or byte rates over the capture duration, useful for identifying traffic spikes or beaconing |\n\n## Tools & Systems\n\n- **Wireshark 4.0+**: GUI-based packet analyzer with protocol dissectors for 3,000+ protocols, stream reassembly, and export capabilities\n- **tshark**: Command-line version of Wireshark for headless capture, batch processing, and scripted analysis pipelines\n- **tcpdump**: Lightweight packet capture tool for quick captures on remote systems without GUI dependencies\n- **mergecap**: Wireshark utility for combining multiple capture files into a single PCAP for unified analysis\n- **editcap**: Wireshark utility for splitting, filtering, and converting between capture file formats\n\n## Common Scenarios\n\n### Scenario: Investigating Suspected Data Exfiltration via DNS Tunneling\n\n**Context**: The SOC team detected unusually high DNS query volumes from a workstation (10.10.3.45) to an external domain. The SIEM alert flagged DNS queries averaging 200 per minute compared to the baseline of 15. A packet capture was initiated from the network tap on the workstation's VLAN.\n\n**Approach**:\n1. Capture traffic from the workstation's subnet using `tshark -i eth2 -f \"host 10.10.3.45 and port 53\" -w dns_exfil_investigation.pcapng`\n2. Analyze DNS query patterns: `tshark -r dns_exfil_investigation.pcapng -Y \"dns.qry.name contains \\\"suspect-domain.xyz\\\"\" -T fields -e frame.time -e dns.qry.name`\n3. Examine subdomain labels for encoded data (long base64-like subdomains indicate tunneling): `tshark -r dns_exfil_investigation.pcapng -Y \"dns.qry.type == 16\" -T fields -e dns.qry.name -e dns.txt`\n4. Calculate data volume by summing query name lengths to estimate exfiltration bandwidth\n5. Extract unique query names and decode base64 subdomains to recover exfiltrated content\n6. Export evidence packets to a separate PCAP and generate SHA-256 hash for chain of custody\n\n**Pitfalls**:\n- Capturing unfiltered traffic on a busy network and running out of disk space before collecting relevant data\n- Using display filters instead of capture filters, resulting in massive files that are slow to process\n- Overlooking encrypted DNS (DoH\u002FDoT) traffic that bypasses traditional DNS capture on port 53\n- Failing to establish packet capture hash and chain of custody documentation for forensic evidence\n\n## Output Format\n\n```\n## Traffic Analysis Report\n\n**Case ID**: IR-2024-0847\n**Capture File**: dns_exfil_investigation.pcapng\n**SHA-256**: a3f2b8c1d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1\n**Duration**: 2024-03-15 14:00:00 to 14:45:00 UTC\n**Source Interface**: eth2 (VLAN 30 span port)\n\n### Findings\n\n**1. DNS Tunneling Confirmed**\n- Source: 10.10.3.45\n- Destination DNS: 8.8.8.8 (forwarded to ns1.suspect-domain.xyz)\n- Query volume: 9,247 queries in 45 minutes (205\u002Fmin vs 15\u002Fmin baseline)\n- Average subdomain label length: 63 characters (base64-encoded data)\n- Estimated data exfiltrated: ~2.3 MB via TXT record responses\n\n**2. Indicators of Compromise**\n- Domain: suspect-domain.xyz (registered 3 days prior)\n- Nameserver: ns1.suspect-domain.xyz (203.0.113.50)\n- Query pattern: TXT record requests with base64-encoded subdomains\n- Response pattern: TXT records containing base64-encoded payloads\n```\n","# Analyzing Network Traffic with Wireshark\n\n## When to Use\n\n- Investigating suspected network intrusions by examining packet-level evidence of command-and-control traffic, data exfiltration, or lateral movement\n- Diagnosing network performance issues such as retransmissions, fragmentation, or DNS resolution failures\n- Analyzing malware communication patterns by capturing traffic from sandboxed or isolated hosts\n- Validating firewall and IDS rules by confirming what traffic is actually traversing network segments\n- Extracting files, credentials, or indicators of compromise from captured network sessions\n\n**Do not use** to capture traffic on networks without authorization, to intercept private communications without legal authority, or as a substitute for full-featured SIEM platforms in production monitoring.\n\n## Prerequisites\n\n- Wireshark 4.0+ and tshark command-line utility installed\n- Root\u002Fsudo privileges or membership in the `wireshark` group for live packet capture\n- Network interface access (physical NIC, span port, or network tap) to the monitored segment\n- Sufficient disk space for packet capture files (estimate 1 GB per minute on busy gigabit links)\n- Familiarity with TCP\u002FIP protocols, HTTP, DNS, TLS, and SMB at the packet level\n\n## Workflow\n\n### Step 1: Configure Capture Environment\n\nSet up the capture interface and filters to target relevant traffic:\n\n```bash\n# List available interfaces\ntshark -D\n\n# Start capture on eth0 with a capture filter to limit scope\ntshark -i eth0 -f \"host 10.10.5.23 and (port 80 or port 443 or port 445)\" -w \u002Ftmp\u002Fcapture.pcapng\n\n# Capture with ring buffer to manage disk usage (10 files, 100MB each)\ntshark -i eth0 -b filesize:102400 -b files:10 -w \u002Ftmp\u002Frolling_capture.pcapng\n\n# Capture on multiple interfaces simultaneously\ntshark -i eth0 -i eth1 -w \u002Ftmp\u002Fmulti_interface.pcapng\n```\n\nFor Wireshark GUI, set capture filter in the Capture Options dialog before starting.\n\n### Step 2: Apply Display Filters for Targeted Analysis\n\n```bash\n# Filter HTTP traffic containing suspicious user agents\ntshark -r capture.pcapng -Y \"http.user_agent contains \\\"curl\\\" or http.user_agent contains \\\"Wget\\\"\"\n\n# Find DNS queries to suspicious TLDs\ntshark -r capture.pcapng -Y \"dns.qry.name contains \\\".xyz\\\" or dns.qry.name contains \\\".top\\\" or dns.qry.name contains \\\".tk\\\"\"\n\n# Identify TCP retransmissions indicating network issues\ntshark -r capture.pcapng -Y \"tcp.analysis.retransmission\"\n\n# Filter SMB traffic for lateral movement detection\ntshark -r capture.pcapng -Y \"smb2.cmd == 5 or smb2.cmd == 3\" -T fields -e ip.src -e ip.dst -e smb2.filename\n\n# Find cleartext credential transmission\ntshark -r capture.pcapng -Y \"ftp.request.command == \\\"PASS\\\" or http.authbasic\"\n\n# Detect beaconing patterns (regular interval connections)\ntshark -r capture.pcapng -Y \"ip.dst == 203.0.113.50\" -T fields -e frame.time_relative -e ip.src -e tcp.dstport\n```\n\n### Step 3: Protocol-Specific Deep Analysis\n\n```bash\n# Follow a TCP stream to reconstruct a conversation\ntshark -r capture.pcapng -q -z follow,tcp,ascii,0\n\n# Analyze HTTP request\u002Fresponse pairs\ntshark -r capture.pcapng -Y \"http\" -T fields -e frame.time -e ip.src -e ip.dst -e http.request.method -e http.request.uri -e http.response.code\n\n# Extract DNS query\u002Fresponse statistics\ntshark -r capture.pcapng -q -z dns,tree\n\n# Analyze TLS handshakes for weak cipher suites\ntshark -r capture.pcapng -Y \"tls.handshake.type == 2\" -T fields -e ip.src -e ip.dst -e tls.handshake.ciphersuite\n\n# SMB file access enumeration\ntshark -r capture.pcapng -Y \"smb2\" -T fields -e frame.time -e ip.src -e ip.dst -e smb2.filename -e smb2.cmd\n```\n\n### Step 4: Extract Artifacts and IOCs\n\n```bash\n# Export HTTP objects (files transferred over HTTP)\ntshark -r capture.pcapng --export-objects http,\u002Ftmp\u002Fhttp_objects\u002F\n\n# Export SMB objects (files transferred over SMB)\ntshark -r capture.pcapng --export-objects smb,\u002Ftmp\u002Fsmb_objects\u002F\n\n# Extract all unique destination IPs for threat intelligence lookup\ntshark -r capture.pcapng -T fields -e ip.dst | sort -u > unique_dest_ips.txt\n\n# Extract SSL\u002FTLS certificate information\ntshark -r capture.pcapng -Y \"tls.handshake.type == 11\" -T fields -e x509sat.uTF8String -e x509ce.dNSName\n\n# Extract all URLs accessed\ntshark -r capture.pcapng -Y \"http.request\" -T fields -e http.host -e http.request.uri | sort -u > urls.txt\n\n# Hash extracted files for IOC matching\nfind \u002Ftmp\u002Fhttp_objects\u002F -type f -exec sha256sum {} \\; > extracted_file_hashes.txt\n```\n\n### Step 5: Statistical Analysis and Anomaly Detection\n\n```bash\n# Protocol hierarchy statistics\ntshark -r capture.pcapng -q -z io,phs\n\n# Conversation statistics sorted by bytes\ntshark -r capture.pcapng -q -z conv,tcp -z conv,udp\n\n# Identify top talkers\ntshark -r capture.pcapng -q -z endpoints,ip\n\n# IO graph data (packets per second)\ntshark -r capture.pcapng -q -z io,stat,1,\"COUNT(frame) frame\"\n\n# Detect port scanning patterns\ntshark -r capture.pcapng -Y \"tcp.flags.syn == 1 and tcp.flags.ack == 0\" -T fields -e ip.src -e tcp.dstport | sort | uniq -c | sort -rn | head -20\n```\n\n### Step 6: Generate Reports and Export Evidence\n\n```bash\n# Export filtered packets to a new PCAP for evidence preservation\ntshark -r capture.pcapng -Y \"ip.addr == 10.10.5.23 and tcp.port == 4444\" -w evidence_c2_traffic.pcapng\n\n# Generate packet summary in CSV format\ntshark -r capture.pcapng -T fields -E header=y -E separator=, -e frame.number -e frame.time -e ip.src -e ip.dst -e ip.proto -e tcp.srcport -e tcp.dstport -e frame.len > traffic_summary.csv\n\n# Create PDML (XML) output for programmatic analysis\ntshark -r capture.pcapng -T pdml > capture_analysis.xml\n\n# Calculate capture file hash for chain of custody\nsha256sum capture.pcapng > capture_hash.txt\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Capture Filter (BPF)** | Berkeley Packet Filter syntax applied at capture time to limit which packets are recorded, reducing file size and improving performance |\n| **Display Filter** | Wireshark-specific filter syntax applied to already-captured packets for focused analysis without altering the capture file |\n| **PCAPNG** | Next-generation packet capture format supporting multiple interfaces, name resolution, annotations, and metadata in a single file |\n| **TCP Stream** | Reassembled sequence of TCP segments representing a complete bidirectional conversation between two endpoints |\n| **Protocol Dissector** | Wireshark module that decodes a specific protocol's fields and structure, enabling deep inspection of packet contents |\n| **IO Graph** | Time-series visualization of packet or byte rates over the capture duration, useful for identifying traffic spikes or beaconing |\n\n## Tools & Systems\n\n- **Wireshark 4.0+**: GUI-based packet analyzer with protocol dissectors for 3,000+ protocols, stream reassembly, and export capabilities\n- **tshark**: Command-line version of Wireshark for headless capture, batch processing, and scripted analysis pipelines\n- **tcpdump**: Lightweight packet capture tool for quick captures on remote systems without GUI dependencies\n- **mergecap**: Wireshark utility for combining multiple capture files into a single PCAP for unified analysis\n- **editcap**: Wireshark utility for splitting, filtering, and converting between capture file formats\n\n## Common Scenarios\n\n### Scenario: Investigating Suspected Data Exfiltration via DNS Tunneling\n\n**Context**: The SOC team detected unusually high DNS query volumes from a workstation (10.10.3.45) to an external domain. The SIEM alert flagged DNS queries averaging 200 per minute compared to the baseline of 15. A packet capture was initiated from the network tap on the workstation's VLAN.\n\n**Approach**:\n1. Capture traffic from the workstation's subnet using `tshark -i eth2 -f \"host 10.10.3.45 and port 53\" -w dns_exfil_investigation.pcapng`\n2. Analyze DNS query patterns: `tshark -r dns_exfil_investigation.pcapng -Y \"dns.qry.name contains \\\"suspect-domain.xyz\\\"\" -T fields -e frame.time -e dns.qry.name`\n3. Examine subdomain labels for encoded data (long base64-like subdomains indicate tunneling): `tshark -r dns_exfil_investigation.pcapng -Y \"dns.qry.type == 16\" -T fields -e dns.qry.name -e dns.txt`\n4. Calculate data volume by summing query name lengths to estimate exfiltration bandwidth\n5. Extract unique query names and decode base64 subdomains to recover exfiltrated content\n6. Export evidence packets to a separate PCAP and generate SHA-256 hash for chain of custody\n\n**Pitfalls**:\n- Capturing unfiltered traffic on a busy network and running out of disk space before collecting relevant data\n- Using display filters instead of capture filters, resulting in massive files that are slow to process\n- Overlooking encrypted DNS (DoH\u002FDoT) traffic that bypasses traditional DNS capture on port 53\n- Failing to establish packet capture hash and chain of custody documentation for forensic evidence\n\n## Output Format\n\n```\n## Traffic Analysis Report\n\n**Case ID**: IR-2024-0847\n**Capture File**: dns_exfil_investigation.pcapng\n**SHA-256**: a3f2b8c1d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1\n**Duration**: 2024-03-15 14:00:00 to 14:45:00 UTC\n**Source Interface**: eth2 (VLAN 30 span port)\n\n### Findings\n\n**1. DNS Tunneling Confirmed**\n- Source: 10.10.3.45\n- Destination DNS: 8.8.8.8 (forwarded to ns1.suspect-domain.xyz)\n- Query volume: 9,247 queries in 45 minutes (205\u002Fmin vs 15\u002Fmin baseline)\n- Average subdomain label length: 63 characters (base64-encoded data)\n- Estimated data exfiltrated: ~2.3 MB via TXT record responses\n\n**2. Indicators of Compromise**\n- Domain: suspect-domain.xyz (registered 3 days prior)\n- Nameserver: ns1.suspect-domain.xyz (203.0.113.50)\n- Query pattern: TXT record requests with base64-encoded subdomains\n- Response pattern: TXT records containing base64-encoded payloads\n```\n",{"name":5,"tags":48,"author":50,"domain":41,"license":15,"version":51,"nist_csf":52,"subdomain":29,"description":57,"mitre_attack":58},[29,49,32,30,31],"wireshark","mahipal","1.0",[53,54,55,56],"PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02","Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and support incident response investigations on authorized network segments.\n",[59,60,61,62],"T1040","T1071","T1557","T1046","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fanalyzing-network-traffic-with-wireshark",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-network-traffic-with-wireshark",{"tool":79,"command":80},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-network-traffic-with-wireshark",{"tool":82,"command":83},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-network-traffic-with-wireshark","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-network-traffic-with-wireshark\u002FSKILL.md",true,[87,92,98,102,106],{"path":88,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-network-traffic-with-wireshark\u002FLICENSE",{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002Fapi-reference.md","REFERENCE","参考文档",2971,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-network-traffic-with-wireshark\u002Freferences\u002Fapi-reference.md",{"path":99,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Freport-writer.md",6168,"https:\u002F\u002Fgithub.com\u002Fderseitenschneider\u002Fdotfiles\u002Fblob\u002Fmain\u002Fclaude-config\u002F.claude\u002Fskills\u002Fsynced\u002Fc18e4183-2bcf-4f84-9592-16baf9918832_492d02ae-7d32-4227-a9d4-d9f601100de4\u002Fdeep-research\u002Freferences\u002Freport-writer.md",{"path":103,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fresearcher.md",4222,"https:\u002F\u002Fgithub.com\u002Fderseitenschneider\u002Fdotfiles\u002Fblob\u002Fmain\u002Fclaude-config\u002F.claude\u002Fskills\u002Fsynced\u002Fc18e4183-2bcf-4f84-9592-16baf9918832_492d02ae-7d32-4227-a9d4-d9f601100de4\u002Fdeep-research\u002Freferences\u002Fresearcher.md",{"path":107,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":110,"sourceHtmlUrl":111},"scripts\u002Fagent.py","SCRIPT","脚本",7448,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-network-traffic-with-wireshark\u002Fscripts\u002Fagent.py",[113,136,160,188,213,240],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":120,"publishedAt":43},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[119],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[121,122,123,124,42,41,40,125,37,126,36,127,128,129,130,131,132,133,134,135],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","identity","code","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":143,"publishedAt":43},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[142],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[144,132,145,146,42,147,41,37,148,149,150,151,152,153,154,155,156,157,158,159],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":170,"publishedAt":43},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[166,169],{"categoryNo":167,"categoryName":168,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[154,171,172,173,174,41,175,176,148,177,178,179,180,181,182,183,184,185,186,187],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":195,"publishedAt":43},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[194],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[196,197,198,41,199,200,201,202,203,204,205,33,206,207,208,209,151,210,211,212],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":217,"categories":218,"keywords":220,"publishedAt":43},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[219],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[221,222,223,41,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":241,"name":242,"nameZh":6,"description":243,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":244,"categories":245,"keywords":247,"publishedAt":43},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[246],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[42,248,41,249,250,251,252,253,254,255,256,183,257,184,258,259,260,261,262,263],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]