--- name: wireshark-network-traffic-analysis description: This skill should be used when the user asks to "analyze network traffic with Wireshark", "capture packets for troubleshooting", "filter PCAP files", "follow TCP/UDP streams", "detect network anomalies", "investigate suspicious traffic", or "perform protocol analysis". It provides comprehensive techniques for network packet capture, filtering, and analysis using Wireshark. metadata: author: zebbern version: "1.1" --- # Wireshark Network Traffic Analysis ## Purpose Execute comprehensive network traffic analysis using Wireshark to capture, filter, and examine network packets for security investigations, performance optimization, and troubleshooting. This skill enables systematic analysis of network protocols, detection of anomalies, and reconstruction of network conversations from PCAP files. ## Inputs / Prerequisites ### Required Tools - Wireshark installed (Windows, macOS, or Linux) - Network interface with capture permissions - PCAP/PCAPNG files for offline analysis - Administrator/root privileges for live capture ### Technical Requirements - Understanding of network protocols (TCP, UDP, HTTP, DNS) - Familiarity with IP addressing and ports - Knowledge of OSI model layers - Understanding of common attack patterns ### Use Cases - Network troubleshooting and connectivity issues - Security incident investigation - Malware traffic analysis - Performance monitoring and optimization - Protocol learning and education ## Outputs / Deliverables ### Primary Outputs - Filtered packet captures for specific traffic - Reconstructed communication streams - Traffic statistics and visualizations - Evidence documentation for incidents ## Core Workflow ### Phase 1: Capturing Network Traffic #### Start Live Capture Begin capturing packets on network interface: ``` 1. Launch Wireshark 2. Select network interface from main screen 3. Click shark fin icon or double-click interface 4. Capture begins immediately ``` #### Capture Controls | Action | Shortcut | Description | |--------|----------|-------------| | Start/Stop Capture | Ctrl+E | Toggle capture on/off | | Restart Capture | Ctrl+R | Stop and start new capture | | Open PCAP File | Ctrl+O | Load existing capture file | | Save Capture | Ctrl+S | Save current capture | #### Capture Filters Apply filters before capture to limit data collection: ``` # Capture only specific host host 192.168.1.100 # Capture specific port port 80 # Capture specific network net 192.168.1.0/24 # Exclude specific traffic not arp # Combine filters host 192.168.1.100 and port 443 ``` ### Phase 2: Display Filters #### Basic Filter Syntax Filter captured packets for analysis: ``` # IP address filters ip.addr == 192.168.1.1 # All traffic to/from IP ip.src == 192.168.1.1 # Source IP only ip.dst == 192.168.1.1 # Destination IP only # Port filters tcp.port == 80 # TCP port 80 udp.port == 53 # UDP port 53 tcp.dstport == 443 # Destination port 443 tcp.srcport == 22 # Source port 22 ``` #### Protocol Filters Filter by specific protocols: ``` # Common protocols http # HTTP traffic https or ssl or tls # Encrypted web traffic dns # DNS queries and responses ftp # FTP traffic ssh # SSH traffic icmp # Ping/ICMP traffic arp # ARP requests/responses dhcp # DHCP traffic smb or smb2 # SMB file sharing ``` #### TCP Flag Filters Identify specific connection states: ``` tcp.flags.syn == 1 # SYN packets (connection attempts) tcp.flags.ack == 1 # ACK packets tcp.flags.fin == 1 # FIN packets (connection close) tcp.flags.reset == 1 # RST packets (connection reset) tcp.flags.syn == 1 && tcp.flags.ack == 0 # SYN-only (initial connection) ``` #### Content Filters Search for specific content: ``` frame contains "password" # Packets containing string http.request.uri contains "login" # HTTP URIs with string tcp contains "GET" # TCP packets with string ``` #### Analysis Filters Identify potential issues: ``` tcp.analysis.retransmission # TCP retransmissions tcp.analysis.duplicate_ack # Duplicate ACKs tcp.analysis.zero_window # Zero window (flow control) tcp.analysis.flags # Packets with issues dns.flags.rcode != 0 # DNS errors ``` #### Combining Filters Use logical operators for complex queries: ``` # AND operator ip.addr == 192.168.1.1 && tcp.port == 80 # OR operator dns || http # NOT operator !(arp || icmp) # Complex combinations (ip.src == 192.168.1.1 || ip.src == 192.168.1.2) && tcp.port == 443 ``` ### Phase 3: Following Streams #### TCP Stream Reconstruction View complete TCP conversation: ``` 1. Right-click on any TCP packet 2. Select Follow > TCP Stream 3. View reconstructed conversation 4. Toggle between ASCII, Hex, Raw views 5. Filter to show only this stream ``` #### Stream Types | Stream | Access | Use Case | |--------|--------|----------| | TCP Stream | Follow > TCP Stream | Web, file transfers, any TCP | | UDP Stream | Follow > UDP Stream | DNS, VoIP, streaming | | HTTP Stream | Follow > HTTP Stream | Web content, headers | | TLS Stream | Follow > TLS Stream | Encrypted traffic (if keys available) | #### Stream Analysis Tips - Review request/response pairs - Identify transmitted files or data - Look for credentials in plaintext - Note unusual patterns or commands ### Phase 4: Statistical Analysis #### Protocol Hierarchy View protocol distribution: ``` Statistics > Protocol Hierarchy Shows: - Percentage of each protocol - Packet counts - Bytes transferred - Protocol breakdown tree ``` #### Conversations Analyze communication pairs: ``` Statistics > Conversations Tabs: - Ethernet: MAC address pairs - IPv4/IPv6: IP address pairs - TCP: Connection details (ports, bytes, packets) - UDP: Datagram exchanges ``` #### Endpoints View active network participants: ``` Statistics > Endpoints Shows: - All source/destination addresses - Packet and byte counts - Geographic information (if enabled) ``` #### Flow Graph Visualize packet sequence: ``` Statistics > Flow Graph Options: - All packets or displayed only - Standard or TCP flow - Shows packet timing and direction ``` #### I/O Graphs Plot traffic over time: ``` Statistics > I/O Graph Features: - Packets per second - Bytes per second - Custom filter graphs - Multiple graph overlays ``` ### Phase 5: Security Analysis #### Detect Port Scanning Identify reconnaissance activity: ``` # SYN scan detection (many ports, same source) ip.src == SUSPECT_IP && tcp.flags.syn == 1 # Review Statistics > Conversations for anomalies # Look for single source hitting many destination ports ``` #### Identify Suspicious Traffic Filter for anomalies: ``` # Traffic to unusual ports tcp.dstport > 1024 && tcp.dstport < 49152 # Traffic outside trusted network !(ip.addr == 192.168.1.0/24) # Unusual DNS queries dns.qry.name contains "suspicious-domain" # Large data transfers frame.len > 1400 ``` #### ARP Spoofing Detection Identify ARP attacks: ``` # Duplicate ARP responses arp.duplicate-address-frame # ARP traffic analysis arp # Look for: # - Multiple MACs for same IP # - Gratuitous ARP floods # - Unusual ARP patterns ``` #### Examine Downloads Analyze file transfers: ``` # HTTP file downloads http.request.method == "GET" && http contains "Content-Disposition" # Follow HTTP Stream to view file content # Use File > Export Objects > HTTP to extract files ``` #### DNS Analysis Investigate DNS activity: ``` # All DNS traffic dns # DNS queries only dns.flags.response == 0 # DNS responses only dns.flags.response == 1 # Failed DNS lookups dns.flags.rcode != 0 # Specific domain queries dns.qry.name contains "domain.com" ``` ### Phase 6: Expert Information #### Access Expert Analysis View Wireshark's automated findings: ``` Analyze > Expert Information Categories: - Errors: Critical issues - Warnings: Potential problems - Notes: Informational items - Chats: Normal conversation events ``` #### Common Expert Findings | Finding | Meaning | Action | |---------|---------|--------| | TCP Retransmission | Packet resent | Check for packet loss | | Duplicate ACK | Possible loss | Investigate network path | | Zero Window | Buffer full | Check receiver performance | | RST | Connection reset | Check for blocks/errors | | Out-of-Order | Packets reordered | Usually normal, excessive is issue | ## Quick Reference ### Keyboard Shortcuts | Action | Shortcut | |--------|----------| | Open file | Ctrl+O | | Save file | Ctrl+S | | Start/Stop capture | Ctrl+E | | Find packet | Ctrl+F | | Go to packet | Ctrl+G | | Next packet | ↓ | | Previous packet | ↑ | | First packet | Ctrl+Home | | Last packet | Ctrl+End | | Apply filter | Enter | | Clear filter | Ctrl+Shift+X | ### Common Filter Reference ``` # Web traffic http || https # Email smtp || pop || imap # File sharing smb || smb2 || ftp # Authentication ldap || kerberos # Network management snmp || icmp # Encrypted tls || ssl ``` ### Export Options ``` File > Export Specified Packets # Save filtered subset File > Export Objects > HTTP # Extract HTTP files File > Export Packet Dissections # Export as text/CSV ``` ## Constraints and Guardrails ### Operational Boundaries - Capture only authorized network traffic - Handle captured data according to privacy policies - Avoid capturing sensitive credentials unnecessarily - Properly secure PCAP files containing sensitive data ### Technical Limitations - Large captures consume significant memory - Encrypted traffic content not visible without keys - High-speed networks may drop packets - Some protocols require plugins for full decoding ### Best Practices - Use capture filters to limit data collection - Save captures regularly during long sessions - Use display filters rather than deleting packets - Document analysis findings and methodology ## Examples ### Example 1: HTTP Credential Analysis **Scenario**: Investigate potential plaintext credential transmission ``` 1. Filter: http.request.method == "POST" 2. Look for login forms 3. Follow HTTP Stream 4. Search for username/password parameters ``` **Finding**: Credentials transmitted in cleartext form data. ### Example 2: Malware C2 Detection **Scenario**: Identify command and control traffic ``` 1. Filter: dns 2. Look for unusual query patterns 3. Check for high-frequency beaconing 4. Identify domains with random-looking names 5. Filter: ip.dst == SUSPICIOUS_IP 6. Analyze traffic patterns ``` **Indicators**: - Regular timing intervals - Encoded/encrypted payloads - Unusual ports or protocols ### Example 3: Network Troubleshooting **Scenario**: Diagnose slow web application ``` 1. Filter: ip.addr == WEB_SERVER 2. Check Statistics > Service Response Time 3. Filter: tcp.analysis.retransmission 4. Review I/O Graph for patterns 5. Check for high latency or packet loss ``` **Finding**: TCP retransmissions indicating network congestion. ## Troubleshooting ### No Packets Captured - Verify correct interface selected - Check for admin/root permissions - Confirm network adapter is active - Disable promiscuous mode if issues persist ### Filter Not Working - Verify filter syntax (red = error) - Check for typos in field names - Use Expression button for valid fields - Clear filter and rebuild incrementally ### Performance Issues - Use capture filters to limit traffic - Split large captures into smaller files - Disable name resolution during capture - Close unnecessary protocol dissectors ### Cannot Decrypt TLS/SSL - Obtain server private key - Configure at Edit > Preferences > Protocols > TLS - For ephemeral keys, capture pre-master secret from browser - Some modern ciphers cannot be decrypted passively --- Source attribution: Dicklesworthstone Original project: https://github.com/Dicklesworthstone/pi_agent_rust/blob/f28fc46ee0db8e710d95b8b55592cd38d60f2b26/tests/ext_conformance/artifacts/templates-davila7/cli-tool/components/skills/security/wireshark-analysis/SKILL.md License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Dave AI. ## Upstream license notice MIT License (with OpenAI/Anthropic Rider) Copyright (c) 2026 Jeffrey Emanuel Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: ADDITIONAL RIDER / RESTRICTION (OpenAI / Anthropic): This rider is part of the "conditions" of this License. In the event of any conflict between this rider and any other portion of this License, this rider controls. "Restricted Parties" means OpenAI, L.L.C.; Anthropic, PBC; any of their respective Affiliates; and any person or entity acting directly or indirectly on behalf of, for the benefit of, or under the direction of any of the foregoing (including any officer, director, employee, contractor, agent, consultant, service provider, or representative). Notwithstanding any other provision of this License, no rights are granted to any Restricted Party. Any purported license, sublicense, assignment, transfer, or other permission to any Restricted Party is null and void absent the express prior written permission of Jeffrey Emanuel. You may not provide, disclose, distribute, sublicense, sell, lease, lend, host, make available, or otherwise permit access to the Software or any derivative work of the Software (as defined in applicable copyright law) (collectively, "Derivative Works") to or for any Restricted Party. For purposes of this rider, "use" includes, without limitation: copying, modifying, merging, publishing, distributing, sublicensing, selling, transferring, making available, hosting, deploying, executing, benchmarking, testing, analyzing, indexing, or incorporating the Software or any Derivative Works into any dataset, training corpus, evaluation harness, or pipeline for machine learning or other automated systems. This rider applies to the Software and all Derivative Works. As a condition of use, you agree that this rider is a precondition to exercising any rights under this License, and you agree that any distribution of the Software or any Derivative Works must include this rider provision unmodified. Any breach of this rider automatically and immediately terminates the permissions granted by this License. Upon termination, you must immediately cease all use and distribution of the Software and any Derivative Works and destroy all copies under your control. You agree that a breach of this rider would cause irreparable harm and that Jeffrey Emanuel may seek injunctive or other equitable relief to enforce this rider, in addition to any other remedies available at law. To the maximum extent permitted by applicable law, the prevailing party in any action to enforce this rider shall be entitled to recover reasonable attorneys' fees and costs. For purposes of this rider, "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the specified party. "Control" means ownership of more than 50% of the voting securities or other ownership interest, or the power to direct management or policies by contract or otherwise. The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Dave AI resource metadata Creator / publisher: Dicklesworthstone Original project: https://github.com/Dicklesworthstone/pi_agent_rust/blob/f28fc46ee0db8e710d95b8b55592cd38d60f2b26/tests/ext_conformance/artifacts/templates-davila7/cli-tool/components/skills/security/wireshark-analysis/SKILL.md Attribution basis: Source repository record Fields of work: Data & Analytics, Development & Engineering, Operations Roles: Data Analyst, DevOps / SRE, IT Operations, QA / Test Engineer, Security Engineer Specialties: Specialty not specified Tools: Wireshark Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: 6daf1b4f6ab0f38e972fe66db1f497aceb3cafc0bbffb21632ec417d5960658d