The pcap-analyzer skill enables deep inspection of network traffic captures directly within your development or security workflow. By leveraging Scapy and tshark, it automates complex forensic tasks such as TCP/UDP stream reassembly, DNS and HTTP transaction extraction, credential discovery, and file carving. This skill is ideal for security researchers and developers performing incident response, malware behavior analysis, or network auditing, providing structured JSON outputs and summaries to quickly identify C2 beaconing, port scanning, and sensitive data exposure.
主要功能
01File carving from network traffic (PE, ELF, PDF, ZIP, etc.) with MD5 hashing.
028 GitHub stars
03Automated extraction of DNS queries, HTTP transactions, and TCP/UDP streams.
04Detailed traffic statistics, protocol distribution, and endpoint mapping.
05Cleartext credential discovery for protocols like HTTP Basic, FTP, and SMTP.
06Detection of security anomalies including C2 beaconing, DNS tunneling, and data exfiltration.
使用场景
01Auditing network applications for accidental cleartext credential exposure or sensitive data leaks.
02Analyzing malware network behavior from sandbox captures to identify command-and-control infrastructure.
03Investigating network artifacts and communication patterns during forensic incident response.