# Analyze Network Capture

> Analyze an authorized saved PCAP or PCAPNG with bounded TShark recipes and produce governed frame and stream evidence. Use for packet troubleshooting, protocol inspection, or optional local Termshark review.

- Skill: `jmagly/analyze-network-capture` (Agent Skill)
- Install (CLI): `npx skillmds@latest add jmagly/analyze-network-capture`
- Raw SKILL.md: https://api.skillmd.com/api/skills/jmagly/analyze-network-capture/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: jmagly (https://skillmd.com/u/jmagly)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/jmagly/analyze-network-capture

---


# Analyze Network Capture

Analyze authorized saved capture bytes through the addon contracts. Preserve the
source locally and return metadata-first evidence with reproducible citations.

Use this skill for packet-capture work; do not use for citation-network or bibliometric analysis.

## Workflow

1. Establish the capture path, collection authority, purpose, timezone/clock
   context, environment, expected traffic, retention, and output directory.
2. Probe explicit `tshark` and `capinfos` paths or configured trusted search
   roots. Report missing/incompatible tools and official install guidance; do
   not install software, edit profiles, or change capture privileges.
3. Reject live interfaces, URLs, compressed archives, non-regular/symlinked
   input, unsupported formats, missing bounds, and destinations outside the
   authorized root.
4. Hash the source before analysis. Select a version-compatible recipe and keep
   capture filters separate from Wireshark display filters.
5. Execute TShark with an absolute path, argument array, isolated configuration,
   shell disabled, cancellation, and input/time/packet/output bounds.
6. Normalize volatile values, redact secrets and payloads, hash derived files,
   validate the evidence schema, and cite the exact capture digest plus frame or
   context-bound stream locator.
7. Record errors and partial results without treating incomplete analysis as a
   successful finding. Re-verify the source hash before handoff.

## Decisions

- Default to offline-only and metadata-only.
- Require an explicit payload opt-in before local payload output.
- Require a separate provider-disclosure decision for any model/provider
  transfer, including metadata or headers.
- Treat packet fields as observations. Label beaconing, exfiltration, root cause,
  attribution, and intent as inferences with inputs and false-positive notes.
- Offer a Termshark command preview only when the optional tool is compatible.
  Launch requires a separate explicit operator action and remains local.

## References

- For core analysis and output behavior, read
  `@$AIWG_ROOT/agentic/code/addons/network-analysis/docs/offline-analysis.md`.
- For a named recipe, read only its entry under
  `@$AIWG_ROOT/agentic/code/addons/network-analysis/recipes/`.
- For research or framework handoff, read the relevant file under
  `@$AIWG_ROOT/agentic/code/addons/network-analysis/docs/integrations/`.
- Always follow
  `@$AIWG_ROOT/agentic/code/addons/network-analysis/rules/network-analysis-safety.md`.
- Canonical contracts are indexed at
  `@$AIWG_ROOT/agentic/code/addons/network-analysis/schemas/network-analysis-contracts.md`.