# Network Sniffing Packet Capture

> Use when sniffing networks and analyzing packet captures.

- Skill: `loopyluci/network-sniffing-packet-capture` (Agent Skill)
- Install (CLI): `npx skillmds@latest add loopyluci/network-sniffing-packet-capture`
- Raw SKILL.md: https://api.skillmd.com/api/skills/loopyluci/network-sniffing-packet-capture/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: LoopyLuci (https://skillmd.com/u/loopyluci)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/loopyluci/network-sniffing-packet-capture

---


# Network Sniffing and Packet Capture

Sniffing networks and analyzing packet captures — from tcpdump and Wireshark through ARP spoofing, protocol analysis, and traffic decryption.

## When to Use

- Capturing and analyzing network traffic during pentests
- Debugging network protocols and applications
- Analyzing malware network behavior
- Performing man-in-the-middle testing
- Extracting data from pcap files

## Sniffing Techniques

```python
# tcpdump basics
TCPDUMP_CAPTURES = {
    'capture_interface': "tcpdump -i eth0 -w capture.pcap",
    'capture_specific_host': "tcpdump host 10.0.0.5 -w host_traffic.pcap",
    'capture_http': "tcpdump port 80 or port 443 -w web_traffic.pcap",
    'filter_by_proto': "tcpdump 'tcp[tcpflags] & tcp-syn != 0' -w syns.pcap",
}

# Wireshark display filters
WIRESHARK_FILTERS = {
    'http_requests': "http.request",
    'tls_handshakes': "tls.handshake.type == 1",
    'dns_queries': "dns.flags.response == 0",
    'specific_ip': "ip.addr == 10.0.0.1",
    'credentials': "http.request.method == POST || ftp.request.command == USER",
    'follow_stream': "Right-click → Follow → TCP/UDP/HTTP Stream",
}

# Simple ARP spoofing for MITM (educational purposes)
def arp_spoof_demo(target_ip: str, gateway_ip: str, interface: str = 'eth0'):
    """
    Demonstration: ARP cache poisoning for network testing.
    Actual implementation requires scapy and proper authorization.
    """
    pass
```

## Verification Checklist

- [ ] Proper authorization obtained before sniffing
- [ ] Interface in promiscuous mode (if needed)
- [ ] Capture filters applied to reduce file size
- [ ] Wireshark display filters used for analysis
- [ ] TLS traffic decrypted (if keys available)
- [ ] Extracted artifacts (files, credentials, sessions)
- [ ] Network captures stored securely and destroyed post-engagement
- [ ] Legal/compliance reviewed (wiretap laws, ToS)