Performing Network Traffic Analysis With Tshark

Performing Network Traffic Analysis with TShark

Overview

This skill automates packet capture analysis using tshark (Wireshark CLI) and pyshark (Python wrapper). It extracts protocol distribution statistics, identifies suspicious network flows (port scans, beaconing, data exfiltration), extracts IOCs (IPs, domains, URLs), and detects DNS tunneling patterns from PCAP files.

When to Use

Trigger phrases:

• "performing network traffic analysis with tshark"

• "Automate network traffic analysis using tshark and pyshark for protocol statisti"

• When conducting security assessments that involve performing network traffic analysis with tshark

• When following incident response procedures for related security events

• When performing scheduled security testing or auditing activities

• When validating security controls through hands-on testing

Prerequisites

• tshark (Wireshark CLI) installed and in PATH
• Python 3.8+ with pyshark library
• PCAP or PCAPNG capture file for analysis

Steps

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}

1. Extract Protocol Statistics — Generate protocol hierarchy and conversation statistics from the capture
2. Identify Top Talkers — Rank source/destination IPs by volume and connection count
3. Detect Suspicious Flows — Flag port scanning patterns, unusual port usage, and high-frequency connections
4. Extract Network IOCs — Pull unique IPs, domains from DNS queries, and URLs from HTTP traffic
5. Analyze DNS Traffic — Detect DNS tunneling via high-entropy subdomain queries and excessive TXT records
6. Generate Analysis Report — Produce structured report with flow summaries and threat indicators

Expected Output

• JSON report with protocol statistics and top talkers
• Suspicious flow detections with severity ratings
• Extracted IOCs (IPs, domains, URLs)
• DNS anomaly analysis results

When NOT to Use

• You don't have explicit written authorization to test
• Task is about defense/detection, not offense (use detection skills)
• You need to implement security controls (use implementing-* skills)
• Task requires compliance auditing (use auditing-* skills)
• You're investigating an incident (use incident response skills)
• Target is out of scope for your engagement
• Task is about vulnerability scanning only (use scanning tools)

Red Flags

• Performing actions without explicit written authorization from the asset owner
• Testing against production systems without a defined scope and rules of engagement
• Capturing traffic on networks without authorization or privacy considerations
• Leaving packet captures containing sensitive data unencrypted on disk
• Deploying inline blocking rules without testing for false positives first

Process

1. Design — Define interface, identify patterns, plan implementation
2. Implement — Write code following existing conventions, add tests
3. Verify — Run tests, check integration, validate behavior

Verification

• All steps executed successfully against a test environment before production use
• Output documented with screenshots or logs demonstrating expected behavior
• Captures verified as complete with no dropped packets
• Detection rules tested against known-benign traffic for false positive rate
• Alert thresholds validated and tuned to reduce noise

Anti-Rationalization Table