# Performing Network Traffic Analysis With Tshark

> Perform performing network traffic analysis with tshark assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.

- Skill: `wufufu770/performing-network-traffic-analysis-with-tshark` (Agent Skill)
- Install (CLI): `npx skillmds@latest add wufufu770/performing-network-traffic-analysis-with-tshark`
- Raw SKILL.md: https://api.skillmd.com/api/skills/wufufu770/performing-network-traffic-analysis-with-tshark/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: wufufu770 (https://skillmd.com/u/wufufu770)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/wufufu770/performing-network-traffic-analysis-with-tshark

---


## TL;DR

- **目的**：Automate network traffic analysis using tshark (Wireshark CLI) and pyshark to compute protocol distribution statistics, detect suspicious fl…
- **适用**：辅助/通用
- **输入**：PCAP 文件路径 + 分析维度（协议统计/IOC）
- **输出**：IOC 列表 + 行为分析
- **红线**：仅限授权范围内；扫描限速 `-c 10 -rl 10`；所有动作记 oplog
- **关联**：上游：003-src-session-start → 下游：180-performing-network-traffic-analysis-with-zeek, 173-analyzing-network-packets-with-scapy, 175-analyzing-security-logs-with-splunk

# Performing Network Traffic Analysis with TShark

## Quick Start

```bash
# 基本协议统计
tshark -r capture.pcap -q -z io,phs
# 提取 HTTP 请求
tshark -r capture.pcap -Y "http.request" -T fields -e http.host -e http.request.uri
# 提取 DNS 查询
tshark -r capture.pcap -Y "dns.qry.name" -T fields -e dns.qry.name
```

## Overview

This skill automates packet capture analysis using tshark (Wireshark CLI) and pyshark (Python wrapper). It extracts protocol distribution statistics, identifies suspicious network flows (port scans, beaconing, data exfiltration), extracts IOCs (IPs, domains, URLs), and detects DNS tunneling patterns from PCAP files.


## When to Use

- When conducting security assessments that involve performing network traffic analysis with tshark
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing

## Prerequisites

- tshark (Wireshark CLI) installed and in PATH
- Python 3.8+ with pyshark library
- PCAP or PCAPNG capture file for analysis

## Workflow
1. **Extract Protocol Statistics** — Generate protocol hierarchy and conversation statistics from the capture
2. **Identify Top Talkers** — Rank source/destination IPs by volume and connection count
3. **Detect Suspicious Flows** — Flag port scanning patterns, unusual port usage, and high-frequency connections
4. **Extract Network IOCs** — Pull unique IPs, domains from DNS queries, and URLs from HTTP traffic
5. **Analyze DNS Traffic** — Detect DNS tunneling via high-entropy subdomain queries and excessive TXT records
6. **Generate Analysis Report** — Produce structured report with flow summaries and threat indicators

## Output Format

- JSON report with protocol statistics and top talkers
- Suspicious flow detections with severity ratings
- Extracted IOCs (IPs, domains, URLs)
- DNS anomaly analysis results

## Advanced Techniques

### Extract HTTP Credentials from PCAP
```bash
# 提取 HTTP Basic Auth
tshark -r capture.pcap -Y "http.authbasic" -T fields -e http.authbasic

# 提取 HTTP POST 数据（含密码）
tshark -r capture.pcap -Y "http.request.method==POST" -T fields -e http.file_data
```

### Detect C2 Beaconing
```bash
# 计算每个目标 IP 的请求间隔（标准差）
tshark -r capture.pcap -Y "dns" -T fields -e dns.qry.name -e dns.a 2>/dev/null |   python3 -c "
import sys, statistics
from collections import defaultdict
data = defaultdict(list)
for line in sys.stdin:
    pass  # 简化逻辑
"
```

### TLS Decryption with Session Keys
```bash
# 使用 (Pre)-Master-Secret 日志解密
SSLKEYLOGFILE=/tmp/keylog.txt tshark -r capture.pcap -o "tls.keylog_file:/tmp/keylog.txt"
```