Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →automateyournetwork/nsm-session-pivot
Pivot through Zeek session and protocol metadata from a packet capture (read-only) — connection listing, service filtering, and following a connection uid into dns/http/ssl logs.
Passed 11 of 16 test cases with the skill, and 7 of 16 without it.
and 7 more in the full report
7 fixed8 passed either way6 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
During analysis of `/captures/clean.pcap`, the tool output reports a `zeek_posture` of `VALIDATING`. What does this state indicate about packet checksum validation and dropped packets?
| Checked | Without skill | With skill |
|---|---|---|
| Explains that VALIDATING means checksum validation was active and no invalid checksum packets were flagged or dropped | Missed | Passed |
The instructions your model reads when the skill loads.
nsm-mcp (NetClaw-authored, spec 091)nsm_status, nsm_analyze, nsm_sessions, nsm_protocol_log.pcap/.pcapng file already on disk. Nothing sniffs an interface.A missing protocol log does not mean there was no such traffic.
Zeek discards packets with invalid TCP checksums by default. Measured on a reference
capture: with validation on, Zeek produced no http.log at all — the HTTP request was
invisible — and a conn.log that was also wrong, 3 rows instead of the correct 2, because
discarded packets fragment the flow. The only signal is a warning on stderr.
Captures from a NIC with checksum offloading routinely have invalid checksums, including
the ones NetClaw's own cml-packet-capture and gns3-packet-capture skills produce.
So nsm-mcp defaults ignore_checksums=true, the opposite of Zeek's own default, and
attaches zeek_posture to every response:
state | What it means |
|---|---|
IGNORING_CHECKSUMS | all packets analysed — the correct setting for offloaded captures |
PACKETS_DISCARDED | packets were dropped; protocol logs may be missing and conn.log may be wrong |
VALIDATING | validation on, nothing flagged |
If you see PACKETS_DISCARDED, re-run with ignore_checksums=true before drawing any
conclusion. Reporting "no HTTP in this capture" from a discarded run is a wrong answer that
looks like a finding.
nsm_analyze — which Zeek logs did this capture produce, and how many connections?nsm_sessions — the connection table. Note service, conn_state, byte countsuidnsm_protocol_log with log="dns" / "http" / "ssl" and that uid — every Zeek logtest cases passed, vs 7 / 16 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.