Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Implementing Network Traffic Analysis with Arkime · mukul975 | DecimalAI

Implementing Network Traffic Analysis With Arkime

SkillScore43Maintained

implementing-network-traffic-analysis-with-arkime

Deploy and query Arkime (formerly Moloch) for full packet capture network traffic analysis. Uses the Arkime API v3 to search sessions, download PCAPs, analyze connection patterns, detect beaconing behavior, and identify suspicious network flows. Monitors DNS queries, HTTP traffic, and TLS certificate anomalies across captured traffic.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/implementing-network-traffic-analysis-with-arkime/SKILL.md

decimalai skills pull implementing-network-traffic-analysis-with-arkime --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/implementing-network-traffic-analysis-with-arkime/SKILL.md https://app.decimal.ai/s/implementing-network-traffic-analysis-with-arkime/SKILL.md

Raw file: /s/implementing-network-traffic-analysis-with-arkime/SKILL.md ↗ · machine-readable summary at /s/implementing-network-traffic-analysis-with-arkime.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 56d ago

Yes — +35% lift-12% tokens0% turns43% of whole cases pass with skill (10/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-08	✗→✓	▲ Improved	—	—
case-07	✗→✓	▲ Improved	—	—
case-01	✗→✓	▲ Improved	—	—
case-14	✗→✓	▲ Improved	—	—
case-16	✗→✓	▲ Improved	—	—

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/implementing-network-traffic-analysis-with-arkime/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Implementing Network Traffic Analysis with Arkime

When to Use

When deploying or configuring implementing network traffic analysis with arkime capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Familiarity with network security concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Install dependencies: pip install requests
Configure Arkime viewer URL and credentials.
Run the agent to query Arkime sessions and analyze traffic:

Search sessions by IP, port, protocol, or expression
Download PCAP data for forensic analysis
Detect C2 beaconing via connection interval analysis
Identify DNS tunneling through query length statistics
Flag connections to known-bad TLS certificate issuers

bash
python scripts/agent.py --arkime-url https://arkime.local:8005 --user admin --password secret --output arkime_report.json

Examples

Beaconing Detection

Source: 10.1.2.50 -> 185.220.101.34:443
Sessions: 288 over 24 hours
Avg interval: 300s, Jitter: 4.2%
Verdict: HIGH confidence C2 beaconing (jitter < 5%)

Illustrative Want to see what implementing-network-traffic-analysis-with-arkime would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 09:32 UTC · 23 cases

Lift

+35%

43% vs 9%

Agent turns

1.0 vs 1.0

Tokens

-12%

1,773.7 vs 2,017.43

fail → pass · 8pass → pass · 2fail → fail · 13

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-09 What minimum Python runtime version is required to run the Arkime traffic analysis agent?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-08 I want to run the standard Arkime analysis agent against viewer endpoint `https://10.0.1.50:8005` using administrative credentials `secops` / `P@ssword123` and store output to `results.json`. Show me the exact terminal command.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-07 During an automated inspection of HTTPS sessions in Arkime, what specific TLS header feature should be flagged to catch suspicious encrypted outbound sessions?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-06 When analyzing DNS query metadata extracted from Arkime session records to uncover covert communication channels, which specific query metric should be evaluated to flag potential DNS tunneling?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 I need to run a network forensic audit against our Arkime instance to detect potential command-and-control beaconing and DNS tunneling. Please execute the python-based Arkime analysis script using our cluster credentials and save the resulting analysis summary to a JSON file.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-14 What environment access and authorization prerequisites are required before executing Arkime session queries and PCAP downloads?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-15 When reviewing periodic network traffic in Arkime to distinguish automated beaconing from human web browsing, what two interval-related mathematical metrics must be computed?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 If an internal endpoint connects to an external host with a certificate issued by an untrusted or blacklisted certificate authority, how does the Arkime agent categorize this event?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 In what format does the Arkime traffic analysis agent export its final security assessment findings?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 How do we set up an Index Lifecycle Management (ILM) policy in OpenSearch to automatically snapshot and delete Arkime session indices older than 90 days?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 Where is the Arkime analysis CLI tool located within the repository structure?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-21 Write a custom Suricata rule to alert on HTTP POST requests containing suspicious base64 payloads in the User-Agent header targeting port 8080.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 Can the Arkime traffic analysis agent extract raw packet capture files directly during a forensic investigation, or does it only inspect JSON metadata?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 If an outbound persistent connection has a fixed timing interval with a calculated jitter of 8.5%, does it meet the strict criteria for high confidence C2 beaconing according to standard Arkime analysis heuristics?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-02 Can you analyze recent network sessions in our local Arkime deployment for suspicious traffic patterns, such as regular connection intervals or abnormal TLS certificate issuers? Run the analysis tool against our viewer instance and produce a detailed report file containing the findings.	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-03 We are conducting a security assessment and need to inspect packet captures and session metadata from Arkime to check for potential data exfiltration via DNS queries. Please run the automated Arkime agent script to evaluate session statistics and output the structured JSON report.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-04 Before running our network session analysis scripts against our Arkime viewer API, what Python packages need to be installed? I am setting up a fresh virtual environment.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 We are calculating connection interval statistics for a suspect internal host communicating with an external IP over port 443. We observed 288 sessions over 24 hours with a 300-second average interval and 4.2% jitter. How should this session behavior be classified in terms of threat confidence?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-11 What session query parameters does the Arkime agent support when filtering network traffic for investigation?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 When connecting the Python agent script to a standard local Arkime viewer service, what default port is typically configured in example invocation commands?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 We need to filter Arkime sessions for HTTP POST requests sent to non-standard ports. Does the traffic analysis agent support custom Arkime search expressions?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 We need to configure the `arkime-capture` daemon on Linux to listen on interface `eth1` and set `bpf` filtering rules. How do we structure the `/opt/arkime/etc/config.ini` file for capture node packet acquisition?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-23 We have a standalone raw `.pcap` file on disk. How can we use `tshark` on the command line to extract all HTTP GET request URIs without importing it into Arkime?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +35 percentage points is the difference between those two pass rates over the 23 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 8.7%
Pass rate with the skill: 43.5%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 09:32 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run43

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+7% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.