Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Performing Network Traffic Analysis with TShark · mukul975 | DecimalAI

Performing Network Traffic Analysis With Tshark

SkillScore45Maintained

performing-network-traffic-analysis-with-tshark

Automate network traffic analysis using tshark and pyshark for protocol statistics, suspicious flow detection, DNS anomaly identification, and IOC extraction from PCAP files

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/performing-network-traffic-analysis-with-tshark/SKILL.md

decimalai skills pull performing-network-traffic-analysis-with-tshark --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/performing-network-traffic-analysis-with-tshark/SKILL.md https://app.decimal.ai/s/performing-network-traffic-analysis-with-tshark/SKILL.md

Raw file: /s/performing-network-traffic-analysis-with-tshark/SKILL.md ↗ · machine-readable summary at /s/performing-network-traffic-analysis-with-tshark.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

—+26% tokens0% turns45% of whole cases pass with skill (10/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-03	✗→✓	▲ Improved	—	—
case-15	✗→✓	▲ Improved	—	—
case-18	✗→✓	▲ Improved	—	—
case-16	✗→✓	▲ Improved	—	—
case-02	✗→✓	▲ Improved	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/performing-network-traffic-analysis-with-tshark/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Performing Network Traffic Analysis with TShark

Overview

This skill automates packet capture analysis using tshark (Wireshark CLI) and pyshark (Python wrapper). It extracts protocol distribution statistics, identifies suspicious network flows (port scans, beaconing, data exfiltration), extracts IOCs (IPs, domains, URLs), and detects DNS tunneling patterns from PCAP files.

When to Use

When conducting security assessments that involve performing network traffic analysis with tshark
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

tshark (Wireshark CLI) installed and in PATH
Python 3.8+ with pyshark library
PCAP or PCAPNG capture file for analysis

Steps

Extract Protocol Statistics — Generate protocol hierarchy and conversation statistics from the capture
Identify Top Talkers — Rank source/destination IPs by volume and connection count
Detect Suspicious Flows — Flag port scanning patterns, unusual port usage, and high-frequency connections
Extract Network IOCs — Pull unique IPs, domains from DNS queries, and URLs from HTTP traffic
Analyze DNS Traffic — Detect DNS tunneling via high-entropy subdomain queries and excessive TXT records
Generate Analysis Report — Produce structured report with flow summaries and threat indicators

Expected Output

JSON report with protocol statistics and top talkers
Suspicious flow detections with severity ratings
Extracted IOCs (IPs, domains, URLs)
DNS anomaly analysis results

Illustrative Want to see what performing-network-traffic-analysis-with-tshark would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/29/2026, 11:18 UTC · 22 cases

Measured on 20 comparable cases — below the 22 needed to publish a lift, so this result is shown here but not on the registry card or leaderboard.

Lift

+27%

45% vs 18%

Agent turns

1.0 vs 1.0

Tokens

+26%

3,261.15 vs 2,586.1

fail → pass · 6pass → pass · 4fail → fail · 12

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-09 Look for any beaconing or repeated connection attempts in the PCAP. Write a detection script that outputs these events.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 Write a script to identify the most active hosts in this PCAPNG file. Output the most active endpoints.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 Analyze this packet capture script for any scanning activity or weird port usage. Return a list of flagged activities.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 Give me a script that lists all the endpoints involved in this capture file.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 We have a proprietary protocol running on TCP port 9999. How do I write a Lua script to parse this in Wireshark? Provide an example script.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 Get the protocol hierarchy from this capture file. Provide the command or script.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We are doing a routine audit on our internal network and captured some traffic in a PCAPNG file. Run an analysis to pull out the conversation statistics and rank the highest volume communicators. I need the final output as a JSON document containing those stats, a list of all unique indicators of compromise, and any detected malicious network behaviors rated by their severity. Don't forget to look for tunneling in the DNS requests.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 I have a network trace file and need a script to get the overall breakdown of protocols used and the communication metrics between hosts. Output a summary of these metrics.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-15 Write a script that lists the suspicious flows found in the network traffic and outputs them.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-11 I need to summarize the traffic in this capture file to see what kinds of communication are happening. Provide a script to output the summary.	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-18 Automate the analysis of this PCAPNG file to find threats. Provide the full script.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-08 Generate a final summary script for the packet capture analysis that outputs the results programmatically.	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-20 I have a PCAP file with TLS traffic and the corresponding RSA private key. How do I decrypt the traffic to see the plaintext HTTP? Provide the steps.	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-04 We need to find out which machines are generating the most traffic in our network capture. Write a script to rank the addresses and output the list.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 How do I start a live packet capture on eth0 and save it to a file, filtering only for port 80? Provide the command.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 Extract all the web links visited from this unencrypted network capture. Provide a Python script to do this.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-12 Provide a script that analyzes name resolution traffic in the network trace to detect potential DNS tunneling based on query size.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 Can you process this new capture file to validate our firewall controls? I need you to parse the traffic to find any weird connection patterns or potential data exfiltration. Provide the results in a JSON report that lists the top talkers, breaks down the protocol usage, lists out all the web addresses and IPs found, and highlights any DNS anomalies or suspicious network flows along with their assigned threat levels.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-06 Parse this network trace and pull out all the indicators we can use for threat intel matching. Return a structured list of these indicators.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 Check this capture for data exfiltration over name resolution protocols. Provide a script that flags these specific anomalies.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-13 Create a structured summary script of the network analysis that outputs the findings, specifically extracting the web client strings to identify anomalous user agents.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 Find all the queried domains in this PCAP file. Provide a script to automate this extraction.	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted, and 20 counted toward the lift figure. The other 2 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +27 percentage points is the difference between those two pass rates over the 20 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 18.2%
Pass rate with the skill: 45.5%
Cases attempted: 22
Cases counted toward lift: 20
Cases that regressed: 1
Skill version measured: v1
Run completed: 7/29/2026, 11:18 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run45

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+18% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.