- Add validated mitre_attack frontmatter to all 754 skills (286 distinct
techniques), verified against MITRE ATT&CK v19.1 via the official
mitreattack-python library: 0 revoked, deprecated, or invalid IDs
- Curate precise per-skill technique IDs for forensics, malware-analysis,
threat-intel, and red-team skills (e.g. DCSync -> T1003.006,
Kerberoasting -> T1558.003, Pass-the-Ticket -> T1550.003)
- Reconcile v19.1 tactic restructuring: Defense Evasion split into
Stealth (TA0005) and Defense Impairment (TA0112); revoked T1562.*
family and T1070.001/.002 remapped to active equivalents (T1685.*)
- Normalize word-split tags across 35 skills (remove filename-derived
stopword tags, add semantic cybersecurity tags)
- Add api-reference.md for 3 skills that were missing it
- Update README ATT&CK section with accurate v19.1 tactic distribution
Automate network traffic analysis using tshark and pyshark for protocol statistics, suspicious flow detection, DNS anomaly identification, and IOC extraction from PCAP files
cybersecurity
network-security
tshark
pyshark
pcap
packet-analysis
network-forensics
wireshark
traffic-analysis
1.0
mahipal
Apache-2.0
PR.IR-01
DE.CM-01
ID.AM-03
PR.DS-02
T1046
T1040
T1557
T1071
T1005
Performing Network Traffic Analysis with TShark
Overview
This skill automates packet capture analysis using tshark (Wireshark CLI) and pyshark (Python wrapper). It extracts protocol distribution statistics, identifies suspicious network flows (port scans, beaconing, data exfiltration), extracts IOCs (IPs, domains, URLs), and detects DNS tunneling patterns from PCAP files.
When to Use
When conducting security assessments that involve performing network traffic analysis with tshark
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Prerequisites
tshark (Wireshark CLI) installed and in PATH
Python 3.8+ with pyshark library
PCAP or PCAPNG capture file for analysis
Steps
Extract Protocol Statistics — Generate protocol hierarchy and conversation statistics from the capture
Identify Top Talkers — Rank source/destination IPs by volume and connection count
Detect Suspicious Flows — Flag port scanning patterns, unusual port usage, and high-frequency connections
Extract Network IOCs — Pull unique IPs, domains from DNS queries, and URLs from HTTP traffic
Analyze DNS Traffic — Detect DNS tunneling via high-entropy subdomain queries and excessive TXT records
Generate Analysis Report — Produce structured report with flow summaries and threat indicators
Expected Output
JSON report with protocol statistics and top talkers
mukul975
cb8d79e068