Анализ сетевого трафика с Wireshark

★ 8.4 · security

analyzing-network-traffic-with-wireshark is a Claude Code skill that captures and analyzes network packet data using Wireshark 4.0+ and the tshark command-line utility to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and support incident response investigations on authorized network segments. The skill covers a full six-step workflow: configuring capture filters with ring-buffer rotation and multi-interface capture, applying display filters to detect beaconing, lateral movement over SMB, cleartext credentials, and suspicious DNS queries, then performing protocol-level deep dives into HTTP, TLS cipher suites, and TCP streams. Artifacts and indicators of compromise are exported via `--export-objects` and hashed with sha256sum for threat intelligence matching, while statistical commands (`conv`, `endpoints`, `io,phs`) surface top talkers and port scan patterns. It is intended for security analysts and incident responders who need packet-level pcap forensics, firewall and IDS rule validation, or malware communication analysis on sandboxed hosts.