traffic-analysis-pcaplisted

# SKILL: Traffic Analysis & PCAP — Expert Analysis Playbook > **AI LOAD INSTRUCTION**: Expert traffic analysis and PCAP forensics techniques. Covers PCAP repair, Wireshark essential filters, protocol-specific analysis (HTTP, HTTPS/TLS, DNS, FTP, SMTP, USB HID, WiFi, ICMP), data extraction (file carving, credential harvesting, covert channels), NetworkMiner, and tshark CLI analysis. Base models miss USB keyboard decode patterns, DNS tunneling detection heuristics, and TLS decryption workflows. ## 0. RELATED ROUTING Before going deep, consider loading: - [memory-forensics-volatility](../memory-forensics-volatility/SKILL.md) for correlating memory artifacts with network traffic - [steganography-techniques](../steganography-techniques/SKILL.md) for analyzing files extracted from traffic captures - [network-protocol-attacks](../network-protocol-attacks/SKILL.md) for understanding attack patterns visible in captures - [reverse-shell-techniques](../reverse-shell-techniques/SKILL.md) for identifying shell traffic in captures --- ## 1. PCAP REPAIR ```bash pcapfix corrupted.pcap -o fixed.pcap # repair corrupted PCAP # Magic bytes: d4c3b2a1=pcap(LE), a1b2c3d4=pcap(BE), 0a0d0d0a=pcapng editcap -F pcap capture.pcapng capture.pcap # convert pcapng→pcap mergecap -w merged.pcap file1.pcap file2.pcap # merge captures ``` --- ## 2. WIRESHARK ESSENTIAL FILTERS ### IP / Host Filters ``` ip.addr == 10.0.0.1 # source or destination ip.src == 10.0.0.1