SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillspacket-capture-analysis

packet-capture-analysis

Security & auditing

View repository

Updated 10-15 16:47

About this skill

Packet Capture Analysis

A skill for reading pcap / pcapng and progressing through grasping the overall picture, labeling IPs with meaning, PNG visualization, and Markdown reporting.

When To Use

  • pcap や pcapng When you are given and first want to understand what is happening
  • When you want to quickly grasp the major communication destinations, major conversations, and protocol composition
  • When you want to attach evidence-backed labels to IPs using DNS, HTTP Host, TLS SNI, and RDAP
  • When you want to create PNG graphs and Markdown reports as well
  • When there is a lot of encrypted communication and you want to explain based on behavioral characteristics rather than payload
  • When you want to use it for both security investigation and operational investigation

Core Principles

  • First, check the capture quality. If there are problems with the snaplen, time series, count, or duration, lower the strength of your conclusions.
  • The first 3 steps are fixed。Protocol Hierarchy → Endpoints → Conversations to build the overall picture.
  • Do not list IPs raw。HTTP Host -> DNS 応答 -> TLS SNI / gQUIC SNI -> RDAP -> reverse DNS in that order.
  • Do not mix evidence sources。hostname と organization as a different kind of evidence should be kept separate.
  • Expert Information is an entry point, not a conclusion. Re-examine the surrounding conversation volume, direction, retransmissions, and reassembly.
  • Explain encrypted communication by behavioral characteristics, not payload. Describe it in terms of destination, direction, volume, time period, and duration.
  • Primary aggregation with CLI, derived aggregation with Python。capinfos / tshark and then pass it to scapy / matplotlib .

Default Workflow

  1. Fix the investigation purpose

    • Decide first what you want to know.
    • Examples: the destination of large-volume communication, suspicious outbound transmissions, specific application communication, reporting.

  2. Check the capture quality

    • Check the duration, count, average rate, time series, snaplen, andpcapng name resolution information.
    • If there are quality problems, downgrade subsequent conclusions to "more of a trend assessment."

  3. Build the overall picture

    • Protocol Hierarchy / Endpoints / Conversations to build a baseline.
    • Here, do not go too deep into details; focus on dominant protocols, major communication destinations, and major conversations.

  4. Label the major communication destinations with meaning

    • Label them in order starting from the top N communication destinations.
    • Avoid querying all of them at once; investigate only the candidates for the report.
    • Leave things with weak evidence as Unknown .

  5. Organize behavioral characteristics and anomaly candidates

    • If HTTP is visible, look at path / host / direction / response volume.
    • If only TLS / QUIC is visible, explain in terms of destination, volume, time period, and duration.
    • Organize anomaly candidates with 確認できたこと / 要再確認 / 未解決 .

  6. Perform visualization and reporting

    • At minimum, produce one time-series chart and one ranking chart.
    • Write the target period, aggregation unit, filter conditions, and top N criteria on the graphs.
    • The report is organized in the order: summary → main tables/graphs → findings → unresolved points.

Tool Choice

Situations where CLI is preferred

  • Initial triage
  • Primary aggregation of large captures
  • Protocol Hierarchy / Endpoints / Conversations
  • Extraction of DNS / HTTP / TLS information

Situations where Python is preferred

  • Secondary processing of CLI results
  • Custom ranking and labeling
  • PNG generation
  • Markdown report generation

How to choose a plotting method

  • If you want to complete it within Python, matplotlib
  • If you want to plot with a lightweight CLI, gnuplot

Minimum Outputs

  • Short summary
  • Top communication destination table
  • Top conversation table
  • IP labels with evidence
  • At least 2 PNGs
    • 1 time-series graph
    • 1 ranking graph
  • 確認できたこと / 要再確認 / 未解決 organization

Anti-Patterns

  • Confirming a failure based only on Expert Information
  • Indiscriminately querying external services for all IPs
  • Equating owner information with service names
  • Forcing an explanation of encrypted traffic based on payload
  • Not writing the time period, aggregation unit, and filter conditions on graphs
  • Reading an entire large capture into Python from the start

Completion Checks

  • Capture quality checks are complete
  • The main protocols, main communication destinations, and main conversations can be explained
  • Labels with evidence are attached to the top IPs or top conversations
  • There is at least 1 time-series PNG and 1 ranking PNG
  • Anomaly candidates are 確認できたこと / 要再確認 / 未解決 organized into
  • The report states the graph conditions and labeling policy
  • Even for encrypted traffic, an explanation based on behavioral characteristics is provided

References