analysis-tshark

name	analysis-tshark
description	Network protocol analyzer and packet capture tool for traffic analysis, security investigations, and forensic examination using Wireshark's command-line interface. Use when: (1) Analyzing network traffic for security incidents and malware detection, (2) Capturing and filtering packets for forensic analysis, (3) Extracting credentials and sensitive data from network captures, (4) Investigating network anomalies and attack patterns, (5) Validating encryption and security controls, (6) Performing protocol analysis for vulnerability research.
version	0.1.0
maintainer	[e-mail]
category	offsec
tags	["packet-capture","network-analysis","forensics","tshark","wireshark","traffic-analysis"]
frameworks	["MITRE-ATT&CK","NIST"]
dependencies	{"packages":["tshark","wireshark"],"tools":["tcpdump","python3"]}
references	["https://www.wireshark.org/docs/man-pages/tshark.html","https://wiki.wireshark.org/DisplayFilters","https://attack.mitre.org/techniques/T1040/"]

TShark Network Protocol Analyzer

Overview

TShark is the command-line network protocol analyzer from the Wireshark project. It provides powerful packet capture and analysis capabilities for security investigations, forensic analysis, and network troubleshooting. This skill covers authorized security operations including traffic analysis, credential extraction, malware detection, and forensic examination.

IMPORTANT: Network packet capture may expose sensitive information and must only be conducted with proper authorization. Ensure legal compliance and privacy considerations before capturing network traffic.

Quick Start

Basic packet capture and analysis:

# Capture packets on interface
sudo tshark -i eth0

# Capture 100 packets and save to file
sudo tshark -i eth0 -c 100 -w capture.pcap

# Read and analyze capture file
tshark -r capture.pcap

# Apply display filter
tshark -r capture.pcap -Y "http.request.method == GET"

# Extract HTTP objects
tshark -r capture.pcap --export-objects http,extracted_files/

Core Workflow

Network Analysis Workflow

Progress: [ ] 1. Verify authorization for packet capture [ ] 2. Identify target interface and capture requirements [ ] 3. Capture network traffic with appropriate filters [ ] 4. Analyze captured packets for security indicators [ ] 5. Extract artifacts (files, credentials, sessions) [ ] 6. Document findings and security implications [ ] 7. Securely handle and store capture files [ ] 8. Clean up sensitive data per retention policy

Work through each step systematically. Check off completed items.

1. Authorization Verification

CRITICAL: Before any packet capture:

• Confirm written authorization for network monitoring
• Verify legal compliance (wiretapping laws, privacy regulations)
• Understand data handling and retention requirements
• Document scope of capture (interfaces, duration, filters)
• Ensure secure storage for captured data

2. Interface Discovery

Identify available network interfaces:

# List all interfaces
tshark -D

# List with interface details
sudo tshark -D

# Capture on specific interface
 tshark -i eth0
 tshark -i wlan0


 tshark -i any


 tshark -i eth0 -i wlan0