performing-network-traffic-analysis-with-tshark

name	performing-network-traffic-analysis-with-tshark
description	Use when automating network traffic analysis using tshark and pyshark for protocol statistics, suspicious flow detection, DNS anomaly identification, and IOC extraction from PCAP files
domain	cybersecurity
subdomain	network-security
tags	["tshark","pyshark","pcap","packet-analysis","network-forensics","wireshark","traffic-analysis"]
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"]

Performing Network Traffic Analysis with TShark

Overview

This skill automates packet capture analysis using tshark (Wireshark CLI) and pyshark (Python wrapper). It extracts protocol distribution statistics, identifies suspicious network flows (port scans, beaconing, data exfiltration), extracts IOCs (IPs, domains, URLs), and detects DNS tunneling patterns from PCAP files.

When to Use

Trigger phrases:

• "performing network traffic analysis with tshark"

• "Automate network traffic analysis using tshark and pyshark for protocol statisti"

• When conducting security assessments that involve performing network traffic analysis with tshark

• When following incident response procedures for related security events

• When performing scheduled security testing or auditing activities

• When validating security controls through hands-on testing

Prerequisites

• tshark (Wireshark CLI) installed and in PATH
• Python 3.8+ with pyshark library
• PCAP or PCAPNG capture file for analysis

Steps

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}

1. Extract Protocol Statistics — Generate protocol hierarchy and conversation statistics from the capture
2. Identify Top Talkers — Rank source/destination IPs by volume and connection count
3. Detect Suspicious Flows — Flag port scanning patterns, unusual port usage, and high-frequency connections
4. — Pull unique IPs, domains from DNS queries, and URLs from HTTP traffic