wireshark-analysis — Claude Code skill: packet analysis
A Claude skill for Wireshark work: capture and display filters, TCP/UDP stream reconstruction, protocol stats and anomaly hunting.
npx claude-code-templates@latest --skill security/wireshark-analysisWhat wireshark-analysis does
The skill kicks in when you ask to analyze network traffic, filter a PCAP, follow a TCP or UDP stream, or investigate suspicious packets. It walks through phases: live capture, display filters, stream reconstruction, statistics, and incident review.
Filters are grouped by kind — IP and port, protocol (http, dns, ssh, smb), TCP flags, packet contents, and analysis flags such as retransmissions or zero window. Combine them with &&, || and !. Statistics get their own sections: protocol hierarchy, conversations, endpoints, flow graph, and I/O graphs.
Live capture needs admin or root rights and an interface you can put in promiscuous mode. Some familiarity with TCP, UDP, HTTP and DNS helps a lot, otherwise you end up guessing at filter syntax. Offline work only needs a PCAP or PCAPNG file.
What it helps with
- filter a PCAP down to one host or port
- rebuild a conversation from a TCP stream
- spot retransmissions and zero-window stalls
- check DNS responses that returned errors
- see how protocols are distributed across a capture
Example prompts for the agent
- analyze capture.pcapng and list every DNS query that failed
- follow the TCP stream for 192.168.1.100 and look for plaintext credentials
- build a filter that finds SYN scanning from a single address
How to install wireshark-analysis
1claude-code-templates
npx claude-code-templates@latest --skill security/wireshark-analysis2Skills CLI (Vercel)
npx skills add davila7/claude-code-templates --skill wireshark-analysis -a claude-code3Manually: put the files in place
~/.claude/skills/wireshark-analysis/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/wireshark-analysis/
Manually: put the files in place
.agents/skills/wireshark-analysis/SKILL.mdFor all projects use ~/.agents/skills/
Manually: put the files in place
.cursor/skills/wireshark-analysis/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install davila7/claude-code-templates wireshark-analysis2Manually: put the files in place
.github/skills/wireshark-analysis/SKILL.mdPlatform CLI
gemini skills install https://github.com/davila7/claude-code-templates --path cli-tool/components/skills/security/wireshark-analysisManually: put the files in place
.devin/skills/wireshark-analysis/SKILL.mdThe legacy .windsurf/skills/ path still works
Claude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about wireshark-analysis
How do I install wireshark-analysis in Claude?
Use the templates installer: npx claude-code-templates@latest --skill security/wireshark-analysis. Alternatively run npx skills add davila7/claude-code-templates --skill wireshark-analysis -a claude-code. The skill file lands at ~/.claude/skills/wireshark-analysis/SKILL.md.
What does wireshark-analysis do?
It guides packet work in Wireshark: building capture and display filters, reconstructing TCP and UDP streams, reading protocol statistics, and flagging connection problems.
What do I need before using it?
Wireshark installed and a network interface you can capture on. Live capture requires admin or root privileges; offline analysis just needs a PCAP or PCAPNG file.
