# wireshark-analysis

A Claude skill for Wireshark work: capture and display filters, TCP/UDP stream reconstruction, protocol stats and anomaly hunting.

- skill · `type=skill` · Claude Code · 113 installs
- Author: zebbern
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/wireshark-analysis
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/wireshark-analysis

## What it does

The skill kicks in when you ask to analyze network traffic, filter a PCAP, follow a TCP or UDP stream, or investigate suspicious packets. It walks through phases: live capture, display filters, stream reconstruction, statistics, and incident review.

Filters are grouped by kind — IP and port, protocol (http, dns, ssh, smb), TCP flags, packet contents, and analysis flags such as retransmissions or zero window. Combine them with `&&`, `||` and `!`. Statistics get their own sections: protocol hierarchy, conversations, endpoints, flow graph, and I/O graphs.

Live capture needs admin or root rights and an interface you can put in promiscuous mode. Some familiarity with TCP, UDP, HTTP and DNS helps a lot, otherwise you end up guessing at filter syntax. Offline work only needs a PCAP or PCAPNG file.

## Install

### Claude Code (native platform)

1. **claude-code-templates**
```bash
npx claude-code-templates@latest --skill security/wireshark-analysis
```

2. **Skills CLI (Vercel)**
```bash
npx skills add davila7/claude-code-templates --skill wireshark-analysis -a claude-code
```

3. **Manually: put the files in place**
- File: `~/.claude/skills/wireshark-analysis/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/wireshark-analysis/

### Codex

**Manually: put the files in place**
- File: `.agents/skills/wireshark-analysis/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

**Manually: put the files in place**
- File: `.cursor/skills/wireshark-analysis/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install davila7/claude-code-templates wireshark-analysis
```

2. **Manually: put the files in place**
- File: `.github/skills/wireshark-analysis/SKILL.md`

### Gemini CLI

**Platform CLI**
```bash
gemini skills install https://github.com/davila7/claude-code-templates --path cli-tool/components/skills/security/wireshark-analysis
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/wireshark-analysis/SKILL.md` — The legacy .windsurf/skills/ path still works

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/wireshark-analysis

## When to use it
- filter a PCAP down to one host or port
- rebuild a conversation from a TCP stream
- spot retransmissions and zero-window stalls
- check DNS responses that returned errors
- see how protocols are distributed across a capture

## Example prompts
- analyze capture.pcapng and list every DNS query that failed
- follow the TCP stream for 192.168.1.100 and look for plaintext credentials
- build a filter that finds SYN scanning from a single address

## Similar
- [traffic-analysis-pcap](https://affpapa.org/en/nevibecode/skills/traffic-analysis-pcap.md) — skill · 3700 installs
- [analyzing-network-traffic-with-wireshark](https://affpapa.org/en/nevibecode/skills/analyzing-network-traffic-with-wireshark.md) — skill · 533 installs
- [analyzing-network-traffic-of-malware](https://affpapa.org/en/nevibecode/skills/analyzing-network-traffic-of-malware.md) — skill · 413 installs
- [network-protocol-attacks](https://affpapa.org/en/nevibecode/skills/network-protocol-attacks.md) — skill · 3600 installs
- [network-watcher](https://affpapa.org/en/nevibecode/skills/network-watcher.md) — skill · 454 installs
- [ntwarden-windows-analysis-toolkit](https://affpapa.org/en/nevibecode/skills/ntwarden-windows-analysis-toolkit.md) — skill · 443 installs

From the same set: [davila7/claude-code-templates](https://affpapa.org/en/nevibecode/by/davila7/claude-code-templates.md) — 238 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md