Skills analysis-tshark
📦

analysis-tshark

v0.1.0 Content revision r2 Critical ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables⚡ Contains scripts

Analyze Network Traffic with TShark

Packet captures are difficult to inspect quickly and consistently. This skill provides TShark workflows for filtering traffic, extracting evidence, and reporting findings.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "analysis-tshark" from https://skillstore.io/skills/agentsecops-analysis-tshark.md and its manifest at https://skillstore.io/api/skills/agentsecops-analysis-tshark/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/agentsecops-analysis-tshark.md Signed manifest GET /api/skills/agentsecops-analysis-tshark/manifest Signed lockfile GET /api/skills/agentsecops-analysis-tshark/lockfile

Test it

Using "analysis-tshark". Summarize the main traffic in incident.pcap.

Expected outcome:

  • Primary protocols: DNS, TLS, HTTP, and SMB.
  • Most active endpoint pair: workstation to application server.
  • Notable event: repeated DNS queries at regular intervals require investigation.

Using "analysis-tshark". Find large HTTP uploads and explain the evidence.

Expected outcome:

Three POST requests exceed the selected threshold. The report lists timestamps, source and destination hosts, content lengths, and validation caveats.

Using "analysis-tshark". Create a forensic review plan for a wireless capture.

Expected outcome:

The plan covers authorization, SSID and client inventory, deauthentication checks, handshake review, evidence hashing, access controls, and secure deletion.

Security Audit

Critical
v9 • 7/23/2026 Open versioned report

Most static alerts are false positives caused by Markdown formatting, defensive examples, offline packet filters, and framework terminology. Confirmed risks include remote pipe-to-shell installation, mutable third-party token exposure, privileged packet capture, and TLS key handling. Credential extraction and packet-metadata email alerts add sensitive-data exposure.

6
Files scanned
2,168
Lines analyzed
32
Review items
0
False positives ignored

Confirmed security concerns (5)

Critical
assets/ci-config-template.yml:240
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The CI template downloads a script from a mutable upstream branch and pipes it directly to bash. A compromised repository or changed script would gain code execution in the CI runner.
High
SKILL.md:608
Certificate/key files
tshark -r capture.pcap -o tls.keylog_file:sslkeys.log -Y "http"
The command consumes a TLS key-log file to decrypt captured traffic. Key-log files contain session secrets and require strict access, retention, and deletion controls.
High
SKILL.md:611
Certificate/key files
tshark -r capture.pcap -o tls.keys_list:192.168.1.100,443,http,/path/to/server.key
The command directs TShark to read a server private-key file for traffic decryption. Private-key access is highly sensitive and can expose protected sessions if mishandled.
High
SKILL.md:275-320SKILL.md:473-487
Credential and Authentication Artifact Extraction
The guide instructs users to extract plaintext credentials, NTLM responses, HTTP POST bodies, and authentication data from captures. These dual-use workflows can expose reusable secrets and personal data if authorization or storage controls fail.
The cited sections explicitly provide commands for credential extraction and writing POST data or NTLM responses to local files.
Medium
SKILL.md:550-555
Packet Metadata Disclosure Through Email Alerts
The monitoring example emails packet-derived source, destination, host, and DNS data to a configured mailbox. This can disclose monitored network metadata through an external mail path.
The script pipes each TShark alert line into the mail command, and the selected fields include internal addresses, HTTP hosts, and DNS names.
Capability review items (32)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
assets/ci-config-template.yml:240
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
This URL retrieves executable installation code from a mutable upstream branch. The network dependency directly supports the unsafe pipe-to-shell command on the same line.
High
assets/ci-config-template.yml:164
Git platform tokens
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
The workflow exposes GITHUB_TOKEN to a third-party action referenced by a mutable version tag. Compromise of that action could disclose or misuse the job token within its granted permissions.
High
SKILL.md:38
sudo privilege escalation
sudo tshark -i eth0
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:41
sudo privilege escalation
sudo tshark -i eth0 -c 100 -w capture.pcap
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:87
sudo privilege escalation
sudo tshark -D
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:90
sudo privilege escalation
sudo tshark -i eth0
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:91
sudo privilege escalation
sudo tshark -i wlan0
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:94
sudo privilege escalation
sudo tshark -i any
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:97
sudo privilege escalation
sudo tshark -i eth0 -i wlan0
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:113
sudo privilege escalation
sudo tshark -i eth0
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:116
sudo privilege escalation
sudo tshark -i eth0 -c 1000
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:119
sudo privilege escalation
sudo tshark -i eth0 -a duration:60
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:122
sudo privilege escalation
sudo tshark -i eth0 -w capture.pcap
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:125
sudo privilege escalation
sudo tshark -i eth0 -w capture.pcap -b filesize:100000 -b files:5
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:141
sudo privilege escalation
sudo tshark -i eth0 -f "tcp port 80"
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:144
sudo privilege escalation
sudo tshark -i eth0 -f "host 192.168.1.100"
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:147
sudo privilege escalation
sudo tshark -i eth0 -f "net 192.168.1.0/24"
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:150
sudo privilege escalation
sudo tshark -i eth0 -f "tcp port 80 or tcp port 443"
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:153
sudo privilege escalation
sudo tshark -i eth0 -f "not port 22"
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:156
sudo privilege escalation
sudo tshark -i eth0 -f "tcp[tcpflags] & tcp-syn != 0"
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:441
sudo privilege escalation
sudo tshark -i eth0 -w incident_$(date +%Y%m%d_%H%M%S).pcap -a duration:300
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:458
sudo privilege escalation
sudo tshark -i eth0 -w malware_traffic.pcap
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:477
sudo privilege escalation
sudo tshark -i eth0 -Y "(http.authorization or ftp or pop or imap) and not tls" -T fields -e ip.src
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:509
sudo privilege escalation
sudo tshark -i mon0 -w wireless_capture.pcap
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:550
sudo privilege escalation
sudo tshark -i $INTERFACE -Y "$ALERT_FILTER" -T fields -e frame.time -e ip.src -e ip.dst -e http.hos
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:565
sudo privilege escalation
sudo tshark -i eth0
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:568
sudo privilege escalation
sudo usermod -a -G wireshark $USER
This command uses sudo to persistently add the current user to the wireshark group. That expands packet-capture access beyond the current session and requires explicit administrator approval.
High
SKILL.md:569
sudo privilege escalation
sudo setcap cap_net_raw,cap_net_admin+eip /usr/bin/tshark
This command uses sudo to grant TShark raw-network and network-administration capabilities. Those persistent capabilities permit sensitive packet capture without future sudo prompts.
High
SKILL.md:582
sudo privilege escalation
sudo tshark -D
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:594
sudo privilege escalation
sudo tshark -i eth0 -f "not port 22" -w capture.pcap
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:597
sudo privilege escalation
sudo tshark -i eth0 -w capture.pcap -b filesize:100000 -b files:5
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.
High
SKILL.md:600
sudo privilege escalation
sudo tshark -i eth0 -s 128 -w capture.pcap
This example runs TShark through sudo, granting privileged packet-capture access to network traffic. The authorization warnings reduce misuse but do not remove the privilege and privacy risk.

Risk Factors

⚙️ External commands (50)
assets/ci-config-template.yml:298 assets/ci-config-template.yml:301 assets/ci-config-template.yml:304 assets/ci-config-template.yml:307 assets/ci-config-template.yml:310 assets/ci-config-template.yml:134 assets/ci-config-template.yml:250 assets/ci-config-template.yml:291 SKILL.md:36-51 SKILL.md:51-82 SKILL.md:82-98 SKILL.md:98-111 SKILL.md:111-126 SKILL.md:126-129 SKILL.md:129-130 SKILL.md:130-131 SKILL.md:131-132 SKILL.md:132-133 SKILL.md:133-139 SKILL.md:139-157 SKILL.md:157-160 SKILL.md:160-161 SKILL.md:161-162 SKILL.md:162-163 SKILL.md:163-164 SKILL.md:164-165 SKILL.md:165-171 SKILL.md:171-189 SKILL.md:189-193 SKILL.md:193-208 SKILL.md:208-216 SKILL.md:216-228 SKILL.md:228-232 SKILL.md:232-244 SKILL.md:244-248 SKILL.md:248-260 SKILL.md:260-264 SKILL.md:264-273 SKILL.md:273-281 SKILL.md:281-287 SKILL.md:287-291 SKILL.md:291-297 SKILL.md:297-301 SKILL.md:301-307 SKILL.md:307-311 SKILL.md:311-320 SKILL.md:320-326 SKILL.md:326-338 SKILL.md:338-342 SKILL.md:342-348
🌐 Network access (37)
assets/ci-config-template.yml:240 assets/rule-template.yaml:43 assets/rule-template.yaml:44 assets/rule-template.yaml:45 assets/rule-template.yaml:73 assets/rule-template.yaml:118 assets/rule-template.yaml:119 assets/rule-template.yaml:151 assets/rule-template.yaml:191 assets/rule-template.yaml:192 assets/rule-template.yaml:193 assets/rule-template.yaml:217 assets/rule-template.yaml:260 assets/rule-template.yaml:261 assets/rule-template.yaml:288 SKILL.md:47 SKILL.md:173 SKILL.md:195 SKILL.md:218 SKILL.md:365 SKILL.md:470 SKILL.md:480 SKILL.md:483 SKILL.md:535 SKILL.md:19 SKILL.md:20 SKILL.md:21 SKILL.md:634 SKILL.md:635 SKILL.md:636 SKILL.md:637 SKILL.md:638 SKILL.md:144 SKILL.md:147 SKILL.md:611 SKILL.md:312 SKILL.md:313
📁 Filesystem access (2)
assets/ci-config-template.yml:323 assets/ci-config-template.yml:323
🔑 Env variables (23)
assets/ci-config-template.yml:164 assets/rule-template.yaml:148 assets/rule-template.yaml:148 assets/rule-template.yaml:147 assets/rule-template.yaml:162 assets/rule-template.yaml:132 assets/rule-template.yaml:147 assets/rule-template.yaml:148 assets/rule-template.yaml:156 assets/rule-template.yaml:157 assets/rule-template.yaml:162 assets/rule-template.yaml:163 assets/rule-template.yaml:164 assets/rule-template.yaml:165 references/EXAMPLE.md:423 references/EXAMPLE.md:423 references/EXAMPLE.md:424 references/EXAMPLE.md:425 references/EXAMPLE.md:427 references/EXAMPLE.md:430 references/EXAMPLE.md:432 references/EXAMPLE.md:437 references/EXAMPLE.md:444
⚡ Contains scripts (2)
references/EXAMPLE.md:138 references/EXAMPLE.md:137

Detected Patterns

Pipe to shell pattern
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/agentsecops-analysis-tshark/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/agentsecops-analysis-tshark/security.svg)](https://skillstore.io/skills/agentsecops-analysis-tshark?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/agentsecops-analysis-tshark?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentsecops-analysis-tshark/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/agentsecops-analysis-tshark.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

AgentSecOps. (2026). analysis-tshark security audit report (audit version 9) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/agentsecops-analysis-tshark/audits/9

BibTeX citation

@techreport{agentsecops-agentsecops-analysis-tshark-2026, author = {AgentSecOps}, title = {analysis-tshark security audit report (audit version 9)}, institution = {Skillstore}, year = {2026}, number = {9}, url = {https://skillstore.io/skills/agentsecops-analysis-tshark/audits/9}, note = {Author version 0.1.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "analysis-tshark security audit report (audit version 9)" version: "0.1.0" type: report authors: - name: "AgentSecOps" date-released: "2026-07-23" url: "https://skillstore.io/skills/agentsecops-analysis-tshark/audits/9" identifiers: - type: other value: "skillstore:agentsecops-analysis-tshark:audit:9" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
100
Maintainability
87
Content
72
Community
87
Spec Compliance

What You Can Build

Triage an Incident Capture

Filter a PCAP for suspicious hosts, protocols, failed connections, beaconing, and transferable incident indicators.

Investigate Protocol Behavior

Inspect DNS, HTTP, TLS, SMB, and authentication fields to diagnose application or network problems.

Preserve Forensic Evidence

Build a traffic timeline, extract authorized artifacts, document scope, and maintain defensible evidence handling.

Try These Prompts

Summarize a PCAP 
Analyze [capture path] with TShark. Summarize protocols, endpoints, conversations, errors, and notable traffic without extracting sensitive payloads.
Build a Display Filter 
Create and explain a TShark display filter for [protocol or behavior] in [capture path]. Show expected fields and interpretation limits.
Triage Suspicious Traffic 
Triage [capture path] for [incident indicators]. Correlate timestamps, hosts, DNS, HTTP, TLS, and connection patterns. Return prioritized findings with evidence.
Design an Authorized Capture Workflow 
Design a least-privilege TShark workflow for [approved scope]. Include capture filters, rotation, evidence protection, validation, retention, and cleanup requirements.

Best Practices

  • Confirm written authorization, capture scope, retention, and privacy requirements before accessing traffic.
  • Use narrow capture filters, short durations, least privilege, encrypted storage, and strict evidence access controls.
  • Corroborate packet indicators with logs, asset context, and timelines before declaring malicious activity.

Avoid

  • Do not capture networks, interfaces, credentials, or wireless traffic outside an explicitly approved scope.
  • Do not store PCAP files, decrypted payloads, passwords, hashes, or key material in plaintext or shared locations.
  • Do not execute remote installation scripts, unverified filters, or privileged commands without reviewing their source and impact.

Frequently Asked Questions

Does this skill install TShark?
No. Install TShark or Wireshark through a trusted package source before using the workflows.
Can it analyze an existing PCAP without root access?
Usually yes. Reading an accessible capture file generally does not require live-capture privileges.
Why can live capture require elevated permissions?
Packet capture needs raw network access. Prefer narrowly assigned capture capabilities instead of running the complete analyzer as root.
Can it decrypt TLS traffic?
Yes, when authorized session secrets or suitable private keys are available. Those secrets require strict protection and deletion controls.
Does a suspicious filter match prove an attack?
No. Filters identify evidence for review. Confirm findings with host logs, asset roles, expected behavior, and additional telemetry.
How should capture files be shared?
Minimize and redact sensitive fields, encrypt transfers, restrict recipients, preserve integrity, and follow the approved retention policy.

Developer Details

License

MIT

Author version

v0.1.0

Skillstore revision

r2

Repository

https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/offsec/analysis-tshark

Ref

9e952417e76879bc9d853e1b8b2cd6d6d8d4a1c2

Maintenance freshness

7/24/2026

Usage

8 downloads · 331 views

File structure

📁 assets/

📄 .gitkeep

📄 ci-config-template.yml

📄 rule-template.yaml

📁 references/

📄 EXAMPLE.md

📄 WORKFLOW_CHECKLIST.md

📄 SKILL.md

More from AgentSecOps

View all

Related Skills

View all