Network technique

Goal: move from network signal to validated finding quickly, with reproducible triage and clear pivot logic.

When this technique applies

• Need to triage suspected network intrusion or anomalous traffic.
• Need to map exposed services before deeper testing.
• Need protocol-level reconstruction from PCAP or sensor logs.
• Need cross-source correlation (scan + metadata logs + packets).
• Need scenario-based tool selection instead of one-tool-for-all.

Boundary with offensive-tools

This skill defines workflow, triage decisions, and pivot strategy. Tool flags and command syntax belong in offensive-tools/* skills.

Initial triage