SKILL: Traffic Analysis & PCAP — Expert Analysis Playbook

AI LOAD INSTRUCTION: Expert traffic analysis and PCAP forensics techniques. Covers PCAP repair, Wireshark essential filters, protocol-specific analysis (HTTP, HTTPS/TLS, DNS, FTP, SMTP, USB HID, WiFi, ICMP), data extraction (file carving, credential harvesting, covert channels), NetworkMiner, and tshark CLI analysis. Base models miss USB keyboard decode patterns, DNS tunneling detection heuristics, and TLS decryption workflows.

0. RELATED ROUTING

Before going deep, consider loading:

• memory-forensics-volatility for correlating memory artifacts with network traffic
• steganography-techniques for analyzing files extracted from traffic captures
• network-protocol-attacks for understanding attack patterns visible in captures
• reverse-shell-techniques for identifying shell traffic in captures

1. PCAP REPAIR