How to use the Wireshark network traffic analysis agent skill

What the skill makes the agent do

Once installed, the agent knows how to use tshark to capture live network traffic and to examine saved packet files in PCAP format. The skill's instructions cover capture filters, display filters, protocol-level analysis, artifact extraction and reporting. It is aimed at investigations, not day-to-day monitoring.

• Capture traffic from a chosen interface, optionally limited by a capture filter or split into rotating files
• Filter saved captures for suspicious patterns such as unusual DNS domains, beaconing, port scans, cleartext passwords and SMB file access
• Extract files and URLs from captures and list destination IPs for threat intelligence lookups
• Produce hashed evidence and summary reports, including CSV output and SHA-256 hashes for chain of custody

Install the skill in Claude

You can install the skill for a single project or for your whole user account. Download the skill ZIP from this page and unzip it. Then place the resulting skill folder in one of the locations below.

For all your projects, put it in your user skills folder at ~/.claude/skills/. For one project only, put it in that project's .claude/skills/ folder. In the Claude apps, you can instead upload the skill under Settings, then Capabilities, then Skills.

• Personal install: ~/.claude/skills/
• Project install: the .claude/skills/ folder inside your project
• Claude apps: Settings → Capabilities → Skills

Check the requirements before you start

The skill only instructs and helps the agent. It still needs a working Wireshark setup on the machine where the analysis runs. The skill's listed requirements are Wireshark 4.0 or later with the tshark utility installed, Python 3 to run the helper script, and access to the traffic you want to examine.

Live capture needs root or sudo privileges, or membership in the wireshark group. You also need access to a network interface or a span port or tap on the segment you are monitoring. Analyzing an existing PCAP file does not require capture access. The source also notes that the skill does not use the network.

• Wireshark 4.0 or later, with tshark installed
• Root/sudo privileges or the wireshark group for live capture
• Access to a network interface, span port or tap on the monitored segment
• Python 3 to run scripts/agent.py
• Familiarity with TCP/IP, HTTP, DNS, TLS and SMB at the packet level

Trigger the skill with natural requests

You do not need to name tshark commands. Describe the job and include the file or interface. The agent should pick this skill when your request involves packet captures, network traffic or the kinds of patterns listed in its description. Give it the capture file location and say what you are looking for.

Good requests state the question and the evidence. Be specific about the host, time window or pattern. Example requests you could type:

• Analyze capture.pcapng for signs of command-and-control beaconing from 10.10.5.23
• Check this PCAP for DNS queries to suspicious top-level domains and list the hosts that made them
• Find cleartext passwords sent over FTP or HTTP basic auth in this capture
• Export the HTTP objects from this file and give me SHA-256 hashes for each one
• Why are there so many TCP retransmissions in this trace? Show me where they happen

Example commands the skill draws on

The skill's instructions contain tshark commands for each stage of an analysis. The agent builds on patterns like these, and you can run them yourself to check its work. The examples below come directly from the skill's reference material.

• List interfaces: tshark -D
• Capture for 60 seconds: tshark -i eth0 -a duration:60 -w output.pcap
• Find retransmissions: tshark -r capture.pcap -Y "tcp.analysis.retransmission"
• Follow a TCP stream: tshark -r capture.pcapng -q -z follow,tcp,ascii,0

Safety notes for captures and scripts

Only capture or analyze traffic on networks you own or have written authorization to monitor. Intercepting traffic without permission can be illegal, and the skill is explicitly not for that. It is also not a replacement for a SIEM or IDS in production monitoring.

The skill includes a Python helper in scripts/agent.py that runs tshark commands on your behalf. Read it before running it, and run it only against files and interfaces you are authorized to use. Keep captures in a controlled location, because they can contain credentials and personal data. Treat the output as leads that need expert review, not final conclusions.

• Get written authorization before capturing on any network
• Review scripts/agent.py before running it
• Store captures and extracted files securely, since they may contain credentials
• Confirm findings by checking the packets yourself before acting on them

Tips for better results

Narrow the scope early. A capture filter such as a single host and a few ports keeps files small and analysis focused. For long captures, ask the agent to use a ring buffer so disk use stays bounded. Hash the original capture before analysis so you can show later that evidence was not altered.

Ask the agent to explain each filter it uses. Expert review is still needed, because the source notes that output requires interpretation to avoid false conclusions. The reference material also documents common display filters such as dns.qr == 0 for DNS queries and tls.handshake.type == 1 for TLS Client Hello.

• Use a capture filter at capture time and a display filter during analysis
• Use a ring buffer for long captures, so older files roll off
• Hash the original PCAP first for chain of custody
• Ask the agent to show the exact tshark command it ran