network-security--traffic-analysis

# Network Security & Traffic Analysis ## Purpose Enable Claude to assist with network security operations including traffic analysis from PCAP files, IDS/IPS rule authoring for Snort and Suricata, firewall rule auditing, network anomaly detection, and network architecture security reviews. --- ## Activation Triggers This skill activates when the user asks about: - Analyzing PCAP or PCAPNG files for suspicious activity - Creating Snort or Suricata detection rules - Writing Zeek (Bro) scripts for network analysis - Reviewing firewall rules (iptables, nftables, pf, cloud security groups) - Detecting C2 beaconing, DNS tunneling, or data exfiltration in network traffic - Network architecture security review - IDS/IPS signature development - Network segmentation and east-west traffic analysis - TLS inspection and certificate analysis --- ## Prerequisites ```bash pip install scapy dpkt requests ``` **Recommended tools:** - `Wireshark / tshark` — Packet capture and GUI analysis - `Suricata` — Modern IDS/IPS engine - `Snort 3` — Classic IDS/IPS engine - `Zeek (Bro)` — Network analysis and scripting framework - `tcpdump` — Command-line packet capture - `NetworkMiner` — PCAP artifact extraction - `nmap` — Network scanning and discovery --- ## Core Capabilities ### 1. PCAP Traffic Analysis **When the user provides a PCAP file or asks to analyze network traffic:** ```bash # Quick summary with tshark tshark -r capture.pcap -q -z io,phs # Protocol hierarchy tshark -r...