analysis-tshark

# TShark Network Protocol Analyzer ## Overview TShark is the command-line network protocol analyzer from the Wireshark project. It provides powerful packet capture and analysis capabilities for security investigations, forensic analysis, and network troubleshooting. This skill covers authorized security operations including traffic analysis, credential extraction, malware detection, and forensic examination. **IMPORTANT**: Network packet capture may expose sensitive information and must only be conducted with proper authorization. Ensure legal compliance and privacy considerations before capturing network traffic. ## Quick Start Basic packet capture and analysis: ```bash # Capture packets on interface sudo tshark -i eth0 # Capture 100 packets and save to file sudo tshark -i eth0 -c 100 -w capture.pcap # Read and analyze capture file tshark -r capture.pcap # Apply display filter tshark -r capture.pcap -Y "http.request.method == GET" # Extract HTTP objects tshark -r capture.pcap --export-objects http,extracted_files/ ``` ## Core Workflow ### Network Analysis Workflow Progress: [ ] 1. Verify authorization for packet capture [ ] 2. Identify target interface and capture requirements [ ] 3. Capture network traffic with appropriate filters [ ] 4. Analyze captured packets for security indicators [ ] 5. Extract artifacts (files, credentials, sessions) [ ] 6. Document findings and security implications [ ] 7. Securely handle and store capture files [ ] 8. Clean up sensitiv...