Skill UI

Utilize the Scapy library in Python to perform deep packet inspection, crafting, sending, and sniffing of various network protocols (TCP, UDP, ICMP, DNS). This skill is essential for analyzing pcap files, implementing advanced security techniques like SYN scans, extracting protocol fields, and detecting network anomalies such as fragmentation or tunneling indicators. Ideal for security researchers, SOC analysts, and penetration testers.

This tool provides comprehensive network traffic analysis capabilities by querying the Arkime API. Users can search sessions, download PCAPs for forensics, detect sophisticated threats like C2 beaconing (via jitter/interval analysis), spot DNS tunneling patterns, and flag connections to known-bad TLS certificate issuers. Ideal for security assessment and incident investigation.

A comprehensive, advanced playbook for conducting deep network traffic analysis and PCAP forensics. Covers essential skills like PCAP repair, advanced Wireshark filtering (HTTP, DNS, TLS), data extraction (file carving, credential harvesting), and detecting covert channels. It guides users through sophisticated techniques, including TLS decryption workflows and DNS tunneling identification.