Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add killvxk/cybersecurity-skills-zh --skill analyzing-network-traffic-with-wiresharkgit clone --depth 1 https://github.com/killvxk/cybersecurity-skills-zhWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-network-traffic-with-wireshark)<a href="https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-network-traffic-with-wireshark"><img src="https://agentmods.dev/badge/skills/killvxk/cybersecurity-skills-zh/analyzing-network-traffic-with-wireshark/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-network-traffic-with-wireshark"><img src="https://agentmods.dev/badge/skills/killvxk/cybersecurity-skills-zh/analyzing-network-traffic-with-wireshark.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00058 | $0.03093 |
| Opus 5 | $0.00029 | $0.01546 |
| Sonnet 5 | $0.00012 | $0.00619 |
| Haiku 4.5 | $0.00006 | $0.00309 |
Grade B, and why
analyzing-network-traffic-with-wireshark scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- 进行实时数据包捕获需要 root/sudo 权限或隶属于 `wireshark` 组 Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
tshark -r capture.pcapng -Y "http.user_agent contains \"curl\" or http.user_agent contains \"Wget\"" How it starts
The opening of the file, as written. The whole thing — 218 lines — stays where its author put it; the contents beside it link to each section on GitHub.
使用 Wireshark 分析网络流量
适用场景
- 通过检查命令与控制（command-and-control）流量、数据外泄或横向移动（lateral movement）的数据包级证据，调查疑似网络入侵
- 诊断网络性能问题，如重传、分片或 DNS 解析失败
- 通过捕获沙盒或隔离主机的流量，分析恶意软件的通信模式
- 通过确认实际穿越网络分段的流量，验证防火墙（firewall）和入侵检测系统（IDS）规则
- 从捕获的网络会话中提取文件、凭据或失陷指标（IOC）
不适用于：在未经授权的网络上捕获流量、在没有法律授权的情况下拦截私人通信，或作为生产监控中全功能 SIEM 平台的替代品。
前置条件
- 已安装 Wireshark 4.0+ 和 tshark 命令行工具
- 进行实时数据包捕获需要 root/sudo 权限或隶属于
wireshark组 - 访问受监控网段的网络接口（物理网卡、SPAN 端口或网络分路器）
- 足够的磁盘空间用于数据包捕获文件（繁忙的千兆链路估计每分钟 1 GB）
- 熟悉 TCP/IP 协议、HTTP、DNS、TLS 和 SMB 的数据包层级细节
工作流程
步骤 1：配置捕获环境
设置捕获接口和过滤器，锁定相关流量：
# 列出可用接口
tshark -D
# 在 eth0 上启动捕获，使用捕获过滤器限制范围
tshark -i eth0 -f "host 10.10.5.23 and (port 80 or port 443 or port 445)" -w /tmp/capture.pcapng
# 使用环形缓冲区捕获以管理磁盘占用（10 个文件，每个 100MB）
tshark -i eth0 -b filesize:102400 -b files:10 -w /tmp/rolling_capture.pcapng
# 同时在多个接口上捕获
tshark -i eth0 -i eth1 -w /tmp/multi_interface.pcapng
对于 Wireshark GUI，在开始捕获前在"Capture Options"对话框中设置捕获过滤器。
步骤 2：应用显示过滤器进行针对性分析
# 过滤包含可疑 User-Agent 的 HTTP 流量
tshark -r capture.pcapng -Y "http.user_agent contains \"curl\" or http.user_agent contains \"Wget\""
# 查找指向可疑顶级域名的 DNS 查询
tshark -r capture.pcapng -Y "dns.qry.name contains \".xyz\" or dns.qry.name contains \".top\" or dns.qry.name contains \".tk\""
# 识别表明网络问题的 TCP 重传
tshark -r capture.pcapng -Y "tcp.analysis.retransmission"
# 过滤用于横向移动检测的 SMB 流量
tshark -r capture.pcapng -Y "smb2.cmd == 5 or smb2.cmd == 3" -T fields -e ip.src -e ip.dst -e smb2.filename
# 查找明文凭据传输
tshark -r capture.pcapng -Y "ftp.request.command == \"PASS\" or http.authbasic"
# 检测信标模式（规律间隔的连接）
tshark -r capture.pcapng -Y "ip.dst == 203.0.113.50" -T fields -e frame.time_relative -e ip.src -e tcp.dstport
步骤 3：协议专项深度分析
# 跟踪 TCP 流以重建对话
tshark -r capture.pcapng -q -z follow,tcp,ascii,0
# 分析 HTTP 请求/响应对
tshark -r capture.pcapng -Y "http" -T fields -e frame.time -e ip.src -e ip.dst -e http.request.method -e http.request.uri -e http.response.code
# 提取 DNS 查询/响应统计
tshark -r capture.pcapng -q -z dns,tree
# 分析 TLS 握手以检测弱密码套件
tshark -r capture.pcapng -Y "tls.handshake.type == 2" -T fields -e ip.src -e ip.dst -e tls.handshake.ciphersuite
# SMB 文件访问枚举
tshark -r capture.pcapng -Y "smb2" -T fields -e frame.time -e ip.src -e ip.dst -e smb2.filename -e smb2.cmd
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago First seen · 218 lines · 58 tokens per session scan B 2b14b7e9f6eb
analyzing-network-traffic-with-wireshark is a skill published in the GitHub repository killvxk/cybersecurity-skills-zh (45 stars, last pushed 4mo ago), licensed Apache-2.0. It adds 58 tokens to every session and 3,093 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 2 findings (asks for root, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-network-traffic-with-wireshark
Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and support incident response investigations on authorized network segments.
analyzing-network-traffic-with-wireshark
Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and support incident response investigations on authorized network segments.
analyzing-network-traffic-with-wireshark
Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and support incident response investigations on authorized network segments.
analyzing-network-traffic-with-wireshark
Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and support incident response investigations on authorized network segments.
analyzing-network-traffic-with-wireshark
Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and support incident response investigations on authorized network segments.
analyzing-network-traffic-with-wireshark
Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and support incident response investigations on authorized network segments.