Works with the AI tools you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+22 moreClaude CodeCursorCodex CLIMuseDots
OpenClaw
Manus
Grok
Grok Bot+18 agentsPCAP Triage
Pure Python PCAP triage tool to extract credentials, JA3 fingerprints, and suspicious network indicators.
$9.99
PCAP Triage
Example session with this skill installed
Analyze this incident.pcap for suspicious activity and extract any cleartext credentials or TLS fingerprints. Focus on host 192.168.1.45.
- Read your context and instructions
- Compiled the pcap triage
I have triaged the provided capture incident.pcap focusing on host 192.168.1.45. The analysis identified 422 total packets for this host, including three instances of cleartext credential transmission and a TLS fingerprint associated with non-standard browser behavior.
Network Triage Report: incident.pcap
| Category | Finding | Details |
|---|---|---|
| Top Talker | 192.168.1.45 | 82% of total traffic directed to 104.21.43.12 (HTTP) |
| Credentials | HTTP Basic Auth | User: admin Pass: P@ssw0rd123 (Dest: 192.168.1.1) |
| TLS Analysis | JA3 Hash | 771,4865-4866-4867,43-51-45-50-27-10-11,29-23-24,0 |
| Suspicious SNI | update.malware-c2.net | SNI detected on port 443; potential beaconing |
| DNS Query | axz12.long-random-subdomain.com | High entropy label detected |
Extracted Flow Data
[
{
"timestamp": "2023-10-27T14:22:01Z",
"src_ip": "192.168.1.45",
"dst_ip": "192.168.1.1",
"protocol": "HTTP",
"alert": "Cleartext password found",
"payload_snippet": "Authorization: Basic YWRtaW46UEBzc3cwcmQxMjM="
},
{
"timestamp": "2023-10-27T14:22:05Z",
"src_ip": "192.168.1.45",
"dst_ip": "104.21.43.12",
"protocol": "TLS",
"sni": "update.malware-c2.net",
"ja3": "a0e9f5d64e9a08e6b1851b12e11d9311"
}
]
Next steps
- Immediately rotate the credentials for
adminon the192.168.1.1management interface. - Block the C2 domain
update.malware-c2.netat the firewall and DNS resolver level. - Run the extracted JA3 hash through a threat intelligence database to identify the specific tool or malware family used.
Connects securely to your tools. The creator never sees your data.
About this skill
Manual packet analysis is slow and often requires heavy dependencies like Wireshark or Scapy. This skill provides a lightweight, dependency-free Python tool for rapid triage of .pcap and .pcapng files to identify threats and extract network indicators.
What it does
- Protocol Breakdown provides a high-level summary of traffic across Ethernet, IPv4/IPv6, and VLAN layers.
- Credential Extraction identifies cleartext passwords in protocols like HTTP Basic, FTP, POP3, and Telnet.
- Traffic Summarization maps top talkers, conversation flows, and port usage to find outliers.
- Encrypted Traffic Analysis extracts TLS SNI hostnames and generates JA3 fingerprints for client identification.
- IOC Discovery flags suspicious DNS queries, long labels, and HTTP connections to raw IP addresses.
How it works
- Initial Scan of the packet capture file using the pure Python triage script.
- Filter Results by specific IP addresses or ports to isolate suspicious host behavior.
- Analyze Outputs including extracted HTTP headers, DNS responses, and TLS fingerprints.
- Export Data to JSON or CSV formats for further enrichment or reporting.
Frameworks & tools
This tool is built in pure Python and requires no external libraries like Scapy or tshark. It supports standard PCAP and PCAPNG formats.
Why this beats prompting it yourself
Writing logic to parse raw packet headers in a chat window is prone to errors and handles large files poorly. This skill provides a tested script that processes thousands of packets per minute and standardizes the extraction of complex signatures like JA3 hashes.
Use cases
- Identify compromised hosts by finding cleartext credentials in network traffic.
- Detect malware C2 activity by analyzing JA3 fingerprints and TLS SNI patterns.
- Perform rapid incident response when tshark or Wireshark are unavailable.
- Map internal network conversations to identify lateral movement.
Known limitations
Handles captures up to a few GB. Very large files should be pre-filtered using tcpdump to improve processing speed.
How to use
Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
30-day refund
Not a fit? Get your money back
Trust & safety
Security scanned
Verified clean 1 day ago
- Passed all security checks, Safe to install