saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/analyzing-network-traffic-with-wireshark/references/api-reference.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

2.9 KiB
Raw Blame History

API Reference: Wireshark and tshark

Live Capture

tshark -i eth0                              # Capture on interface
tshark -i eth0 -w output.pcap              # Write to file
tshark -i eth0 -a duration:60              # Capture for 60 seconds
tshark -i eth0 -f "port 80"               # BPF capture filter
tshark -D                                   # List interfaces

Display Filters (Read Mode)

tshark -r capture.pcap -Y "<filter>"

Common Filters

Filter Purpose
ip.addr == 10.0.0.5 Traffic to/from IP
tcp.port == 443 Traffic on port 443
http.request HTTP requests only
dns.qr == 0 DNS queries only
tls.handshake.type == 1 TLS Client Hello
tcp.flags.syn == 1 && tcp.flags.ack == 0 SYN-only
frame.len > 1500 Large frames
tcp.analysis.retransmission Retransmissions
icmp ICMP traffic

Field Extraction

tshark -r capture.pcap -T fields \
  -e frame.time -e ip.src -e ip.dst -e tcp.dstport \
  -E separator="," -E header=y

Common Fields

Field Description
frame.time Packet timestamp
ip.src / ip.dst Source/destination IP
tcp.srcport / tcp.dstport TCP ports
http.request.method HTTP method
http.host HTTP Host header
http.request.uri Request URI
http.user_agent User-Agent
dns.qry.name DNS query name
tls.handshake.extensions_server_name TLS SNI
tls.handshake.ja3 JA3 fingerprint

Statistics

tshark -r capture.pcap -q -z conv,ip         # IP conversations
tshark -r capture.pcap -q -z endpoints,ip    # IP endpoints
tshark -r capture.pcap -q -z io,stat,60      # I/O per minute
tshark -r capture.pcap -q -z io,phs          # Protocol hierarchy
tshark -r capture.pcap -q -z http,tree       # HTTP stats
tshark -r capture.pcap -q -z dns,tree        # DNS stats
tshark -r capture.pcap -q -z expert          # Expert info

Object Export

tshark -r capture.pcap --export-objects "http,/output/dir"
tshark -r capture.pcap --export-objects "smb,/output/dir"
tshark -r capture.pcap --export-objects "tftp,/output/dir"
tshark -r capture.pcap --export-objects "imf,/output/dir"

Stream Following

tshark -r capture.pcap -z follow,tcp,ascii,0
tshark -r capture.pcap -z follow,http,ascii,0
tshark -r capture.pcap -z follow,tls,ascii,0

Wireshark GUI Shortcuts

Shortcut Action
Ctrl+F Find packet
Ctrl+G Go to packet
Ctrl+Shift+E Export objects
Ctrl+H Follow stream

editcap - PCAP Manipulation

editcap -A "2024-01-15 09:00" -B "2024-01-15 10:00" in.pcap out.pcap  # Time filter
editcap -c 1000 large.pcap split.pcap    # Split into 1000-packet files
editcap -F pcap in.pcapng out.pcap       # Convert format

mergecap - Merge PCAPs

mergecap -w merged.pcap file1.pcap file2.pcap