A high-performance network forensics skill that transforms raw packet captures into actionable security reports using tshark.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install pcap-analyzer
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install pcap-analyzer using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is PCAP Analyzer?
The PCAP Analyzer is a specialized technical utility designed for network engineers and security researchers to perform rapid triage on packet capture files. By leveraging the power of tshark, awk, and sed, this Openclaw Skills tool parses PCAP and PCAPNG files to identify top talkers, service distributions, and potential security anomalies. The tool operates locally, ensuring that sensitive data remains on your machine while providing deep insights into network traffic.
This skill is particularly valuable for laboratory work, incident response, and cybersecurity training. It automates the extraction of critical metadata, DNS patterns, and TLS fingerprints, allowing users to focus on high-level analysis rather than manual packet inspection. Whether you are hunting for beaconing activity or auditing service ports, this skill provides a structured framework for network forensics.
PCAP Analyzer Use Cases
- Rapid incident triage during network security events to identify suspicious connections.
- Automated extraction of DNS queries to detect DGA or tunneling patterns.
- Identifying high-volume talkers and bandwidth consumers in local network environments.
- Performing traffic analysis for penetration testing and CPENT-style laboratory exercises.
How PCAP Analyzer Works
- The user specifies the file path to a .pcap or .pcapng file residing on the local system.
- The skill executes a localized bash script that triggers tshark for deep packet inspection.
- Raw packet data is piped through awk and sed to filter and aggregate information into categories like top talkers and port distributions.
- Best-effort heuristics are applied to flag anomalies such as SYN scans, excessive RST packets, or beaconing behavior.
- A final, human-readable report is generated containing structured network forensics data.
PCAP Analyzer Setup
Before using this skill, ensure that tshark, awk, and sed are installed on your host system. The skill requires the pcap_summary.sh script to be present in the tool directory.
# Verify tshark is available
tshark --version
# Execute analysis via the provided script
{baseDir}/scripts/analyze.sh "/path/to/capture.pcapng"
PCAP Analyzer Data Schema & Taxonomy
The skill organizes forensic data into several logical segments for clarity:
| Data Segment | Description |
|---|---|
| Capture Metadata | Details on file type, size, and first/last packet timestamps. |
| Conversation Tables | Lists of top TCP/UDP conversations and destination ports. |
| Layer 7 Data | Parsed SNI, server names, and queried DNS domains. |
| Anomaly Heuristics | High-level flags for SYN-only scans and retransmission bursts. |
PCAP Analyzer Advanced Features
- Focus host filtering allows users to isolate traffic summaries around a specific IP address.
- Time-windowed analysis provides the ability to narrow forensics to specific event durations.
- Privacy-centric local execution ensures that sensitive packet data is never exfiltrated.
- Comprehensive protocol support including IPv4, IPv6, DNS, TLS, and plain-text HTTP within the Openclaw Skills framework.
SKILL.md
Loading
Related Openclaw Skills
Memory Manager
A professional memory architecture for AI agents implementing episodic, semantic, and procedural storage to prevent context loss.
YouTube-Hook
An AI-driven YouTube content strategist that transforms any topic into high-performing video scripts, SEO-optimized metadata, and visual concepts.
moa-debate
A Mixture of Agents workflow that simulates a rigorous Oxford Union-style formal debate to stress-test arguments and explore complex topics.
Agent Passport
Agent Passport is a comprehensive security framework providing OAuth-style consent-gating, behavioral contracts, and threat-shielding for autonomous AI agents.
Error-Driven Evolution
A structured system for AI agents to transform mistakes into imperative, executable rules that prevent recurring errors.
TripGenie
TripGenie is a specialized travel assistant skill that integrates with OpenClaw to handle real-time hotel bookings, flight searches, and comprehensive itinerary planning.
Featured*
