alivirgo/major-ai-skills/wireshark

┌─────────────────────────────────────────────────────────────┐
│                 Wireshark Core Architecture                 │
│                                                             │
│  Packet Capture & Tap Layer                                 │
│  ├── `dumpcap` (High-speed multi-threaded capture engine)    │
│  ├── Npcap / libpcap Kernel Ring Buffer Tap                 │
│  └── Wiretap Library (PCAP, PCAPNG, ETL, CAP file format I/O)│
│                                                             │
│  Protocol Dissection & Analysis Layer (`epan`)              │
│  ├── Protocol Dissector Pipeline (Ethernet -> IP -> TLS)    │
│  ├── TCP Stream Tracking (ACK/SEQ analysis, retransmissions)│
│  ├── TLS Decryption Subsystem (RSA Key & Pre-Master Secret) │
│  └── Display Filter Engine (Rich contextual boolean queries)│
└─────────────────────────────────────────────────────────────┘

"""
Wireshark / TShark Automated PCAP Security Miner
Extracts DNS anomalies, TLS SNI hosts, and TCP retransmission rates.
"""
import sys
import os
import subprocess
import json
def analyze_pcap(pcap_path: str):
    if not os.path.exists(pcap_path):
        print(f"Error: PCAP file '{pcap_path}' not found.")
        return
    print(f"--- [ANALYZING PCAP: {pcap_path}] ---")
    # 1. Extract Queried DNS Hostnames
    dns_cmd = [
        "tshark", "-r", pcap_path,
        "-Y", "dns.flags.response == 0 and dns.qry.name",
        "-T", "fields", "-e", "dns.qry.name"
    ]
    dns_out = subprocess.run(dns_cmd, capture_output=True, text=True).stdout.splitlines()
    unique_dns = sorted(list(set(dns_out)))
    print(f"\n[1] Unique DNS Queries ({len(unique_dns)}):")
    for domain in unique_dns[:10]:
        print(f"  • {domain}")
    # 2. Extract TLS Server Name Indication (SNI) Targets
    tls_cmd = [
        "tshark", "-r", pcap_path,
        "-Y", "tls.handshake.extensions_server_name",
        "-T", "fields", "-e", "tls.handshake.extensions_server_name"
    ]
    tls_out = subprocess.run(tls_cmd, capture_output=True, text=True).stdout.splitlines()
    unique_sni = sorted(list(set(tls_out)))
    print(f"\n[2] TLS Handshake SNI Targets ({len(unique_sni)}):")
    for sni in unique_sni[:10]:
        print(f"  • {sni}")
    # 3. Calculate TCP Retransmission Rate
    total_tcp_cmd = ["tshark", "-r", pcap_path, "-Y", "tcp", "-T", "fields", "-e", "frame.number"]
    total_tcp = len(subprocess.run(total_tcp_cmd, capture_output=True, text=True).stdout.splitlines())
    retrans_cmd = ["tshark", "-r", pcap_path, "-Y", "tcp.analysis.retransmission", "-T", "fields", "-e", "frame.number"]
    retrans_count = len(subprocess.run(retrans_cmd, capture_output=True, text=True).stdout.splitlines())
    if total_tcp > 0:
        loss_rate = (retrans_count / total_tcp) * 100.0
        print(f"\n[3] TCP Health Metrics:")
        print(f"  • Total TCP Packets: {total_tcp:,}")
        print(f"  • Retransmissions: {retrans_count:,} ({loss_rate:.2f}%)")
        if loss_rate > 3.0:
            print("  ⚠️ WARNING: High packet loss / retransmission rate detected!")
        else:
            print("  ✅ TCP connection quality is healthy.")
if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: python pcap_security_miner.py <capture.pcapng>")
        sys.exit(1)
    analyze_pcap(sys.argv[1])

# 1. High-Performance Headless Packet Capture with 256MB Ring Buffer
dumpcap -i eth0 -B 256 -b filesize:500000 -b files:10 -w /var/log/traffic.pcapng
 
# 2. Decrypt HTTPS Traffic using SSL Key Log via TShark
tshark -r https_traffic.pcapng -o "tls.keylog_file:/path/to/ssl-keys.log" -Y "http" -T fields -e http.request.full_uri
 
# 3. Slice PCAP by Time Window (First 5 Minutes)
editcap -A "2026-08-22 10:00:00" -B "2026-08-22 10:05:00" input.pcapng output_window.pcapng
 
# 4. Filter and Export Only HTTP 5xx Server Errors
tshark -r traffic.pcapng -Y "http.response.code >= 500" -w server_errors.pcapng