skills.rest
crystalzhangbai
crystalzhangbaiCOMMUNITY
Explore all skills by this author →
GitHub

network-trace

Analyzes pcap, pcapng, tcpdump, and CSV capture files for TCP, IPsec, and ICMP issues.

Updated Aug 13, 2026
Search Tags:#packet capture#pcap#tshark#wireshark#network troubleshooting#ipsec#tcp analysis
One-click install
npx skills add https://github.com/crystalzhangbai/TS-Agent-Azure --skill network-trace-crystalzhangbai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: network-trace
Source: https://github.com/crystalzhangbai/TS-Agent-Azure/tree/main/bridge/naniteagent-playground/naniteagent/skills/network-trace
Command: npx skills add https://github.com/crystalzhangbai/TS-Agent-Azure --skill network-trace-crystalzhangbai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Diagnosing network connectivity, performance, and packet loss issues from raw capture files requires deep protocol knowledge and tedious manual inspection of Wireshark data. This Skill automates capture summarization and guides structured deep-dive analysis of TCP sessions, IPsec tunnels, and ICMP anomalies. ## Core Features & Use Cases - Capture Summary: Generates packet counts, duration, protocol distribution, and capture-point identification from pcap, pcapng, tcpdump text, or CSV files. - TCP Session Analysis: Diagnoses connectivity failures, retransmissions, out-of-order packets, window issues, and distinguishes real loss from TLP/DSACK probes. - IPsec & ICMP Analysis: Troubleshoots IKE negotiation, NAT-T detection, ESP sequence gaps, MTU/fragmentation, and ICMPv6 NDP/Router Advertisement problems. - Capture File Editing: Extracts, merges, deduplicates, strips encapsulation headers, and converts captures to CSV using tshark, editcap, and mergecap. - Use Case: A user uploads a pcap from an Azure VM showing intermittent VPN drops; the Skill summarizes the capture, detects ESP traffic, and analyzes SPI sequence numbers to pinpoint packet loss direction. ## Quick Start Analyze the attached capture file 'vpn-issue.pcap' and summarize its contents, then diagnose any TCP retransmission or IPsec tunnel problems.

Frequently Asked Questions about network-trace

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze a pcap file for TCP retransmissions?▼

Filter TCP sessions and calculate the retransmission ratio, then classify retransmissions as RTO, fast retransmit, SACK-based, or TLP probes. Check for DSACK responses to avoid counting speculative TLP probes as real packet loss.

How to merge and deduplicate pcap files with Wireshark tools?▼

Use mergecap to combine multiple captures ordered by timestamp, then editcap -d to remove duplicates. For ERSPAN or VXLAN encapsulated captures, strip outer headers with editcap -C before deduplication.

Does packet capture analysis work with Azure VXLAN encapsulation?▼

Yes, but Azure underlay VXLAN uses non-standard UDP port 65330, which must be recognized for correct protocol identification. Always analyze the innermost overlay IP packets, since underlay encapsulation is only for forwarding.

Why do captured packets exceed the MTU size?▼

NIC offload features like TSO and LRO cause captures to show jumbo or coalesced segments that never existed on the wire. Disable offloads with ethtool or netsh before recapturing if precise per-packet analysis is needed.

How do I detect IPsec packet loss using ESP sequence numbers?▼

Filter ESP packets by SPI to isolate one tunnel direction, then examine sequence numbers for gaps indicating loss or reordering. Compare packet counts per SPI in both directions to identify asymmetric loss.

What are the limitations of analyzing truncated capture files?▼

Packets truncated by snaplen make frame.len unreliable for throughput calculations. Always use the IP header Total Length field (ip.len) to compute actual transmitted data volume.

Related Skills

Explore More Software Engineering Skills→
braydos-hbraydos-h
4

performing-network-packet-capture-analysis

Analyze PCAP and PCAPNG captures with Wireshark, tshark, and Scapy to detect malicious traffic.

Community
Intermediate
linfordWulinfordWu
1

network-diagnosis

Diagnose Linux network faults by aggregating multi-source telemetry into root-cause reports.

Community
Advanced
pkuppenspkuppens

operations-monitoring

Correlate logs, metrics, and alerts to detect production anomalies.

Community
Intermediate
officialpmofficialpm

moltbookdowndetector

Probe Moltbook endpoints and report reachability and latency.

Community
Intermediate