performing-network-packet-capture-analysis

What problem does it solve? Network forensic investigations require reconstructing communications, extracting transferred files, and proving data exfiltration or command-and-control activity from raw packet captures, which is slow and error-prone when done manually. ## Core Features & Use Cases - Protocol and Conversation Analysis: Compute protocol distributions, top talkers, and TCP/UDP conversation statistics using Scapy and tshark. - Threat Detection: Detect port scans, DNS exfiltration via oversized queries, beaconing intervals, and traffic on known C2 ports such as 4444 and 31337. - Artifact Extraction: Pull HTTP requests, DNS queries, TLS SNI values, credentials, and transferred files from captures, then generate a JSON forensic report. - Use Case: During incident response, run the suspicious-traffic detection against a capture from a compromised host to surface C2 beaconing and DNS tunneling evidence for the investigation report. ## Quick Start Analyze the attached capture.pcap file for suspicious traffic, beaconing patterns, and DNS exfiltration, then generate a forensic report.