What problem does it solve? Analyzing PCAP files for CTF challenges or security investigations requires knowing dozens of Wireshark display filters, tshark commands, and protocol-specific extraction techniques that are easy to forget or miss entirely. ## Core Features & Use Cases - Protocol-Specific Analysis: Covers HTTP, HTTPS/TLS decryption, DNS tunneling detection, FTP credential extraction, SMTP email parsing, USB HID keyboard decoding, WiFi WPA handshake capture, and ICMP exfiltration detection. - Data Extraction Workflows: File carving from TCP streams, credential harvesting from plaintext protocols, covert channel detection, and NetworkMiner automated analysis. - PCAP Repair & CLI Analysis: Repair corrupted captures with pcapfix, convert pcapng formats, and run tshark one-liners for statistics, conversations, and object export. - Use Case: Given a CTF challenge PCAP containing USB keyboard traffic, use the HID decode workflow to extract keystrokes with tshark and convert keycodes into the typed flag. ## Quick Start Analyze the attached capture.pcap file and extract any credentials, transferred files, and hidden data from the network traffic.
