How to use the Network Traffic Incident Analysis agent skill

What the skill makes the agent do

Once installed, the skill lets the agent work through a security incident's network evidence in a consistent order. The skill covers capturing or obtaining traffic with tcpdump, Zeek logs and NetFlow/IPFIX; looking for command-and-control (C2) beaconing; checking for lateral movement over SMB, RDP, WinRM, WMI and SSH; detecting data exfiltration such as large uploads and DNS tunneling; extracting indicators of compromise; and documenting findings with evidence references.

The skill is aimed at incident response. Its own notes say host-based questions such as process execution or file system artifacts need endpoint forensics tools instead.

Install the skill in Claude

Download the ZIP of the skill from this page and unzip it. To make it available across your projects, place the skill folder in ~/.claude/skills/. To make it available only inside one project, place it in that project's .claude/skills/ folder.

You can also upload the skill in the Claude apps. Go to Settings, then Capabilities, then Skills, and upload the skill there.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project
• App install: Settings → Capabilities → Skills

Check your requirements before you start

The skill assumes you already have the analysis tools in place. Wireshark or tshark must be installed. If you analyse Zeek output, you need Zeek logs such as conn.log and dns.log. Python 3 with scapy is optional; the bundled script falls back if scapy is missing. tcpdump is needed for live capture. Where relevant, you also need network access to the capture point, such as a tap or SPAN port.

The skill does not make network requests itself. It does run scripts, so review the scripts/network folder before running anything on sensitive data.

• Wireshark / tshark (required for the script's analysis)
• Zeek logs such as conn.log and dns.log (if using Zeek output)
• Python 3 with scapy (optional)
• tcpdump (for live capture)
• Access to a network tap or SPAN port (where applicable)

Trigger the skill with natural requests

You do not need special syntax. Describe the task in plain language that matches the skill's scope. The skill's description lists the kinds of requests it responds to, including network traffic analysis, packet capture investigation, PCAP analysis, network forensics, C2 traffic detection and exfiltration detection.

Give the agent as much context as you can: the incident type, which PCAP or log files you have, the suspected hosts or IP addresses, and the time window.

• Analyze this PCAP for C2 beaconing from 10.1.5.42 and summarise the evidence.
• Check these Zeek conn.log and dns.log files for signs of data exfiltration.
• Review this capture for lateral movement over SMB, RDP or WinRM from the compromised host.
• Help me write up the network findings for this incident with frame numbers and timestamps.

Follow the investigation workflow

The skill works through six steps: capture or acquire traffic, identify C2 communications, analyse lateral movement, detect exfiltration, extract and correlate IOCs, and document findings. The steps include example commands and Wireshark display filters you can run yourself to check the agent's results.

For example, a tcpdump capture filtered on a suspect host looks like this:

• Look for regular intervals between connections, consistent packet sizes and HTTPS to external IPs not tied to known CDNs or services.
• Filter SMB with smb2 and the source host, and RDP with tcp.dstport == 3389.
• Look for large HTTP POST uploads, DNS responses with large TXT records, and unusual ICMP volume.

Run the analysis on a PCAP file

For a PCAP, the agent can use tshark to pull statistics such as IP conversations, endpoints and I/O rates per minute, and to extract fields for specific ports or flags. The reference file lists examples like these, which you can run to verify findings:

• Filter by port: tshark -r capture.pcap -Y "tcp.port==445" (SMB)
• List IP conversations: tshark -r capture.pcap -q -z conv,ip
• Show DNS query tree: tshark -r capture.pcap -q -z dns,tree

Safety and authorisation

Only capture or analyse traffic you are authorised to examine. Capturing live traffic can expose private data and may be unlawful without approval, so do not run live captures on production networks without authorisation. Keep evidence files in a controlled location, since PCAPs can contain credentials, personal data and business information.

Because the skill includes scripts, read the code in scripts/agent.py and the scripts/network folder before running it, and test on a sample capture first.

• Get written authorisation before live capture.
• Test the script on a sample PCAP before using it on case data.
• Check the commands against your own log formats before trusting results.