<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Network Traffic Analysis — API Reference

## tshark Commands

### C2 Beaconing Detection

```bash
# SYN packets with timestamps per destination
tshark -r capture.pcap -Y "tcp.flags.syn==1 && !tcp.flags.ack==1" \
  -T fields -e frame.time_epoch -e ip.dst -e tcp.dstport

# HTTP beacons with user-agent
tshark -r capture.pcap -Y "http.request" \
  -T fields -e frame.time -e ip.dst -e http.host -e http.user_agent
```

### DNS Analysis

```bash
# All DNS queries
tshark -r capture.pcap -Y "dns.flags.response==0" \
  -T fields -e frame.time -e ip.src -e dns.qry.name

# DNS TXT records (C2 data channel)
tshark -r capture.pcap -Y "dns.qry.type==16" \
  -T fields -e dns.qry.name -e dns.txt
```

### Data Transfer Analysis

```bash
# Bytes transferred per connection pair
tshark -r capture.pcap -q -z conv,tcp

# Top talkers
tshark -r capture.pcap -q -z endpoints,ip
```

## Zeek Commands

```bash
# Process pcap offline
zeek -r capture.pcap

# Connection summary
cat conn.log | zeek-cut ts id.orig_h id.resp_h id.resp_p duration orig_bytes resp_bytes

# DNS queries
cat dns.log | zeek-cut ts query qtype answers

# HTTP requests
cat http.log | zeek-cut ts host uri method status_code response_body_len
```

## tcpdump Capture Filters

```bash
# Specific host
tcpdump -i eth0 host 10.0.1.50 -w host.pcap

# DNS only
tcpdump -i eth0 port 53 -w dns.pcap

# Non-standard HTTPS
tcpdump -i eth0 'tcp dst port not 443 and tcp dst port not 80' -w nonstandard.pcap
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `-r` | Read from pcap file | `capture.pcap` |
| `-Y` | Display filter | `"http.request"` |
| `-T fields` | Tabular output mode | N/A |
| `-e` | Field to extract | `ip.dst` |
| `-q -z` | Statistics mode | `conv,tcp` |
| `-c` | Packet count limit | `1000000` |
