<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Network Forensics

## tshark (Wireshark CLI)

```bash
# Read PCAP and display summary
tshark -r capture.pcap

# Display filter
tshark -r capture.pcap -Y "ip.addr == 10.0.0.1"

# Field extraction
tshark -r capture.pcap -T fields -e ip.src -e ip.dst -e tcp.port

# Export HTTP objects
tshark -r capture.pcap --export-objects http,./http_objects/

# Export SMB objects
tshark -r capture.pcap --export-objects smb,./smb_objects/

# Statistics
tshark -r capture.pcap -z io,phs        # Protocol hierarchy
tshark -r capture.pcap -z conv,tcp -q   # TCP conversations
tshark -r capture.pcap -z endpoints,ip -q  # IP endpoints
tshark -r capture.pcap -z dns,tree -q   # DNS statistics
```

## tcpdump

```bash
# Capture all traffic on interface
tcpdump -i eth0 -w capture.pcap

# Capture with BPF filter
tcpdump -i eth0 -w capture.pcap 'port 53 or port 80'
tcpdump -i eth0 -w capture.pcap 'host 10.0.0.1 and tcp'

# Read and filter PCAP
tcpdump -r capture.pcap -n 'dst port 443'
tcpdump -r capture.pcap -A 'port 80'  # ASCII content
```

## Zeek (formerly Bro)

```bash
# Process PCAP
zeek -r capture.pcap
zeek -r capture.pcap local  # With full policy scripts

# Output logs (TSV format):
# conn.log, dns.log, http.log, ssl.log, files.log, notice.log, weird.log

# Query with zeek-cut
cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p proto duration
cat dns.log | zeek-cut query answers
cat http.log | zeek-cut host uri user_agent
cat ssl.log | zeek-cut server_name subject issuer ja3
```

## Scapy (Python)

```python
from scapy.all import rdpcap, IP, TCP, DNS, DNSQR

packets = rdpcap("capture.pcap")

# Filter by protocol
dns_packets = [p for p in packets if p.haslayer(DNS)]
tcp_packets = [p for p in packets if p.haslayer(TCP)]

# Access fields
for pkt in dns_packets:
    if pkt[DNS].qr == 0:  # Query
        print(pkt[DNSQR].qname)

# Write filtered PCAP
from scapy.all import wrpcap
filtered = [p for p in packets if p.haslayer(IP) and p[IP].dst == "10.0.0.1"]
wrpcap("filtered.pcap", filtered)
```

## NetworkMiner

```bash
# GUI — open PCAP for artifact extraction
NetworkMiner capture.pcap

# Extracts: files, images, credentials, DNS, sessions, hosts
```

## capinfos

```bash
capinfos capture.pcap          # Full statistics
capinfos -c capture.pcap       # Packet count only
capinfos -s capture.pcap       # File size only
capinfos -u capture.pcap       # Duration only
```

## BPF Filter Syntax

```
host 10.0.0.1                  # Source or destination
src host 10.0.0.1              # Source only
dst port 443                   # Destination port
tcp and port 80                # Protocol and port
not arp                        # Exclude protocol
net 192.168.0.0/24             # Subnet
portrange 1-1024               # Port range
```
