<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Detecting Covert Channels — API & Tool Reference

> Quick reference for tools, commands, and APIs used in detecting-covert-channels.

## Tools

### `tshark`

Protocol-level packet analysis

**Usage:**
```bash
tshark -r capture.pcap -Y "icmp && frame.len > 100"
```

**Key Flags:**
  - `-r: read PCAP`
  - `-Y: display filter`
  - `-T fields: field extraction`
  - `-e: field specifier`

---

### `suricata`

IDS with deep packet inspection for covert channels

**Usage:**
```bash
suricata -r capture.pcap -S covert-channel.rules -l /tmp/output/
```

**Key Flags:**
  - `-S: rule file`
  - `-r: read PCAP`
  - `-l: log directory`

---

### `zeek`

Network analysis for protocol anomalies

**Usage:**
```bash
zeek -r capture.pcap covert-channel-detect.zeek
```

**Key Flags:**
  - `-r: read PCAP`
  - `-C: disable checksum validation`

---

## Integration Notes

- All tools should be run with least-privilege access appropriate to the task
- Log all tool invocations for audit trail
- Validate tool output before acting on results
- Cross-reference findings with multiple tools where possible

## See Also

- Parent skill: [Network Security](../../../SKILL.md)
- Technique SKILL.md: [../SKILL.md](../SKILL.md)
