<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Analyzing Packet Captures — API & Tool Reference

> Quick reference for tools, commands, and APIs used in analyzing-packet-captures.

## Tools


### `tshark`

CLI packet analyzer from Wireshark suite

**Usage:**
```bash
tshark -r <pcap> -Y <filter> -T fields -e <field>
```

**Key Flags:**
  - `-r: read PCAP`
  - `-Y: display filter`
  - `-T fields: field output`
  - `-e: extract field`
  - `-q: quiet (stats only)`
  - `-z: statistics mode`

---

### `tcpdump`

Command-line packet capture utility

**Usage:**
```bash
tcpdump -i <iface> -w <file> [filter]
```

**Key Flags:**
  - `-i: interface`
  - `-w: write to file`
  - `-s 0: full snaplen`
  - `-C: file size limit MB`
  - `-G: rotate seconds`
  - `-Z: drop privs to user`

---

### `zeek`

Network analysis framework for protocol logging

**Usage:**
```bash
zeek -r <pcap> local
```

**Key Flags:**
  - `-r: read PCAP`
  - `local: load local policy scripts`
  - `-C: ignore checksums`

---


## Integration Notes

- All tools should be run with least-privilege access appropriate to the task
- Log all tool invocations for audit trail
- Validate tool output before acting on results
- Cross-reference findings with multiple tools where possible

## See Also

- Parent skill: [Network Security](../../../SKILL.md)
- Technique SKILL.md: [../SKILL.md](../SKILL.md)
