List PCAP files in the specified directory.

Load a PCAP file for analysis and return a session ID.

Close and clean up a PCAP analysis session.

Get summary statistics for a loaded PCAP session.

One-shot triage for a PCAP: protocol overview, top talkers, IOC hints, and recommended next analysis tracks. Accepts session_id or pcap_path.

One-shot lateral movement analysis for SMB/NTLM/RDP evidence. Accepts session_id or pcap_path.

One-shot webshell analysis: enumerate HTTP streams, detect tool family, extract/guess key, decrypt, and extract loot to workdir/loot. Accepts session_id or pcap_path.

Solve the Solar traffic-analysis CTF task: extract CVE, forged username, malicious filename, run path, flag, JWT key, and compute final flag{md5(...)}. Accepts session_id or pcap_path.

Run a tshark command with specified arguments. Arguments are validated against a whitelist.

Apply a display filter to the loaded PCAP and return matching packets.

Follow and extract the content of a TCP stream.

Detect suspicious activity in the loaded PCAP based on predefined rules.

Extract Indicators of Compromise (IOCs) from the loaded PCAP.

Generate a timeline of network events from the loaded PCAP.

Export objects (files, certificates, etc.) from a PCAP based on protocol. Accepts session_id or pcap_path.

Perform advanced threat detection using behavioral analysis and pattern recognition.

【CTF必备】Search for patterns including CTF flags (flag{...}, CTF{...}) and custom regex. Use this when: 1) User asks to find flag, 2) User wants to search for specific patterns in traffic, 3) After following a TCP stream to search its content.

【CTF必备】Analyze Shannon entropy of data to detect encryption or compression. High entropy (>5.0) suggests encrypted data. Use this when: 1) User suspects encrypted payload, 2) After finding suspicious data that looks random, 3) Before attempting decryption.

【CTF必备】Automatically decode Base64, hex, URL, or rot13 encoded data. Use this when: 1) User asks to decode something, 2) After entropy analysis suggests encoding, 3) Found what looks like encoded flag.

【Webshell专用】Detect encrypted webshell traffic (Behinder, Godzilla, AntSword) using fingerprint matching. Use this when: 1) User asks about webshell, 2) Suspicious HTTP traffic found, 3) Encrypted POST data detected.

【Webshell专用】Extract decryption key from webshell handshake traffic. Use this when: 1) After detect_webshell finds encrypted traffic, 2) User knows the webshell type and wants to decrypt, 3) Found potential key exchange in first request.

【Webshell专用】Decrypt webshell traffic to reveal attacker commands. Supports Behinder (AES), Godzilla (AES+XOR), AntSword (XOR). Use this when: 1) Key has been extracted, 2) User provides the key, 3) Want to see what commands attacker executed.

【Webshell专用】Brute force webshell decryption key using common passwords. Use this when: 1) Key extraction failed, 2) Decryption with known key failed, 3) Need to recover key from encrypted traffic.

Get Top-N communicating pairs by traffic volume. Use this when: 1) User wants to see who talks most, 2) Identifying C2 servers, 3) Finding data exfiltration targets.

Detect port scanning behavior from traffic patterns. Use this when: 1) User suspects reconnaissance, 2) Many connections to different ports, 3) Early stage of attack analysis.

Analyze timing patterns to detect beaconing or periodic communication. Use this when: 1) User suspects C2 heartbeat, 2) Looking for automated callbacks, 3) Anomaly detection in time series.

【实时抓包】Capture live traffic and provide raw packet data as JSON. Use this when: 1) User wants to capture live network traffic, 2) Monitoring current network activity, 3) Real-time threat detection.

【实时抓包】Capture live traffic and provide protocol hierarchy statistics. Use this when: 1) User wants protocol distribution, 2) Quick network overview, 3) Traffic analysis summary.

【实时抓包】Capture live traffic and provide TCP/UDP conversation statistics. Use this when: 1) User wants conversation details, 2) Identifying communicating pairs, 3) Network mapping.

【威胁情报】Check an IP address against URLhaus blacklist. Use this when: 1) User asks if an IP is malicious, 2) Checking IOCs, 3) Threat intelligence lookup.

【取证分析】Extract credentials (HTTP Basic, FTP, Telnet, Kerberos) from a PCAP file. Use this when: 1) User wants to find passwords, 2) Credential harvesting analysis, 3) Forensic investigation.

【RDP/SMB取证】Extract NTLM hashes from SMB/RDP authentication traffic. Supports Hashcat and John the Ripper formats. Accepts session_id or pcap_path.

【RDP取证】Analyze RDP sessions and correlate with NTLM evidence (NLA/TLS detection and handshake hints). Does not guarantee full TLS/CredSSP decryption. Accepts session_id or pcap_path.

【自动化攻击链路】Automated analysis of RDP + NTLM attack chain. Correlates NTLM evidence with RDP sessions and extracts forensic hints. Accepts session_id or pcap_path.