Get detailed workflow instructions on how to set up TLS/SSL decryption, including extracting keys from memory via x64dbg. Call this tool BEFORE attempting to decrypt TLS traffic.

Run a TShark command with the given arguments.

Args: command_args: The command line arguments to pass to tshark

Returns: The output of the tshark command

Analyze a PCAP file using TShark.

Args: file_path: Path to the PCAP file display_filter: Optional display filter to apply keylog_file: Optional path to a TLS key log file (SSLKEYLOGFILE) for decrypting TLS/SSL traffic max_packets: Maximum number of packets to output (default 100)

Returns: Packet analysis output

Get statistics about packets in a PCAP file.

Args: file_path: Path to the PCAP file

Returns: Packet statistics

Extract detailed information about a specific packet.

Args: file_path: Path to the PCAP file packet_number: The packet number to analyze (1-based)

Returns: Detailed packet information

List available network interfaces for capture.

Returns: List of network interfaces

Extract specific fields from packets in a PCAP file.

Args: file_path: Path to the PCAP file fields: Comma-separated field names (e.g. "ip.src,ip.dst,tcp.port"). Use "http.request.uri" or "tls.app_data" for decrypted content. display_filter: Optional display filter to apply keylog_file: Optional path to a TLS key log file for decrypting TLS traffic

Returns: Tab-separated field values, one packet per line

Export packets from a PCAP file as JSON for structured analysis.

Args: file_path: Path to the PCAP file display_filter: Optional display filter to apply max_packets: Maximum number of packets to export (default 50) keylog_file: Optional path to a TLS key log file for decrypting TLS traffic

Returns: JSON-formatted packet data (decrypted if keylog_file is provided)

Get conversation statistics from a PCAP file.

Args: file_path: Path to the PCAP file protocol: Protocol to analyze - one of: eth, ip, tcp, udp, sctp (default: tcp)

Returns: Conversation statistics table

Follow and reconstruct a TCP or UDP stream.

Args: file_path: Path to the PCAP file protocol: Stream protocol - "tcp", "udp", or "sctp" stream_index: Stream index to follow (default: 0, the first stream) keylog_file: Optional path to a TLS key log file. When provided, use follow_tls_stream instead for decrypted TLS content.

Returns: Reconstructed stream content as ASCII text

Follow and reconstruct a decrypted TLS stream as plaintext.

Requires a TLS key log file (SSLKEYLOGFILE). To generate one:

• Chrome/Edge: launch with --ssl-key-log-file=C:/path/keys.log

• Firefox: set environment variable SSLKEYLOGFILE=C:/path/keys.log

• Python requests/httpx: set SSLKEYLOGFILE env var before running

Args: file_path: Path to the PCAP file containing TLS traffic keylog_file: Path to the TLS key log file (SSLKEYLOGFILE format) stream_index: TLS stream index to follow (default: 0, the first stream)

Returns: Decrypted TLS stream content as ASCII plaintext

Capture live packets from a network interface.

Args: interface: Network interface name (use list_interfaces to find names) packet_count: Number of packets to capture (default: 50, max: 500) display_filter: Optional display filter to apply duration: Maximum capture duration in seconds (default: 10, max: 60)

Returns: Captured packet summary

Capture live TLS traffic and immediately show decrypted plaintext.

This tool saves the capture to a PCAP file and then decrypts it using the provided TLS key log file. The application generating traffic must write its session keys to keylog_file during capture (set SSLKEYLOGFILE env var before launching Chrome, Firefox, curl, Python, etc.).

Workflow:

1. Set SSLKEYLOGFILE=C:/path/keys.log before launching the target app

2. Call this tool pointing at the same keys.log

3. Browse or make HTTPS requests in the target app

4. The tool returns decrypted HTTP/application data

Args: interface: Network interface to capture on (from list_interfaces) keylog_file: Path to the TLS key log file written by the target app output_pcap: Path where the captured PCAP will be saved for later analysis packet_count: Number of packets to capture (default: 200, max: 500) duration: Capture duration in seconds (default: 30, max: 60) display_filter: Optional display filter (e.g. "tls" or "tcp.port == 443")

Returns: Summary of captured packets and decrypted TLS stream content

Filter packets from a PCAP file and save the result to a new PCAP file.

Args: input_file: Path to the source PCAP file output_file: Path where the filtered PCAP will be saved display_filter: Display filter to select packets (e.g. "tcp.port == 80")

Returns: Status message with packet count written

List running processes with their PIDs.

Use this to find the PID to pass to capture_process.

Args: name_filter: Optional substring to filter process names (case-insensitive). E.g. "chrome" or "python".

Returns: Table of PID and process name for matching processes.

Capture network traffic from a specific process by its PID.

Snapshots the process's active connections at the moment capture starts, builds a BPF filter from those local ports, and captures only the matching traffic. New connections opened after capture starts share the same ports and are included automatically.

Use list_processes() to find the PID, and list_interfaces() to find the interface name.

Args: pid: Process ID to capture traffic for. interface: Network interface to capture on (from list_interfaces). output_pcap: Path where the captured PCAP will be saved. duration: Capture duration in seconds (default: 30, max: 60). packet_count: Maximum packets to capture (default: 200, max: 500). keylog_file: Optional TLS key log file path (SSLKEYLOGFILE format). When provided, decrypted TLS stream content is included in the output. The file must exist before calling this.

Returns: Capture summary showing detected connections, packet list, and (when keylog_file is supplied) decrypted TLS stream content.

Compute traffic volume over time — packets and bytes per interval.

Uses tshark's io,stat to bucket traffic into fixed-width time windows. Useful for identifying bursts, sustained flows, and periodic patterns.

Args: file_path: Path to the PCAP file interval_seconds: Bucket width in seconds (default: 1.0) display_filter: Optional display filter to restrict which packets are counted (e.g. "tcp", "ip.addr == 10.0.0.1")

Returns: Table of intervals with frame count and byte count per bucket

Build a host-pair communication matrix showing traffic volume.

Extracts ip.src, ip.dst, and frame.len fields from packets, then aggregates by (src, dst) pair sorted by total bytes descending.

Args: file_path: Path to the PCAP file display_filter: Optional display filter (e.g. "not arp") top_n: Number of top host pairs to return (default: 20)

Returns: Ranked table of host pairs with packet count and byte totals

Deep analysis of DNS traffic: query patterns, response times, error rates.

Extracts per-query details including query name, response code, and response time, then summarises top queried domains and NXDOMAIN failures.

Args: file_path: Path to the PCAP file display_filter: Optional extra display filter (applied in addition to dns) top_n: Number of top domains to show in summary (default: 30)

Returns: DNS summary with top queried domains, NXDOMAIN list, and response stats

Aggregate packet flows grouped by arbitrary tshark field combinations.

Extracts the specified fields plus frame.len from each packet, then groups and sums by those fields. Default grouping is (src IP, dst IP, protocol number).

Args: file_path: Path to the PCAP file group_by: Comma-separated tshark field names to group by (default: "ip.src,ip.dst,ip.proto"). Examples: "ip.src,tcp.dstport" for per-service flows, "ip.src,ip.dst,ip.proto,tcp.dstport" for 5-tuple display_filter: Optional display filter (e.g. "tcp.dstport == 5432") top_n: Number of top flows to return, ranked by bytes (default: 20)

Returns: Table of flow groups with packet count and byte total, ranked by volume

Analyse TCP performance: RTT, retransmissions, window size, and lost segments.

Extracts tcp.analysis.ack_rtt, tcp.window_size, tcp.analysis.retransmission, and tcp.analysis.lost_segment fields to compute aggregate statistics useful for diagnosing network quality.

Args: file_path: Path to the PCAP file display_filter: Optional display filter (e.g. "ip.addr == 10.0.0.1")

Returns: Performance summary with RTT stats, retransmission count, and window info

Reconstruct SS7 TCAP signaling dialogues from a PCAP file.

Groups TCAP messages (Begin/Continue/End/Abort) by their transaction IDs (OTID/DTID) to show the full lifecycle of each signaling dialogue. MAP operation codes (when present) are included for each component.

Typical protocol stack: SCTP -> M3UA -> SCCP -> TCAP -> MAP

Args: file_path: Path to the PCAP file display_filter: Optional extra filter (e.g. "sccp.called_party == '...'") max_dialogues: Maximum number of dialogues to reconstruct (default: 20)

Returns: Per-dialogue message sequence with timestamps, message types, and MAP ops

Analyse GSM MAP (Mobile Application Part) operations from SS7 traffic.

Extracts MAP operation codes, IMSI, and MSISDN values to show which operations are most frequent and which subscribers are involved. Useful for telecom network auditing and SS7 security analysis.

Typical protocol stack: SCTP -> M3UA -> SCCP -> TCAP -> MAP

Args: file_path: Path to the PCAP file display_filter: Optional extra filter to narrow MAP traffic top_n: Top N operations and subscribers to show (default: 20)

Returns: MAP operation frequency table and per-IMSI activity summary

Extract transferred files from a PCAP using tshark's --export-objects.

Reconstructs files exchanged over application protocols and writes them to output_dir. Useful for forensic recovery of HTTP downloads, SMB file transfers, FTP uploads/downloads, and TFTP transfers.

Args: file_path: Path to the PCAP file protocol: Protocol layer to extract from — one of: http, smb, tftp, imf, dicom output_dir: Directory where extracted files will be written (must exist)

Returns: List of extracted files with sizes, or error message

Merge multiple PCAP files in timestamp order and analyse the combined result.

Uses mergecap (bundled with Wireshark) to combine captures from multiple network taps or capture sessions, then runs a packet summary on the merged file. Useful for correlating events across different capture points.

Args: input_files: Comma-separated paths to input PCAP files (minimum 2) output_file: Path where the merged PCAP will be written display_filter: Optional display filter for the post-merge summary

Returns: Merge status and packet summary of the combined capture