network_search
Extract specific network fields from packet captures using Wireshark display filters to test hypotheses during DFIR investigations.
Instructions
Targeted tshark extraction to test a specific hypothesis. display_filter is a Wireshark display filter; fields is a list of field names to extract. Example: display_filter="http.cookie", fields=["frame.number","ip.src","http.cookie"].
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| pcap | Yes | ||
| display_filter | Yes | ||
| fields | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |