From iothackbot
Analyzes pcap/pcapng files to extract outbound TCP/UDP flows and resolve DNS hostnames. Ideal for IoT device analysis or mapping network destinations from packet captures.
How this skill is triggered — by the user, by Claude, or both
Slash command
/iothackbot:netflowsThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
You are helping the user extract and analyze network flows from packet capture files using the netflows tool.
You are helping the user extract and analyze network flows from packet capture files using the netflows tool.
NetFlows analyzes pcap/pcapng files to:
This is particularly useful for IoT device analysis to understand what external services a device communicates with.
When the user asks to analyze network flows, extract destinations, or identify what hosts a device talks to:
Gather requirements:
Execute the analysis:
Interpret results:
Analyze a pcap file showing all flows:
netflows capture.pcap
Extract flows from a specific device:
netflows capture.pcap --source-ip 192.168.1.100
Analyze multiple capture files:
netflows capture1.pcap capture2.pcapng
# Human-readable colored output (default)
netflows capture.pcap --format text
# Machine-readable JSON
netflows capture.pcap --format json
# Minimal output - just hostname:port list
netflows capture.pcap --format quiet
Input:
pcap_files: One or more pcap/pcapng files to analyze (required)Filtering:
-s, --source-ip: Filter flows originating from this IP addressOutput:
--format text|json|quiet: Output format (default: text)-v, --verbose: Enable verbose outputAnalyze IoT device traffic:
netflows iot-capture.pcap --source-ip 192.168.1.50
Get just the flow list for scripting:
netflows capture.pcap -s 10.0.0.100 --format quiet
JSON output for parsing:
netflows capture.pcap --format json | jq '.data[].flow_summary'
Text format includes:
JSON format includes:
dns_mappings: Dictionary of IP to hostname mappingstcp_flows: List of TCP flow objects with hostname, ip, portudp_flows: List of UDP flow objects with hostname, ip, portflow_summary: List of "hostname:port" or "ip:port" stringsdns_queries: List of DNS domains queriedtotal_packets: Number of packets analyzednpx claudepluginhub brownfinesecurity/iothackbot --plugin iothackbotCapture and analyze PCAP network traffic using Wireshark and tshark to reconstruct events, extract artifacts, and identify malicious communications.
Capture and analyze PCAP network traffic using Wireshark and tshark to reconstruct events, extract artifacts, and identify malicious communications.
Captures and analyzes network traffic with Wireshark and tshark to reconstruct events, extract artifacts, and identify malicious communications from PCAP files.