PCAP Triage
A network-forensics learning workflow extracting DNS, TLS SNI, and protocol statistics for analyst review.
01 / The engineering question
What is this project for?
Help an analyst organize initial network observations from an authorized packet capture.
- Inputs
- A local .pcap or .pcapng capture and an optional output directory.
- Outputs
- dns.txt, sni.txt and protocols.txt in the selected directory. The script defaults to out/, while the README examples mention outputs/.
02 / Documented workflow
How the work is structured
- 01
Invoke tshark to extract visible DNS queries.
- 02
Extract TLS SNI when present.
- 03
Write protocol hierarchy statistics.
- 04
Review the outputs and complete an analyst report.
03 / Source material
Evidence you can inspect.
The documented workflow accepts packet captures, produces text artifacts, and provides an analyst-authored report template.
Read the primary evidence ↗Source links are pinned to reviewed commit 518c6b878b27. Later repository changes do not silently change this evidence.
04 / Verification boundary
What this evidence does not prove.
The inspected script suppresses tshark errors and can report completion with empty or incomplete artifacts. It is a learning tool, not an intrusion-detection system or a forensic completeness guarantee. Source code was inspected, not executed; captures must remain private.
Source inspection is not an execution test, a security certification, a performance benchmark, or proof of a production deployment.
05 / Next verifiable step
Build the next piece of proof.
Publish a sanitized fixture and an analyst report with reproducible steps.