reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/capturing-and-analyzing-malware-network-traffic/references/api-reference.md

@@ -0,0 +1,43 @@
+# API Reference: Capturing and Analyzing Malware Network Traffic
+
+## Overview
+
+`scripts/analyst.py` summarizes a PCAP into top conversations, DNS queries, TLS SNI, and detects
+beaconing by inter-arrival timing. It prefers `pyshark` (tshark) and falls back to a minimal
+pure-Python classic-pcap parser for IPv4 conversations and beaconing.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| pyshark | >= 0.6 | Rich packet parsing via tshark (optional) |
+| (stdlib) | — | Minimal pcap parser, statistics |
+
+## External tools
+
+| Tool | Purpose |
+|------|---------|
+| tshark / Wireshark | Interactive and scripted PCAP analysis |
+| Zeek | Connection, DNS, HTTP, and SSL logs from PCAP |
+
+## Core functions
+
+### `summarize(path)`
+Dispatches to pyshark or the minimal parser; returns conversations, DNS/SNI (pyshark), and
+beaconing.
+
+### `_beaconing(timestamps_by_dst)`
+Flags destinations with low-jitter regular intervals (likely C2 check-ins).
+
+## Usage
+
+```bash
+pip install pyshark      # optional; requires tshark on PATH
+python scripts/analyst.py summarize capture.pcap
+```
+
+## Sources
+
+- Wireshark User Guide — https://www.wireshark.org/docs/wsug_html_chunked/
+- Zeek documentation — https://docs.zeek.org/
+- libpcap classic file format (header/record layout)