reverse-skills-max/vendor-new/analyst-ai-pack/skills/capturing-and-analyzing-malware-network-traffic/references/api-reference.md

API Reference: Capturing and Analyzing Malware Network Traffic

Overview

scripts/analyst.py summarizes a PCAP into top conversations, DNS queries, TLS SNI, and detects beaconing by inter-arrival timing. It prefers pyshark (tshark) and falls back to a minimal pure-Python classic-pcap parser for IPv4 conversations and beaconing.

Dependencies

Package	Version	Purpose
pyshark	>= 0.6	Rich packet parsing via tshark (optional)
(stdlib)	—	Minimal pcap parser, statistics

External tools

Tool	Purpose
tshark / Wireshark	Interactive and scripted PCAP analysis
Zeek	Connection, DNS, HTTP, and SSL logs from PCAP

Core functions

summarize(path)

Dispatches to pyshark or the minimal parser; returns conversations, DNS/SNI (pyshark), and beaconing.

_beaconing(timestamps_by_dst)

Flags destinations with low-jitter regular intervals (likely C2 check-ins).

Usage

pip install pyshark      # optional; requires tshark on PATH
python scripts/analyst.py summarize capture.pcap

Sources

• Wireshark User Guide — https://www.wireshark.org/docs/wsug_html_chunked/
• Zeek documentation — https://docs.zeek.org/
• libpcap classic file format (header/record layout)