Summary
Pairing capture with a threat-intelligence lookup is what turns packets into a question you can answer.
Raw packet JSON is a lot of data and very little meaning; the useful move is always "which of these addresses is known bad". Doing the capture and the reputation check behind one connection means that question is one step rather than an export and a paste. Analysing a stored capture matters just as much — most real investigation happens after the fact, on a file someone hands you.
What it is
A wrapper around Wireshark's command-line tool that turns live and recorded network traffic into structured data a model can reason over.
What you get
- capture_packets — live traffic as raw packet data in JSON
- get_summary_stats — protocol hierarchy, so the composition of the traffic is visible at a glance
- get_conversations — TCP and UDP conversation statistics between endpoints
- check_threats — captured addresses checked against a public blocklist
- check_ip_threats — a targeted lookup for one address across several threat sources
- analyze_pcap — the same treatment for a stored capture file
Requirements
Wireshark's tshark installed and on PATH, plus Node. MIT licensed.
Setup effort
Build from source — clone the repository and build it, then point your client at the binary