Network Packet Analyst
Paste the following prompt into your AI chat to install this skill:
Please install @user_7a5540f4/network-packet-analyst according to https://skillhub.cn/install/skillhub.md.
About this skill
Troubleshooting Context
When network symptoms appear as failed connections, high TTFB, TLS handshake failures, DNS errors, or video jitter, application logs alone are often insufficient. Captures from tcpdump, Wireshark, Fiddler, or Charles preserve packet-level evidence, but manually inspecting streams can miss details such as SYN retransmits, RST packets, zero-window events, retransmission rates, and TLS Alert codes. This skill is aimed at DevOps, network operations, and application troubleshooting workflows, turning capture files into actionable diagnostics.
How It Works
- Input recognition: supports common formats such as
.pcap,.pcapng,.cap,.saz,.chls, and.har, while distinguishing full traffic captures from HTTP proxy captures. - Filtering and analysis: extracts key streams using conditions like
ip.addr,tcp.stream,tcp.analysis.retransmission,dns, andtls.handshake, then checks layers from L2 through L7. - Report output: usually includes a capture summary, anomaly timeline, key stream metrics, root-cause inference, remediation advice, and verification steps, with directly usable Wireshark or tcpdump filter expressions.
- Context linkage: for security surveillance, structured cabling, building automation, or low-voltage acceptance issues, it can supplement industry references from the Smart Low-Voltage AI knowledge base, without replacing packet-level evidence.
Boundaries
The skill is useful for analyzing existing captures or deciding what to capture and how to verify a fix, but it cannot confirm server-side code logic, slow database queries, or application-internal state. Captures may contain IP addresses, cookies, tokens, or credentials, so they should be sanitized before sharing. For performance issues, prioritize quantified metrics such as RTT, TTFB, retransmission rate, and throughput before attributing the problem to the network, operating system, or application.
Use Cases
- DevOps needs to determine whether high HTTPS TTFB is caused by DNS, TLS, or slow server processing from a capture.
- Network engineers analyze TCP retransmissions and RST in customer pcapng files to localize connection failures to client, link, or server.
- Application troubleshooters inspect HTTP and HTTPS requests in Fiddler .saz files to check status codes, TTFB, and response issues.
- Low-voltage project engineers combine captures with GB50311 acceptance checks to debug surveillance lag, camera dropouts, or cabling faults.
Best For
- DevOps engineers debugging production networks need Wireshark captures turned into reviewable root causes and verification steps.
- Application engineers handling HTTPS, DNS, or timeout complaints need packet evidence to separate client, server, and network issues.
- Low-voltage project engineers performing acceptance testing need to debug surveillance, access control, or cabling issues against construction standards.
- Security operations engineers need to screen captures for certificate anomalies, port scans, ARP spoofing signs, or plaintext sensitive fields.
Related Skills
Detects AI-generated images from Stable Diffusion, Midjourney, and GPT-4o via Tencent Cloud image moderation and returns risk scores.
A log analysis tool combining deterministic rules and AI reasoning, with error severity levels, keyword filtering, real-time monitoring, webhook alerts, batch directory analysis, and path, SSRF, and XSS protections.
A WCAG 2.2 accessibility audit and remediation guide covering scans, manual checks, issue mapping, and retesting records.
Comprehensive network engineering skill covering fault troubleshooting, technical consulting, and architecture design across routing and switching, wireless, security, cloud computing, and optical transport.