packet capture

Guide to automating smarter packet capture on Linux with Bash: rotate ring-buffer tcpdump captures, trigger bursts on spikes, extract flow features via tshark, and flag outliers with Python IsolationForest, then summarize, archive, and notify. Includes apt/dnf/zypper installs, safe permissions, cron/systemd scheduling, and tips for filters, storage, and optional Zeek/LLM summaries to speed incident response.

A practical, Bash-first guide to AI-powered PCAP triage: safely capture and rotate traffic, extract flow features with tshark/Zeek, train a lightweight Isolation Forest, and continuously score new captures to flag scans, beacons, and exfil—even with encrypted payloads. Includes install steps, ready-to-run scripts, cron automation, tuning tips, and integration with Suricata/Zeek for contextual alerts.

TCPFlow is a command-line utility designed for detailed TCP stream analysis in Unix-like systems. It captures and reconstructs TCP traffic, making it vital for network troubleshooting and security assessments. This tool is particularly useful for network engineers, sysadmins, and security analysts, supporting installations across various Linux distributions with straightforward instructions. TCPFlow is ideal for environments requiring robust debugging and data examination without a graphical interface.