network_analysis_plugin
A DeepSeek Harness tool plugin for inspecting PCAP/PCAPNG captures through bounded, evidence-oriented network traffic queries.
Install
$ dsh plugin --profile web add /abs/path/to/network_analysis_plugin/packages/dsh-pluginPlugin Overview & Capabilities
AI-assisted organization based on the public repository snapshot. The content must be grounded in source evidence and does not replace compatibility or security verification.
Key Capabilities
- Opens PCAP/PCAPNG files and reports capture identity, format, packet count, and duration.
- Builds traffic overviews with protocol distributions, conversation counts, and top conversations.
- Queries conversation and event data through a constrained AST query interface.
- Provides conversation inspection, frame-level evidence retrieval, and bounded raw tshark queries.
- Produces binned traffic time series for bytes, packets, window, RTT, and TLS-byte metrics.
- Generates HTTP transaction timelines for cleartext HTTP traffic.
- Offers a read-only DuckDB-over-Parquet SQL layer with statement/function allowlists, row budgets, and timeout interruption.
- Uses tshark as a backend, with configured, cached pinned, system, and automatic-download resolution paths.
Useful For
- Investigating PCAP or PCAPNG captures in a DeepSeek Harness agent workflow.
- Reviewing packet-level evidence behind an agent's traffic-analysis claims.
- Exploring TCP analysis events, HTTP transactions, TLS handshake attributes, and QUIC streams.
- Analyzing traffic trends with bounded time-series aggregation.
- Performing constrained SQL exploration when the predefined traffic IR does not cover a question.
Who It Fits
- DeepSeek Harness users analyzing network captures with agents.
- Network engineers and incident responders who need structured packet-capture observations.
- Developers building evidence-driven traffic-analysis workflows in DSH.
Documented Limitations
- Tools return observations and evidence rather than conclusions such as congestion, attacks, or slow websites; interpretation is left to the LLM.
- HTTP timelines apply only to cleartext HTTP.
- The documented query DSL is AND-only and limited to allowlisted fields.
- Frame evidence is limited to 200 frames per request.
- Time-series bins are constrained to 10–5000 ms, with automatic widening beyond 500 bins.
- Raw queries are bounded and validate requested fields against tshark vocabulary.
- The backend depends on tshark availability; pinned-download availability may be affected when Wireshark CDN versions are removed.
- The project explicitly does not provide zcode MCP glue, a tshark binary npm subpackage, QUIC/HTTP2 stream-layer support, cross-conversation transaction pairing, OR conditions, or arbitrary expressions.
DSH Compatibility
Version-specific runtime evidence collected by DSH Plugin. A missing result means we have not tested that combination yet.
Security Signals
Objective signals discovered from package metadata and source inspection. These are not a guarantee that a plugin is safe.
package.json declares 0 runtime, 0 development, 0 peer, and 0 optional dependencies.
GitHub did not report an SPDX license for this repository snapshot.
A root package.json was captured and can be inspected by the registry.
Public GitHub source metadata is available for this registry snapshot.
Source & Registry Notes
Public provenance, Registry classification, and the latest source check for this entry, kept separate from runtime verification.
- Source repository
- SWHsz/network_analysis_plugin
- Registry source
- GitHub · dsh-plugin topic
- Registry classification
- Plugin
- Source checked
- 8d447ea · 2026-09-04
This project is independently indexed from public source information. DSH Plugin is not affiliated with DeepSeek or the plugin author. Always check the author repository before installation.
Repository Activity
- GitHub stars
- 0GitHub stars
- Forks
- 0
- Open issues
- 0
- Last commit
- 2026-09-03
- Last release
- No release detected
Related DSH Plugins
Ranked by overlapping capabilities, use cases, plugin type, categories, and DSH profile.
DSH undo and crash-recovery plugin with snapshots, rollback, Safe Mode, and offline Windows tools.
View plugin →DeepSeek Harness web-search plugin that adds web search, X search, and focused page fetching with structured evidence.
View plugin →Agent skill for beautiful, verifiable architecture, workflow, sequence, data-flow, and lifecycle diagrams—self-contained HTML with motion and crisp export.
View plugin →Sandbox-first automatic permission policy and intelligent risk classification for DeepSeek Harness.
View plugin →