# Netflows

Network flow extractor that analyzes pcap/pcapng files to identify outbound connections...

- Repository: https://github.com/BrownFineSecurity/iothackbot (879 stars)
- Category: Engineering
- License: MIT
- Last updated: 2026-06-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BrownFineSecurity/iothackbot --skill netflows -g -a claude-code -y`
Codex: `npx skills add BrownFineSecurity/iothackbot --skill netflows -g -a codex -y`
Cursor: `npx skills add BrownFineSecurity/iothackbot --skill netflows -g -a cursor -y`
Gemini CLI: `npx skills add BrownFineSecurity/iothackbot --skill netflows -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add BrownFineSecurity/iothackbot`

## Description

Network flow extractor that analyzes pcap/pcapng files to identify outbound connections with automatic DNS hostname resolution. Use when you need to enumerate network destinations, identify what hosts a device communicates with, or map IP addresses to hostnames from packet captures.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# NetFlows - Network Flow Extractor with DNS Resolution

You are helping the user extract and analyze network flows from packet capture files using the netflows tool.

## Tool Overview

NetFlows analyzes pcap/pcapng files to:
- Extract unique TCP and UDP flows (destination IP:port pairs)
- Build a DNS resolution table from DNS responses in the capture
- Automatically resolve IP addresses to hostnames where possible
- Filter flows by source IP address
- Generate a summary of all network destinations contacted

This is particularly useful for IoT device analysis to understand what external services a device communicates with.

## Instructions

When the user asks to analyze network flows, extract destinations, or identify what hosts a device talks to:

1. **Gather requirements**:
   - Get the pcap/pcapng file path(s)
   - Ask if they want to filter by a specific source IP (e.g., the IoT device's IP)
   - Determine preferred output format

2. **Execute the analysis**:
   - Use the netflows command from the iothackbot bin directory

3. **Interpret results**:
   - Explain resolved hostnames and their significance
   - Note any unresolved IPs that may need further investigation
   - Highlight interesting patterns (cloud services, P2P connections, etc.)

## Usage

### Basic Analysis
Analyze a pcap file showing all flows:
```bash
netflows capture.pcap
```

### Filter by Source IP
Extract flows from a specific device:
```bash
netflows capture.pcap --source-ip 192.168.1.100
```

### Multiple Files
Analyze multiple capture files:
```bash
netflows capture1.pcap capture2.pcapng
```

### Output Formats
```bash
# Human-readable colored output (default)
netflows capture.pcap --format text

# Machine-readable JSON
netflows capture.pcap --format json

# Minimal output - just hostname:port list
netflows capture.pcap --format quiet
```

## Parameters

**Input:**
- `pcap_files`: One or more pcap/pcapng files to analyze (required)

The rest: https://github.com/BrownFineSecurity/iothackbot/blob/HEAD/skills/netflows/SKILL.md