Help us improve
Share bugs, ideas, or general feedback.
From iothackbot
Analyzes IoT network traffic from PCAP files or live captures to detect protocols (MQTT, CoAP) and identify security vulnerabilities like unencrypted communications or weak authentication.
npx claudepluginhub brownfinesecurity/iothackbot --plugin iothackbotHow this skill is triggered — by the user, by Claude, or both
Slash command
/iothackbot:iotnetThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
You are helping the user analyze network traffic to detect IoT protocols and identify security vulnerabilities using the iotnet tool.
Analyzes network traffic using Wireshark: captures live on interfaces or from PCAP files, applies capture/display filters for IPs/ports/protocols, troubleshoots security/performance issues.
Tests IoT devices across hardware, firmware, network, cloud, and mobile surfaces using UART/JTAG debugging, firmware extraction, and protocol analysis.
Captures and analyzes network traffic with Wireshark, tcpdump, tshark, Scapy for protocol reverse engineering, security research, and debugging proprietary protocols.
Share bugs, ideas, or general feedback.
You are helping the user analyze network traffic to detect IoT protocols and identify security vulnerabilities using the iotnet tool.
IoTNet analyzes network packet captures (PCAPs) or performs live traffic capture to:
When the user asks to analyze network traffic, capture IoT traffic, or assess network security:
Determine input type:
Gather requirements:
Execute the analysis:
Analyze one or more existing packet capture files:
iotnet capture1.pcap capture2.pcap
Capture and analyze traffic in real-time:
sudo iotnet -i eth0 -d 30
Input Options:
pcap_files: One or more PCAP files to analyze-i, --interface: Network interface for live captureFiltering Options:
--ip: Filter traffic by IP address-c, --capture-filter: BPF syntax filter for live capture--display-filter: Wireshark display filter for PCAP analysisLive Capture Options:
-d, --duration: Capture duration in seconds (default: 30)Analysis Options:
--config: Custom IoT detection rules configuration file
config/iot/detection_rules.json in the iothackbot directoryOutput Options:
--format text|json|quiet: Output format (default: text)-v, --verbose: Detailed outputAnalyze a packet capture file:
iotnet /path/to/capture.pcap
Live capture for 60 seconds on wifi interface:
sudo iotnet -i wlan0 -d 60
Analyze traffic for specific IP:
iotnet capture.pcap --ip 192.168.1.100
Live capture with BPF filter:
sudo iotnet -i eth0 -c "port 1883 or port 5683" -d 45
Multiple PCAPs with custom config:
iotnet file1.pcap file2.pcap --config custom-rules.json
Filter by display filter (Wireshark syntax):
iotnet capture.pcap --display-filter "mqtt or coap"
The tool can identify:
IoTNet identifies vulnerabilities such as:
Results include: