IoT network traffic analyzer for detecting IoT protocols and identifying security vulnerabilities in network communications. Use when you need to analyze network traffic, identify IoT protocols, or assess network security of IoT devices.
Analyzes network traffic to detect IoT protocols and security vulnerabilities in PCAP files or live captures. Use when investigating IoT device communications, checking for unencrypted protocols, or assessing network security risks.
/plugin marketplace add BrownFineSecurity/iothackbot/plugin install iothackbot@iothackbot-marketplaceThis skill inherits all available tools. When active, it can use any tool Claude has access to.
You are helping the user analyze network traffic to detect IoT protocols and identify security vulnerabilities using the iotnet tool.
IoTNet analyzes network packet captures (PCAPs) or performs live traffic capture to:
When the user asks to analyze network traffic, capture IoT traffic, or assess network security:
Determine input type:
Gather requirements:
Execute the analysis:
Analyze one or more existing packet capture files:
iotnet capture1.pcap capture2.pcap
Capture and analyze traffic in real-time:
sudo iotnet -i eth0 -d 30
Input Options:
pcap_files: One or more PCAP files to analyze-i, --interface: Network interface for live captureFiltering Options:
--ip: Filter traffic by IP address-c, --capture-filter: BPF syntax filter for live capture--display-filter: Wireshark display filter for PCAP analysisLive Capture Options:
-d, --duration: Capture duration in seconds (default: 30)Analysis Options:
--config: Custom IoT detection rules configuration file
config/iot/detection_rules.json in the iothackbot directoryOutput Options:
--format text|json|quiet: Output format (default: text)-v, --verbose: Detailed outputAnalyze a packet capture file:
iotnet /path/to/capture.pcap
Live capture for 60 seconds on wifi interface:
sudo iotnet -i wlan0 -d 60
Analyze traffic for specific IP:
iotnet capture.pcap --ip 192.168.1.100
Live capture with BPF filter:
sudo iotnet -i eth0 -c "port 1883 or port 5683" -d 45
Multiple PCAPs with custom config:
iotnet file1.pcap file2.pcap --config custom-rules.json
Filter by display filter (Wireshark syntax):
iotnet capture.pcap --display-filter "mqtt or coap"
The tool can identify:
IoTNet identifies vulnerabilities such as:
Results include:
This skill should be used when the user asks to "create a slash command", "add a command", "write a custom command", "define command arguments", "use command frontmatter", "organize commands", "create command with file references", "interactive command", "use AskUserQuestion in command", or needs guidance on slash command structure, YAML frontmatter fields, dynamic arguments, bash execution in commands, user interaction patterns, or command development best practices for Claude Code.
This skill should be used when the user asks to "create an agent", "add an agent", "write a subagent", "agent frontmatter", "when to use description", "agent examples", "agent tools", "agent colors", "autonomous agent", or needs guidance on agent structure, system prompts, triggering conditions, or agent development best practices for Claude Code plugins.
This skill should be used when the user asks to "create a hook", "add a PreToolUse/PostToolUse/Stop hook", "validate tool use", "implement prompt-based hooks", "use ${CLAUDE_PLUGIN_ROOT}", "set up event-driven automation", "block dangerous commands", or mentions hook events (PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, Notification). Provides comprehensive guidance for creating and implementing Claude Code plugin hooks with focus on advanced prompt-based hooks API.