shark1For an IT 566 forensics assignment, I wrote a Wireshark plugin known as TCPdShark. It is a variation of TCPdSTAT. I have tweaked it to search for network abnormalities that would reflect an intrusion or attack as well as provide a baseline reading for network administrators that want to be able to quickly and painlessly analyse key protocols and their statistics.

To install this plugin, drop the LUA file in C:\Program Files\Wireshark\plugins\1.8.6\

I have not tested the script with any other platform or architecture. Please let me know if it does or does not work for you.



  • Specifically tuned for offline analysis.
  • Analyzes entire capture and specifically looks for abnormalities with SSH, IRC, TELNET, HTTP, ARP, FTP, ICMP, SMTP.
  • Highly configurable and customizable.
  • Programmed in LUA.
  • Dialogue Boxes for tweaking default thresholds on a protocol basis at start up.

Current version: 1.0.0
Current Version: 1.1.0
Edit: As of 29 Aug 2014 TCPdShark is now at version 1.1.0 and has had some bug fixes implemented thanks to the good work of Grant and Team!

Script can be downloaded Here.


  1. Grant Peterson February 4, 2014 4:04 pm  Reply

    Hey hey! My friend and I are actually in that same class, and we were wondering if we could build on top of your tool with some new functionality, etc. What do you think?

    • jules February 17, 2014 3:43 pm  Reply

      Whatever you guys wanna do. The source code is available at I don’t have much time these days to play with those scripts anymore. Apparently the IRC parser is fixed now. I wanted the script to generate IRC chats but the bug wasn’t allowing it. It is really need to get something working as a WS plugin. Very helpful stuff if you use it a lot.

  2. Grant Peterson February 19, 2014 12:08 am  Reply

    True that. I’ll let you know how the updates on the program come, and will link you up with the newest versions when we make some progress!

    • jules February 19, 2014 3:11 pm  Reply

      Sounds fun, If you want me to host your new version from just let me know.

    • jules March 31, 2014 9:46 pm  Reply

      Looks good guys! Did you enjoy LUA? Turns out, I have used it several times already in “the read world”. One of those languages that seems to be overlooked a lot and not bad to have some experience in.

Leave a comment

Your email address will not be published. Required fields are marked *