The Network Compromise Assessment Tool is designed to analyze pcap files to detect potential suspicious network traffic. This tool focuses on spotting abnormal activities in the network traffic and searching for suspicious keywords. 

• DNS Tunneling Detection: Identifies potential covert communication channels over DNS.
• SSH Tunneling Detection: Spots signs of SSH sessions which may be used to bypass network restrictions or cloak malicious activities.
• TCP Session Hijacking Identification: Monitors for suspicious TCP sessions which might indicate unauthorized takeovers. …

traffic tunneling wireshark