iotnet
IoT network traffic analyzer for detecting IoT protocols and identifying security vulnerabilities in network communications. Use when you need to analyze network traffic, identify IoT protocols, or assess network security of IoT devices.
- Installs
- 45
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/brownfinesecurity/iothackbot --skill iotnet- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads iotnet automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
IoTNet - IoT Network Traffic Analyzer
You are helping the user analyze network traffic to detect IoT protocols and identify security vulnerabilities using the iotnet tool.
Tool Overview
IoTNet analyzes network packet captures (PCAPs) or performs live traffic capture to:
- Detect IoT-specific protocols (MQTT, CoAP, Zigbee, etc.)
- Identify security vulnerabilities in network traffic
- Analyze protocol distribution
- Find unencrypted communications
- Detect weak authentication mechanisms
- Identify insecure IoT device behaviors
Instructions
When the user asks to analyze network traffic, capture IoT traffic, or assess network security:
-
Determine input type:
- PCAP file analysis (offline)
- Live network capture (requires interface)
-
Gather requirements:
- For PCAP: Get file path(s)
- For live capture: Get network interface name and duration
- Ask about filtering needs (specific IPs, protocols)
- Check if custom detection rules are needed
-
Execute the analysis:
- Use the iotnet command from the iothackbot bin directory
Usage Modes
PCAP Analysis (Offline)
Analyze one or more existing packet capture files:
iotnet capture1.pcap capture2.pcap
Live Capture
Capture and analyze traffic in real-time:
sudo iotnet -i eth0 -d 30
Parameters
Input Options:
pcap_files: One or more PCAP files to analyze-i, --interface: Network interface for live capture
Filtering Options:
--ip: Filter traffic by IP address-c, --capture-filter: BPF syntax filter for live capture--display-filter: Wireshark display filter for PCAP analysis
Live Capture Options:
-d, --duration: Capture duration in seconds (default: 30)
Analysis Options:
--config: Custom IoT detection rules configuration file- Default:
config/iot/detection_rules.jsonin the iothackbot directory
- Default:
Output Options:
--format text|json|quiet: Output format (default: text)-v, --verbose: Detailed output
Examples
Analyze a packet capture file:
iotnet /path/to/capture.pcap
Live capture for 60 seconds on wifi interface:
sudo iotnet -i wlan0 -d 60
Analyze traffic for specific IP:
iotnet capture.pcap --ip 192.168.1.100
Live capture with BPF filter:
sudo iotnet -i eth0 -c "port 1883 or port 5683" -d 45
Multiple PCAPs with custom config:
iotnet file1.pcap file2.pcap --config custom-rules.json
Filter by display filter (Wireshark syntax):
iotnet capture.pcap --display-filter "mqtt or coap"
Detected IoT Protocols
The tool can identify:
- MQTT: Message Queue Telemetry Transport
- CoAP: Constrained Application Protocol
- Zigbee: Low-power mesh networking
- Z-Wave: Home automation protocol
- ONVIF: IP camera protocol
- UPnP/SSDP: Universal Plug and Play
- Modbus: Industrial control protocol
- And many more (configurable)
Security Checks
IoTNet identifies vulnerabilities such as:
- Unencrypted MQTT traffic
- Missing TLS/encryption
- Weak or no authentication
- Plaintext credentials
- Insecure protocol versions
- Known vulnerable implementations
Output Information
Results include:
- Total packets analyzed
- Protocol distribution with percentages
- IoT findings with protocol details and packet info
- Vulnerabilities with severity levels (high/medium/low)
- Recommendations for remediation
Important Notes
- Live capture requires root/sudo privileges
- Requires network access to specified interface
- PCAP analysis does not require elevated privileges
- Detection rules can be customized in config file
- Supports standard PCAP format from tcpdump, Wireshark, etc.
FAQ
What does the iotnet skill do?
IoT network traffic analyzer for detecting IoT protocols and identifying security vulnerabilities in network communications. Use when you need to analyze network traffic, identify IoT protocols, or assess network security of IoT devices.
How do I install iotnet?
Run npx skills add https://github.com/brownfinesecurity/iothackbot --skill iotnet in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/iotnet/ (personal) or .claude/skills/iotnet/ (project).
Which AI agents can use iotnet?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is iotnet safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains iotnet?
It is published by brownfinesecurity in brownfinesecurity/iothackbot. It has 45 recorded installs.
More from brownfinesecurity/iothackbot
apktool
brownfinesecurity/iothackbot
Android APK unpacking and resource extraction tool for reverse engineering. Use when you need to decode APK files, extract resources, examine AndroidManifest.xml, analyze smali code, or repackage modified APKs.
jadx
brownfinesecurity/iothackbot
Android APK decompiler that converts DEX bytecode to readable Java source code. Use when you need to decompile APK files, analyze app logic, search for vulnerabilities, find hardcoded credentials, or understand app behavior through readable source code.
nmap
brownfinesecurity/iothackbot
Professional network reconnaissance and port scanning using nmap. Supports various scan types (quick, full, UDP, stealth), service detection, vulnerability scanning, and NSE scripts. Use when you need to enumerate network services, detect versions, or perform network reconnaissance.
telnetshell
brownfinesecurity/iothackbot
Use telnet to interact with IoT device shells for pentesting operations including device enumeration, vulnerability discovery, credential testing, and post-exploitation. Use when the user needs to interact with network-accessible shells, IoT devices, or telnet services.
chipsec
brownfinesecurity/iothackbot
Static analysis of UEFI/BIOS firmware dumps using Intel's chipsec framework. Decode firmware structure, detect known malware and rootkits (LoJax, ThinkPwn, HackingTeam, MosaicRegressor), generate EFI executable inventories with hashes, extract NVRAM variables, and parse SPI flash descriptors. Use when analyzing firmware .bin/.rom/.fd/.cap files offline without requiring hardware access.
Popular security skills
azure-compliance
microsoft/azure-skills
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
minimal-run-and-audit
lllllllama/rigorpilot-skills
Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.
seo-audit
coreyhaines31/marketingskills
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.
firebase-security-rules-auditor
firebase/agent-skills
Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.
audit
pbakaus/impeccable
Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.
competitors
coreyhaines31/marketingskills
When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.