diff --git a/net-misc/wireshark-patoolkit/Manifest b/net-misc/wireshark-patoolkit/Manifest
new file mode 100644
index 000000000..9767ef18f
--- /dev/null
+++ b/net-misc/wireshark-patoolkit/Manifest
@@ -0,0 +1 @@
+DIST wireshark-patoolkit-20181228.tar.gz 120466450 BLAKE2B cfa37c1b1a3429127bca0544be215d737fd7e824b0b67a488d11d664a3ee7b9d534be8c6338cccfa0d0f10a32b615c63a85e2513039677dc1e26ece216cfd706 SHA512 60c0e77fd5e0f4f47b0d079ced9815c24e04c12b5fc85dfc96f6cfe5fdecd196fdedd270563da0089d5b9e49854ea092ecdccabdeafc1ee44d32d6ece7d28c01
diff --git a/net-misc/wireshark-patoolkit/wireshark-patoolkit-20181228.ebuild b/net-misc/wireshark-patoolkit/wireshark-patoolkit-20181228.ebuild
new file mode 100644
index 000000000..26ab1031a
--- /dev/null
+++ b/net-misc/wireshark-patoolkit/wireshark-patoolkit-20181228.ebuild
@@ -0,0 +1,42 @@
+# Copyright 1999-2018 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit multilib
+
+DESCRIPTION="a collection of traffic analysis Wireshark plugins focused on security"
+HOMEPAGE="https://github.com/pentesteracademy/patoolkit"
+HASH_COMMIT="36e83b7200d1ee8e03e01ae5d827fa195449538c"
+SRC_URI="https://github.com/pentesteracademy/patoolkit/archive/${HASH_COMMIT}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+#https://github.com/pentesteracademy/patoolkit/issues/4
+#KEYWORDS="~amd64 ~arm ~x86"
+
+RDEPEND=">=net-analyzer/wireshark-2.6:="
+DEPEND="${RDEPEND}"
+
+S="${WORKDIR}/patoolkit-${HASH_COMMIT}"
+
+get_PV() {
+	local pv=$(best_version $1)
+	pv=${pv#$1-}; pv=${pv%-r*}
+	pv=${pv//_}; echo ${pv}
+}
+
+src_prepare() {
+	mkdir plugins/patoolkit_libs
+	mv plugins/util.lua plugins/patoolkit_libs
+	mv plugins/wifi/security.lua plugins/patoolkit_libs
+	eapply_user
+}
+
+src_install() {
+	#local WS_PLUGIN_DIR="/usr/$(get_libdir)/wireshark/plugins/$(get_PV net-analyzer/wireshark)/patoolkit/"
+	#lue scripts must be just in "plugin" folder
+	local WS_PLUGIN_DIR="/usr/$(get_libdir)/wireshark/plugins/$(get_PV net-analyzer/wireshark)/patoolkit/"
+	dodir $WS_PLUGIN_DIR
+	cp -R "${S}"/plugins/* ${ED}/$WS_PLUGIN_DIR  || die "Copy files failed"
+}
diff --git a/profiles/pentoo/base/package.accept_keywords/net-misc b/profiles/pentoo/base/package.accept_keywords/net-misc
index 97191fed0..d0490b367 100644
--- a/profiles/pentoo/base/package.accept_keywords/net-misc
+++ b/profiles/pentoo/base/package.accept_keywords/net-misc
@@ -16,7 +16,7 @@ net-misc/portspoof
 ~net-vpn/openvpn-2.3.6
 
 ~net-misc/wireshark-sap-plugin-0.4.1
-#=net-misc/wireshark-sap-plugin-9999 **
+net-misc/wireshark-patoolkit
 
 #below here likely needs cleanup
 net-misc/6tunnel