Analyzing Network Packets With Scapy
使用 Scapy 构造、发送、嗅探和解析网络数据包，用于协议分析（protocol analysis）、网络侦察（network reconnaissance）以及在授权安全测试中进行流量异常检测
Install
$ agentstack add skill-killvxk-cybersecurity-skills-zh-analyzing-network-packets-with-scapy ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-killvxk-cybersecurity-skills-zh-analyzing-network-packets-with-scapy) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
使用 Scapy 分析网络数据包
概述
Scapy 是一个 Python 数据包操作库，可在精细的协议层级构造、发送、嗅探和解析网络数据包。本技能涵盖将 Scapy 用于安全相关任务，包括 TCP/UDP/ICMP 数据包构造、pcap 文件分析、协议字段提取、SYN 扫描实现、DNS 查询分析，以及检测异常流量模式（如异常分片数据包或格式错误的头部）。
前置条件
- Python 3.8+ 并安装
scapy库（pip install scapy） - 原始套接字操作（嗅探、发送）需要 root/管理员权限
- Windows 系统需要 Npcap，Linux 系统需要 libpcap 进行数据包捕获
- 获得在目标网络上执行数据包操作的授权
步骤
- 使用
rdpcap()读取和解析 pcap/pcapng 文件进行离线分析 - 提取协议层（IP、TCP、UDP、DNS、HTTP）及字段值
- 计算流量统计：最活跃主机、协议分布、端口频率
- 通过分析 TCP 标志比例检测 SYN 洪水（SYN flood）模式
- 通过查询长度和熵分析识别 DNS 外泄指标
- 为授权网络测试构造自定义探测数据包
- 将发现导出为结构化 JSON 报告
预期输出
JSON 报告，包含数据包统计、协议分布、最活跃源/目标 IP、检测到的异常（SYN 洪水、DNS 隧道（DNS tunneling）指标、分片攻击），以及按流的摘要。
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: killvxk
- Source: killvxk/cybersecurity-skills-zh
- License: Apache-2.0
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.