# Analyzing Network Packets With Scapy

> 使用 Scapy 构造、发送、嗅探和解析网络数据包，用于协议分析（protocol analysis）、网络侦察（network reconnaissance）以及在授权安全测试中进行流量异常检测

- **Type:** Skill
- **Install:** `agentstack add skill-killvxk-cybersecurity-skills-zh-analyzing-network-packets-with-scapy`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [killvxk](https://agentstack.voostack.com/s/killvxk)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [killvxk](https://github.com/killvxk)
- **Source:** https://github.com/killvxk/cybersecurity-skills-zh/tree/master/skills/analyzing-network-packets-with-scapy

## Install

```sh
agentstack add skill-killvxk-cybersecurity-skills-zh-analyzing-network-packets-with-scapy
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# 使用 Scapy 分析网络数据包

## 概述

Scapy 是一个 Python 数据包操作库，可在精细的协议层级构造、发送、嗅探和解析网络数据包。本技能涵盖将 Scapy 用于安全相关任务，包括 TCP/UDP/ICMP 数据包构造、pcap 文件分析、协议字段提取、SYN 扫描实现、DNS 查询分析，以及检测异常流量模式（如异常分片数据包或格式错误的头部）。

## 前置条件

- Python 3.8+ 并安装 `scapy` 库（`pip install scapy`）
- 原始套接字操作（嗅探、发送）需要 root/管理员权限
- Windows 系统需要 Npcap，Linux 系统需要 libpcap 进行数据包捕获
- 获得在目标网络上执行数据包操作的授权

## 步骤

1. 使用 `rdpcap()` 读取和解析 pcap/pcapng 文件进行离线分析
2. 提取协议层（IP、TCP、UDP、DNS、HTTP）及字段值
3. 计算流量统计：最活跃主机、协议分布、端口频率
4. 通过分析 TCP 标志比例检测 SYN 洪水（SYN flood）模式
5. 通过查询长度和熵分析识别 DNS 外泄指标
6. 为授权网络测试构造自定义探测数据包
7. 将发现导出为结构化 JSON 报告

## 预期输出

JSON 报告，包含数据包统计、协议分布、最活跃源/目标 IP、检测到的异常（SYN 洪水、DNS 隧道（DNS tunneling）指标、分片攻击），以及按流的摘要。

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [killvxk](https://github.com/killvxk)
- **Source:** [killvxk/cybersecurity-skills-zh](https://github.com/killvxk/cybersecurity-skills-zh)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-killvxk-cybersecurity-skills-zh-analyzing-network-packets-with-scapy
- Seller: https://agentstack.voostack.com/s/killvxk
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.