Scapy — анализ сетевых пакетов и трафика

★ 8.4 · security

analyzing-network-packets-with-scapy is a Claude Code skill that leverages the Scapy Python library to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets for authorized network security testing and forensic analysis. It covers reading and parsing PCAP/PCAPng files via `rdpcap()`, extracting protocol layer fields, computing traffic statistics, implementing SYN scans, analyzing DNS queries for tunneling indicators, and detecting anomalous patterns such as fragmented packets, malformed headers, and SYN flood activity. Prerequisites include Python 3.8+, root or administrator privileges for raw socket operations, and Npcap (Windows) or libpcap (Linux). The skill outputs a structured JSON report with packet statistics, protocol distribution, top talkers, and per-flow anomaly summaries — making it practical for SOC analysts, network forensics engineers, and penetration testers who need deep protocol-level traffic inspection.