Guide · Agent skill

How to use the Scapy packet analysis agent skill

Updated 2026-10-29 · written with AI from the project's own documentation and checked against our catalogue data

This guide explains the analyzing-network-packets-with-scapy agent skill, which lets an AI agent use the Scapy Python library to read and analyze packet captures and to craft test packets during authorized security work. It is written for readers who have not used agent skills before. By the end you will know how to install the skill, ask for the right kinds of analysis, and understand what it needs and where its limits are.

Analyzing Network Packets with Scapymukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill

Quick start

1Download the ZIP. Download the skill ZIP from this page.
2Unzip into a skills folder. Unzip into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder.
3Install Scapy. Run pip install scapy with Python 3.8 or newer.
4Install capture libraries if needed. Install Npcap on Windows or libpcap on Linux if you plan to capture live traffic.
5Ask for an analysis. Describe the pcap file and what you want, and state that the work is authorized.
6Review the JSON report. Check the exported findings and verify any flagged anomaly against the raw packets.

What the skill makes the agent do

The skill gives the agent a structured procedure for working with network traffic using Scapy. Its documented steps are: read pcap or pcapng files with rdpcap() for offline analysis, extract protocol layers (IP, TCP, UDP, DNS, HTTP) and field values, compute traffic statistics such as top talkers, protocol distribution and port frequency, detect SYN flood patterns from TCP flag ratios, look for DNS exfiltration indicators using query length and entropy, craft custom probe packets for authorized testing, and export findings as a structured JSON report.

Summarize which hosts and protocols appear in a capture
Count TCP flags to spot possible SYN floods
Check DNS queries for signs of tunneling
Flag fragmented or malformed packets
Export the findings as a JSON report
Help craft custom test packets, for authorized testing only

Install the skill

Download the ZIP file from this page. Then choose one of two routes. For a personal setup, unzip it into ~/.claude/skills/. For a single project, unzip it into the project's .claude/skills/ folder. Alternatively, in the Claude apps, open Settings, go to Capabilities, and upload the skill under Skills.

The skill folder contains SKILL.md, scripts/agent.py and references/api-reference.md. Keep this structure intact when unzipping.

Personal: ~/.claude/skills/
Project: .claude/skills/ inside your project
Claude apps: Settings → Capabilities → Skills, then upload

Install the requirements

The skill needs Python 3.8 or newer and the scapy library. Install scapy with pip. For live capture on Windows you need Npcap; on Linux you need libpcap. Live sniffing and sending packets require root or administrator privileges. Reading an existing pcap file does not require live capture.

Python 3.8+
pip install scapy
Npcap (Windows) or libpcap (Linux) for capture operations
Root/administrator privileges for live sniffing or sending

pip install scapy

Trigger the skill with natural requests

You do not need special syntax. Describe the task and mention the capture or the kind of traffic involved. The agent should pick up the skill when the request matches its description: network reconnaissance, protocol-level forensic analysis, or traffic anomaly detection during security testing. State that the work is authorized, since the skill is intended for that purpose.

"Analyze incident.pcap and summarize the hosts and protocols seen."
"Count TCP flags in lab-capture.pcap and tell me whether there are signs of a SYN flood."
"Check the DNS queries in this capture for possible tunneling and export the results as JSON."
"Parse this capture and list IPs, ports, TTL and flags for each packet."

Run the included parser

The bundled script scripts/agent.py parses a capture file and extracts per-packet details such as IP addresses, ports, TTL and flags. The skill's reference file, references/api-reference.md, lists the core Scapy calls it relies on, including rdpcap(), sniff(), wrpcap() and layer access such as pkt[IP].src and pkt[TCP].flags.

Ask the agent to run the script against a capture you are authorized to analyze. The script runs locally and the skill does not use the network.

from scapy.all import rdpcap, IP, TCP
packets = rdpcap("capture.pcap")
for pkt in packets:
    if pkt.haslayer(IP) and pkt.haslayer(TCP):
        print(pkt[IP].src, pkt[IP].dst, pkt[TCP].sport, pkt[TCP].dport, pkt[TCP].flags)

Safety notes for scripts and network use

The skill runs scripts, so review scripts/agent.py before you run it, as you would with any code. Packet sniffing and crafting can be illegal or harmful on networks you do not own or lack written permission to test. Use the skill only on captures you are allowed to analyze and on networks in scope for your engagement.

The detection heuristics are simple. Treat their output as leads to investigate, not confirmed findings. Do not use this skill as production intrusion detection.

Only analyze captures and networks you own or have written permission to test
Review scripts before running them
Expect false positives and missed detections

What people use it for

Summarizing hosts and protocols in a packet capture from an incident
Counting TCP flags to look for possible SYN flood patterns in a lab exercise
Reviewing DNS queries for tunneling indicators such as long queries and high entropy
Documenting protocol-level findings during an authorized penetration test
Teaching protocol-level traffic analysis with a sample capture

Frequently asked questions

How do I install the analyzing network packets with Scapy skill?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. You can also upload it in the Claude apps under Settings → Capabilities → Skills. Install the scapy library with pip install scapy.

What do I need to run this skill?

You need Python 3.8 or newer and the scapy library. Live capture needs Npcap on Windows or libpcap on Linux, and live sniffing or sending needs root or administrator privileges. Reading an existing pcap file does not need live capture.

Is this skill free?

The skill is licensed under Apache-2.0. Scapy is a Python library that you install with pip. This page does not state any price.

Does the skill need network access?

No. The skill's listing says it does not use the network. It does run scripts, so review them before running.

Can it detect SYN floods or DNS tunneling reliably?

It uses simple heuristics: TCP flag ratios for SYN floods and query length and entropy for DNS. The source notes these will produce false positives and misses, so it is not a replacement for production intrusion detection.

What are alternatives if this skill is not what I need?

This source does not compare it with other tools. If you need production-grade detection, use a dedicated intrusion detection system. If you only need to read captures yourself, you can use Scapy directly with the calls in references/api-reference.md.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits security analysts reviewing a capture, students learning protocol analysis, and penetration testers documenting authorized work. It is not suited to monitoring networks you do not have permission to test, or to production intrusion detection because its heuristics are simple. Use it as a helper for reading captures and drafting findings, and verify anything it flags.

Download the skill