Scapy包析与流量分析
原名：analyzing-network-packets-with-scapy
使用Scapy进行TCP/UDP/ICMP/DNS数据包构造、发送、嗅探与解析，分析pcap文件，实施SYN扫描，检测碎片或畸形等异常流量。适用于授权网络侦察、协议级取证及安全测试中的流量异常检测。
- 分类
- 开发提效
- 版本
- v1.0
- 作者
- 弈韬(@ra1nzzz)
- 下载
- 1
- 收藏
- 0
- 发布
- 2026-08-18
- 更新
- 2026-09-06
- TRACE 评分
- 3 / 5
内容概览
Scapy is a Python packet manipulation library that enables crafting, sending, sniffing, and dissecting network packets at granular protocol layers. This skill covers using Scapy for security-relevant tasks including TCP/UDP/ICMP packet crafting, pcap file analysis, protocol field extraction, SYN scan implementation, DNS query analysis, and detecting anomalous traffic patterns such as unusually fragmented packets or malformed headers. - When investigating security incidents that require analyzing network packets with scapy - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques - Python 3.8+ with scapy library installed (pip install scapy) - Root/administrator privileges for raw socket operations (sniffing, sending) - Npcap (W…