Agent skill · aliyun
alibabacloud-pcap-analyzer
Analyze local pcap/pcapng captures to diagnose network transfer problems. Use when given a pcap file to explain slow network transfer, connection issues, abrupt TCP session termination, security association setup error, private network tunnel establishment problem, DNS, TLS or encrypted session establishment error, MTU or oversized packet drop, or receiver buffer exhaustion. Read-only; no credentials required. Triggers: "pcap analysis", "packet capture analysis", "analyze pcap file", "slow network transfer", "TCP retransmission", "connection reset", "IPsec/IKE negotiation failed", "VPN negotiation failure", "TLS handshake failed", "DNS resolution failure", "MTU issue", "zero window", "abrupt TCP session termination", "domain name lookup error", "encrypted session establishment error", "oversized packet drop".
What it needs
About 5k tokens when loaded.
What this skill does
PCAP Analysis Analyze local Wireshark pcap/pcapng packet capture files and produce a structured Markdown diagnosis report. The analyzer covers TCP transfer performance (throughput, window, RTT, retransmission), connection anomalies (FIN/RST, failed handshakes), IPsec/IKE VPN negotiation, MTU/large-packet issues, DNS resolution, TLS handshake, ICMP errors, and TCP zero-window/Keepalive behavior. Suspicious patterns are reported in dedicated dynamic sections, and the report ends with a consolidated conclusion ranking the likely root causes. Requires Python 3 and the scapy library: Module Index Module Purpose File -------- --------- ------ Analysis Rules Diagnosis decision rules and thresholds (rate, FIN/RST, retransmission, window, RTT, MTU modes, DNS, TLS, TCP setup, ICMP, zero window, IKE) references/analysis-rules.md Report Structure The 16-section report layout and the trigger conditions of the dynamic sections references/report-structure.md Limitations Usage limitations and full notes for interpreting results references/limitations.md Load references on demand. Do not read all reference files unless the task requires them. User Confirmation Before running any analysis, confirm the pcap file path with the user. If the user has not provided a pcap file, ask for the file path first. Never guess, derive, or scan for pcap files on your own. Execution Principle MANDATORY: Read-only: this skill only reads and analyzes. It MUST NOT modify, move, or delete any user file, and it requires no credentials of any kind. Single entry point: all analysis MUST be executed through the entry script scripts/pcapanalyze.py. Do not hand-assemble diagnostic command chains. User-provided files only: only analyze pcap files the user explicitly specifies. Never open or analyze files the user did not point to. No scanning: never search for or open pcap files beyond the one the user provided. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aliyun/alibabacloud-pcap-analyzer