alibabacloud-pcap-analyzer
Installation
SKILL.md
PCAP Analysis
Analyze local Wireshark pcap/pcapng packet capture files and produce a structured Markdown diagnosis report. The analyzer covers TCP transfer performance (throughput, window, RTT, retransmission), connection anomalies (FIN/RST, failed handshakes), IPsec/IKE VPN negotiation, MTU/large-packet issues, DNS resolution, TLS handshake, ICMP errors, and TCP zero-window/Keepalive behavior. Suspicious patterns are reported in dedicated dynamic sections, and the report ends with a consolidated conclusion ranking the likely root causes.
Requires Python 3 and the scapy library:
pip3 install scapy
Module Index
| Module | Purpose | File |
|---|---|---|
| Analysis Rules | Diagnosis decision rules and thresholds (rate, FIN/RST, retransmission, window, RTT, MTU modes, DNS, TLS, TCP setup, ICMP, zero window, IKE) | references/analysis-rules.md |
| Report Structure | The 16-section report layout and the trigger conditions of the dynamic sections | references/report-structure.md |
| Limitations | Usage limitations and full notes for interpreting results | references/limitations.md |
Load references on demand. Do not read all reference files unless the task requires them.