analyzing-network-flow-data-with-netflow

解析 NetFlow v9 和 IPFIX 记录，检测容量异常（volumetric anomalies）、端口扫描（port scanning）、数据外泄（data exfiltration）和 C2 信标模式（C2 beaconing patterns）。使用 Python netflow 库解码流记录，…

Skill by killvxk

IndexedApache-2.0★ 57

Write a review

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/killvxk-analyzing-network-flow-data-with-netflow

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

解析 NetFlow v9 和 IPFIX 记录，检测容量异常（volumetric anomalies）、端口扫描（port scanning）、数据外泄（data exfiltration）和 C2 信标模式（C2 beaconing patterns）。使用 Python netflow 库解码流记录，构建流量基线，并应用统计分析识别字节数异常、连接时长异常和周期性定时模式的流量。

Use cases: data

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.

Tools: No tools found
Secrets: None asked for
Install scripts: None found
Runs as: Python package

Network hosts it talks to 1

codeload.github.com · found in install command

Files it touches

~/.claude/skills/analyzing-network-flow-data-with-netflow

What's inside

Skill name: analyzing-network-flow-data-with-netflow
Description: 解析 NetFlow v9 和 IPFIX 记录，检测容量异常（volumetric anomalies）、端口扫描（port scanning）、数据外泄（data exfiltration）和 C2 信标模式（C2 beaconing patterns）。使用 Python netflow 库解码流记录，构建流量基线，并应用统计分析识别字节数异常、连接时长异常和周期性定时模式的流量。
License: Apache-2.0
Instructions: 27 lines in SKILL.md · view on GitHub

Before installing

Ships executable scripts

Files (4)

LICENSE
SKILL.md
api-reference.md · references/
agent.py · scripts/

SKILL.md (first lines)

## 指令

1. 安装依赖：`pip install netflow`
2. 从路由器采集 NetFlow/IPFIX 数据，或使用内置采集器：`python -m netflow.collector -p 9995`
3. 使用 `netflow.parse_packet()` 解析捕获的流数据。
4. 分析流量，检测以下内容：
   - 端口扫描（Port scanning）：单一源地址扫描同一端口的大量目标
   - 数据外泄（Data exfiltration）：向异常目标发送的高字节数出站流量
   - C2 信标（C2 beaconing）：具有固定间隔的周期性连接
   - 容量异常（Volumetric anomalies）：超出基线阈值的流量峰值
5. 生成按优先级排列的发现报告。

```bash
python scripts/agent.py --flow-file captured_flows.json --output netflow_report.json
```

## 示例

### 解析 NetFlow v9 数据包
```python
import netflow
data, _ = netflow.parse_packet(raw_bytes, templates={})
for flow in data.flows:
    print(flow.IPV4_SRC_ADDR, flow.IPV4_DST_ADDR, flow.IN_BYTES)
```

From killvxk/cybersecurity-skills-zh, Apache-2.0.

Signals

Stars: 57
Forks: 14
Open issues: 1
Last commit (this folder): Mar 17, 2026 (7 months ago)

From GitHub (fetched Oct 24, 2026).

Details

License: Apache-2.0
Repository: github.com/killvxk/cybersecurity-skills-zh
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: GitHub github-graphql

More from killvxk

Cite this page

analyzing-network-flow-data-with-netflow skill. Agent Mart. https://agentmart.dev/skills/killvxk-analyzing-network-flow-data-with-netflow (last updated 2026-10-24)