Guide · Agent skill
How to use the NetFlow network flow analyzer agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains what the NetFlow Network Flow Analyzer agent skill does, how to install it, and how to ask an agent to use it. It is written for security analysts, network engineers and students who may never have used an agent skill before. By the end you will know how to point the agent at router flow exports and what kind of report to expect back.
NetFlow Network Flow Analyzermukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the skill ZIP. Download the ZIP of the skill from this page.
- 2Unzip the skill folder. Place it in ~/.claude/skills/ for personal use or in a project's .claude/skills/ folder.
- 3Install Python and netflow. Make sure Python 3.8 or newer is available, then run pip install netflow.
- 4Prepare your flow data. Have NetFlow v9 or IPFIX exports from a router, or a preprocessed JSON flow file, and confirm you are authorized to analyse it.
- 5Ask for the analysis. Describe the flow data and the checks you want in plain language, such as scans, large transfers or beaconing.
- 6Review the prioritized report. Check each finding against the raw flows before acting on it.
What is an agent skill and what does this one do?
An agent skill is a folder of instructions and helper files that an AI agent can load when a task matches it. This skill is named analyzing-network-flow-data-with-netflow and is built around NetFlow v9 and IPFIX records, which are summaries of who talked to whom, how much data moved, and when.
Once installed, the agent can read these flow logs exported by routers. It builds a rough baseline of normal traffic and then looks for patterns that often indicate trouble, then writes a prioritized findings report. The skill is guidance plus a helper script, not a finished product, and the included script is partly a sketch.
- One host scanning many ports on a target
- Unusually large outbound transfers that could mean data theft
- Regular, timed connections that can signal malware calling home (C2 beaconing)
- Volumetric anomalies: traffic spikes beyond baseline thresholds
Install the NetFlow skill from the ZIP download
Download the ZIP of the skill from this page and unzip it. For a personal setup, place the skill folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder instead.
If you use the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.
- Personal: unzip into ~/.claude/skills/
- Project only: unzip into the project's .claude/skills/
- Claude apps: Settings → Capabilities → Skills, then upload
Install the requirements
The skill needs Python 3.8 or newer, the netflow Python library, and either NetFlow/IPFIX data from routers or a preprocessed JSON flow file. You also need authorization to analyse the traffic.
Install the library with pip:
pip install netflowHow do you trigger the skill with a natural request?
You do not need to name the skill. Describe the task in plain language and mention flow data, and the agent can pick the skill up when the request matches its description. Naming the file or the detection type you care about helps.
Good requests say what data you have and what you want checked, for example: check this flow export for port scans and unusually large outbound transfers, then write a prioritized report.
- Analyse this NetFlow v9 capture for signs of data exfiltration and summarize the top findings.
- Look at captured_flows.json and flag any hosts that look like they are beaconing on regular intervals.
- Build a baseline from this week's IPFIX export and list volumetric anomalies.
Run the analysis script
The skill's main helper script reads a flow file and writes a report. Run it from the skill folder with a flow file and an output path. The workflow in the skill also describes collecting data with the netflow library's built-in collector, which listens on a port you choose.
The script's thresholds and statistics are simple, so treat its output as a list of leads to check, not as verdicts.
python scripts/agent.py --flow-file captured_flows.json --output netflow_report.jsonParse a single NetFlow packet yourself
If you want to understand the data before trusting the agent, the skill includes a short example that parses a raw NetFlow v9 packet with the netflow library and prints source address, destination address and byte count for each flow. Templates must persist between calls for v9 and IPFIX, so keep the templates dictionary across packets.
The reference file also lists fields such as L4_DST_PORT, PROTOCOL, IN_PKTS, TCP_FLAGS, FIRST_SWITCHED and LAST_SWITCHED, which the analysis uses.
- Keep the templates dictionary between packets
- Field examples: IPV4_SRC_ADDR, L4_DST_PORT, IN_BYTES, PROTOCOL (6=TCP, 17=UDP)
import netflow
data, _ = netflow.parse_packet(raw_bytes, templates={})
for flow in data.flows:
print(flow.IPV4_SRC_ADDR, flow.IPV4_DST_ADDR, flow.IN_BYTES)Safety notes before you run it
The skill runs scripts and uses the network. Read scripts/agent.py before running it on sensitive data, and run it in a test or lab environment first if you can.
Flow records reveal user activity and may be sensitive personal data. Only analyse traffic you own or are authorized to monitor.
- The skill runs scripts (scripts/agent.py) and uses the network
- Do not use it on networks you do not own or have no authorization to monitor
- Keep exported flow data handled under your organization's data rules
What people use it for
- Reviewing a router's NetFlow export for one host hitting many ports on a server
- Checking for unusually large outbound transfers from workstations after an incident
- Looking for regular, timed connections that might indicate malware beaconing
- Learning how NetFlow fields such as bytes, packets and timestamps are structured
Frequently asked questions
How do I install the NetFlow network flow analyzer agent skill?
Download the ZIP of the skill from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps you can instead upload it under Settings → Capabilities → Skills. Install the Python netflow library with pip install netflow.
What do I need to run it?
You need Python 3.8 or newer, the netflow Python library, NetFlow/IPFIX data from routers or a preprocessed JSON flow file, and authorization to analyse the traffic. The skill also runs scripts and uses the network.
Is the NetFlow skill free to use?
The skill is published under the Apache-2.0 licence. This page does not state pricing, so check the licence and the repository for the terms that apply to your use.
Does it work with IPFIX as well as NetFlow v9?
Yes. The skill is described as parsing NetFlow v9 and IPFIX records using the Python netflow library. Templates must persist between calls for both formats.
Can I rely on the agent's findings without checking them?
No. The script's thresholds and statistics are simple, so it can produce false positives and miss attacks. Findings need analyst validation against the raw flows.
How does it compare with a dedicated flow analysis product?
This skill is guidance plus a helper script, not a finished product. It suits learning and scripted starting points; production alerting needs tuned tools and human review. This page does not benchmark it against other tools.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a SOC analyst, network engineer or student who wants a guided starting point for finding scans, large transfers and beaconing in NetFlow or IPFIX data. Pick a dedicated, tested flow analysis product if you need production alerting without manual review, and never run it on traffic you are not authorized to analyse.
Download the skill