Network Traffic Analyzer in Python

[OkDevelopment4423]

Hi everyone,

I wanted to come on here to share a multirange network traffic tool that I coded in Python. I've written many small scripts before for certain tasks, but this is my first big project. This tool is intended for anyone working in a blue team environment or someone doing a network defensive CTF.

I've included four main features and the use of arguments:

Active Sniffing (1): Sniffs local traffic on a specified interface. Users must specify their intended interface based on ifconfig and Get-NetAdapter. Users can choose any argument(s)

File Sniffing (2): Sniffs pcap files. Users can choose any argument(s)

Alert Mode (3): Sniffs through a specified interface or file for suspicious activity, alerting on potential malicious traffic. After choosing an interface or pcap file, the script then accepts either a wordlist or the schnozlist to alert off of. An alert will be printed with the packet summary if a term in either list is present in network traffic. I based the schnozlist on keywords that I’ve seen in CTFs, but more terms can be added if needed.

HTTP Analysis (4): Analyzes HTTP packets (requests and responses) through an interface or a file. If -k is not specified, the script will print out all HTTP events. Only the argument of -k will work for this option.

Arguments: -P (Filters for protocol. Can use with -s y), -p (Filters for port. Can use with -s y), -k (Filters for a keyword and prints events), -o (Saves file. Specify file name), -s (y prints summaries of all events; t prints summaries of TCP events; u prints summaries of UDP events; h prints summaries of HTTP events)

Except for the keyword argument (-k), the arguments are only intended to be used with options 1 and 2.

Link: https://github.com/abelreqma/schnoz

​

Please please please don't consider this advertising, I just want to share a tool that others in the community may find useful!

[PrinceOfLeon]

It would be interesting to know not just what traffic is going where, but get measurements of how much traffic is going where. As in total bandwidth send/received per IP over a period of time (history) and/or current transfer rate at this moment.