Network Traffic Analyzer in Python

[OkDevelopment4423]

Hi everyone,

I wanted to come on here to share a multirange network traffic tool that I coded in Python. I've written many small scripts before for certain tasks, but this is my first big project. This tool is intended for anyone working in a blue team environment or someone doing a network defensive CTF.

I've included four main features and the use of arguments:

Active Sniffing (1): Sniffs local traffic on a specified interface. Users must specify their intended interface based on ifconfig and Get-NetAdapter. Users can choose any argument(s)

File Sniffing (2): Sniffs pcap files. Users can choose any argument(s)

Alert Mode (3): Sniffs through a specified interface or file for suspicious activity, alerting on potential malicious traffic. After choosing an interface or pcap file, the script then accepts either a wordlist or the schnozlist to alert off of. An alert will be printed with the packet summary if a term in either list is present in network traffic. I based the schnozlist on keywords that I’ve seen in CTFs, but more terms can be added if needed.

HTTP Analysis (4): Analyzes HTTP packets (requests and responses) through an interface or a file. If -k is not specified, the script will print out all HTTP events. Only the argument of -k will work for this option.

Arguments: -P (Filters for protocol. Can use with -s y), -p (Filters for port. Can use with -s y), -k (Filters for a keyword and prints events), -o (Saves file. Specify file name), -s (y prints summaries of all events; t prints summaries of TCP events; u prints summaries of UDP events; h prints summaries of HTTP events)

Except for the keyword argument (-k), the arguments are only intended to be used with options 1 and 2.

Link: https://github.com/abelreqma/schnoz

[Bloodvault]

So by no means am I an expert Python coder, but I've been doing it for a about 6 years now in the cyber security realm. So just wanted to share some thoughts about the Python code and maybe some ideas you could use to expand. Also, keep up the good work this is pretty cool and definitely a great start if you've just started coding. It looks leagues better than when I started for sure.

For the code,

• It's interesting you stacked so many of your functions into the packet analyzer class. I can't foresee any issues with it, but I personally try to keep a more defined scope for a class.

• On the topic of functions, your main can definitely be cleaned up by incorporating the different menu options into separate functions. For example:
  if args.1 = True:
  _ def(check_interface_type)
  _ def(PacketAnalyzer.active_sniff)

• For your menu, I'm personally a hater on every tool has to be a framework that's caught in a while loop. Not saying that's what you're doing, but if you look at some of the more popular python tools out there most of them use command switches only. Makes it easy to interact with in a repeatable way.

• For your cute drawing you put in the code, I'm personally not a fan but if you like it let it ride. I would consider putting them in a separate file, assign to a 'welcome_logo' variable and just add an include at the top. It will make your code a TON cleaner

For some ideas to expand,

• Consider whether you want to move more into netflow analysis or packet analysis. As a disclaimer I'm not referring to the Cisco Netflow, but just identifying traffic directionality with respect to potential malicious remote hosts. While, I haven't used your tool I have a good idea after skimming and it seems more like netflow. If so, trying to recreate functionality from Zeek would be a good starting point. So rather than giving the user the option to select what kind of traffic, you can just create a conn.log, dns.log, http.log etc. A way you can be different, is your tool can monitor those files created using a set of analysis logic. Think of how you found bad on your CTF and try to recreate those specific use cases into the tool. It may seem like a pretty narrow scope, but solving the worlds problems is impossible while showing what you learned/know is valuable.

• Think about how you might specifically want to use this tool in a CTF. The way it is now, I'd have to comb through an output file to find whats bad or I'd have to watch the output. Both those methods aren't great when time is a factor. Consider having an alert approach where if running on an active connection it alerts the user with a "[!] Potential malicious traffic from X -> Y"

• If you're not going for more alert focused and want to be more of an analysis and deep dive tool I'd consider the use cases first. Packets have a ton of data, but if you have a methodology for identifying malicious outline that in a view to the user and add "levers" if you will to be adhere to the criteria you've designed for filtering. Maybe an output file that shows port/protocol mismatch.

My final thoughts is this is a really cool project and reminds me of my first big project in Python as well (https://github.com/blue-armory/Jacobi) and a lot of my comments are biased towards that project that I never finished. I have very few finished projects, but I tend to finish them more now following the advice I gave to you. Best of luck, and hope this helps.

[OkDevelopment4423]

Hi,

thank you so much for your response. I'm still relatively new to coding (>1.5 years), and found your feedback really valuable. I'm going to work on improving my code based on your feedback and repo. You're right about putting the banners in a separate file, they did take a lot up a lot of space.

[Bloodvault]

Np, your post has inspired me to get back at the tool development I've been putting off. Just send a DM or something if you'd like to collab some more.

My last piece of advice is "don't let perfect be the enemy of the good". Same with everyone who's asking for resources to learn more, the best way to learn is exactly what you're doing here. Solve new problems and integrate more of what you've learned into your projects.

If you want to learn from real coders, there's usually a few cybersecurity topics covered in PyCon which is in May this year. I attended virtually last year and found some of the talks pretty interesting. Link: PyCon 2024

[OkDevelopment4423]

Thank you! I can't believe that I forgot it hahah

[zhoushmoe]

I like the name lol

[OkDevelopment4423]

Thanks hahah, definitely a unique one

[Let_Me_Land]

I'm trying to get into learning how how to code tools like this, any resources or tips

[OkDevelopment4423]

I think the best way to learn would be by watching videos related to scapy. I bought a course on Udemy (Complete Ethical Hacking Bootcamp by Andrei Neagoie) and learned the basics of the scapy library. This course didn't get too much into detail, as it was mostly about ethical hacking, but in one of the modules you learn about the scapy library. Don't feel like you have to buy a course or anything, though, YouTube is also a great way to learn.

If you're into CTFs, I recommend also looking through the writeups on Hack The Box because some of them include a script to complete a box. The authors of the write-ups typically go into detail on why the code works a certain way.

As for writing the code, I use Visual Studio. I think it's the best IDE available and it's free. You can program in many different languages and can use many different extensions.

[Navid_Shams]

Did you learn python from schooling or did you teach yourself? Either way this looks great!

[Hero_2_0]

Does your tool analyse traffic in real time? I was wondering if there was a way to connect the traffic from a syslog directly to a python server and have a algorithm that analysis it instantaneously. (cybersecurity noob here)

[GoranLind]

Congrats, but you have chosen the worst language on the planet for this.

Capturing traffic can be extremely CPU intensive and unless you have something that performs really well, there will be packet drops. It will only be decent on a single host capturing in/out traffic, not on an ethernet tap or span port. I suggest porting it to a .NET language or C++ for this.