Network Traffic Analyzer

🏆 1st Place — CNSA SYNthesis Hackathon (Network Analysis Track)

A Python-based network security analysis platform that processes packet captures (PCAP/PCAPNG) to inspect network behavior, detect suspicious activity, and provide security insights through an interactive web dashboard.

Built with Python, Scapy, and Flask, this project combines low-level packet inspection with security-focused detection techniques to analyze network traffic and identify potential threats.

---

Overview

The Network Traffic Analyzer transforms raw packet capture files into structured security information.

The system analyzes packets and reconstructed network streams to identify:

• Network communication patterns
• TCP/IP endpoint relationships
• SYN flood attacks
• Suspicious executable transfers
• Plaintext credential exposure

Users can upload .pcap or .pcapng files through the web dashboard and receive:

• Packet summaries
• Source/destination analysis
• Protocol information
• Security alerts
• Extracted evidence from suspicious traffic

---

Features

📡 Packet-Level Network Analysis

The analyzer processes packet captures using Scapy to extract network metadata.

Extracted information includes:

• Source IP addresses
• Destination IP addresses
• Protocol types
• Packet timestamps
• Network endpoints
• Connection relationships

Supported traffic analysis:

• TCP
• UDP
• ICMP
• HTTP

---

🛡️ Security Detection

SYN Flood Detection

The analyzer detects potential denial-of-service activity by analyzing TCP SYN request patterns.

Detection process:

1. Parse TCP packets from captured traffic
2. Identify SYN packets without completed ACK responses
3. Count SYN requests by source IP
4. Flag sources generating abnormal connection attempts

Example:

[SCAN DETECTED] 192.168.1.10 sent 150 SYNs

---

Executable Transfer Detection

The analyzer detects executable files transferred through captured network traffic.

Implementation:

• Reconstructs TCP streams
• Collects payload data
• Searches for executable signatures

Detection signatures:

MZ Header
PE Header

These signatures identify Windows Portable Executable (PE) files transferred through network streams.

Example alert:

Executable Detected

Source:
192.168.1.10:443

Destination:
10.0.0.5:50234

File:
malware.exe

---

Plaintext Credential Detection

The analyzer scans packet payloads for credentials transmitted through insecure protocols.

Detection targets:

• HTTP
• FTP
• Telnet

The system searches packet payloads for credential indicators such as:

USER
PASS

Example:

ALERT R-001: Plaintext Credentials

Source:
192.168.1.20

Destination:
192.168.1.50

Evidence:
USER admin
PASS password123

---

Web Dashboard

The project includes a Flask-based dashboard for uploading packet captures and viewing analysis results.

Dashboard features:

Endpoint Analysis

Displays:

• Packet timestamps
• Source addresses
• Destination addresses
• Protocol information

Security Alerts

Displays:

• Threat category
• Severity level
• Detection details
• Extracted evidence

---

Architecture

                 User
                  |
                  |
          Upload PCAP File
                  |
                  v
          Flask Web Server
                  |
        ---------------------
        |                   |
        v                   v
 Packet Analyzer      Security Engine
    (Scapy)          (Detection Rules)

        |                   |
        ---------------------
                  |
                  v

          Interactive Dashboard

        - Network Endpoints
        - Protocol Analysis
        - Security Alerts

---

Tech Stack

Backend

• Python
• Flask
• Scapy

Frontend

• HTML
• Bootstrap 5
• Jinja Templates

Networking

• TCP/IP Analysis
• PCAP Processing
• Packet Inspection
• Stream Reconstruction
• Security Pattern Detection

---

Installation

Clone Repository

git clone https://github.com/anthla-dev/network-traffic-analyzer.git

cd network-traffic-analyzer

Install Dependencies

pip install -r requirements.txt

---

Usage

Start Web Dashboard

Run:

python interface.py

Open:

http://127.0.0.1:5000

---

Analyze Traffic

1. Upload a packet capture file:

Supported formats:

.pcap
.pcapng

2. The analyzer processes the capture.

3. Review:

• Packet information
• Network endpoints
• Security detections
• Evidence reports

---

Project Structure

network-traffic-analyzer/

├── interface.py              # Flask web application
├── endpoints.py              # Packet metadata extraction
├── detect_exe.py             # Executable transfer detection
├── security_scan.py          # Security rule scanning
├── templates/
│   └── index.html            # Dashboard interface
├── uploads/                  # Uploaded packet captures
├── requirements.txt
└── README.md

---

Future Improvements

• Real-time packet capture support
• Machine learning anomaly detection
• Expanded intrusion detection rules
• Automated threat intelligence integration
• Network traffic visualization
• Exportable security reports

---

Recognition

🏆 1st Place — CNSA SYNthesis Hackathon
Network Analysis Track

---

License

This project is for educational and research purposes.