Small offices and labs have no network monitoring. Slowdowns get blamed on the internet provider, and a machine probing the network can go unnoticed for weeks.
Objectives
Turn raw packets into a readable picture
Find the hosts using the most bandwidth
Flag port scans and unusual spikes
Recommend concrete fixes
Process
DiscoverListed the questions admins ask: who, how much, and is anything wrong.
DefineGroup packets by protocol, host and port; set a port-scan threshold.
BuildPacket parsing with Scapy, analysis with pandas, charts with Matplotlib.
ProveChecked results against Wireshark on the same captures.
Who it's for
Network admins
See top talkers and protocol mix at a glance.
Security
Get alerted when one host touches too many ports.
Challenges
Captures are large and noisy
Scans look like normal traffic packet by packet
Alerts must be specific enough to act on
What we built
Traffic breakdown
By protocol, source, destination and port, with total bandwidth.
Top talkers
The hosts sending and receiving the most.
Port-scan detection
Flags a source that reaches more distinct ports than the threshold.
Recommendations
Each alert comes with a suggested fix.
Flow
Packet capture
Parse with Scapy
Group by protocol and host
Bandwidth and top talkers
Port-scan check
Alerts
Recommendations
Tools & languages
Python
Scapy
pandas
Matplotlib
Wireshark (validation)
The code
The analyzer script: packet parsing, protocol and host analysis, port-scan detection and charts.
Merciven