https://github.com/flexidriod/packet-sniffer-security
🚀 Internet Packet Sniffer - Advanced Network Traffic Analyzer 🔍
https://github.com/flexidriod/packet-sniffer-security
cpp forensics-tools intrusion-detection network-analysis npcap-sdk packet-capture packet-sniffer windows-11
Last synced: about 1 year ago
JSON representation
🚀 Internet Packet Sniffer - Advanced Network Traffic Analyzer 🔍
- Host: GitHub
- URL: https://github.com/flexidriod/packet-sniffer-security
- Owner: FlexiDriod
- License: mit
- Created: 2025-02-09T20:42:21.000Z (about 1 year ago)
- Default Branch: main
- Last Pushed: 2025-02-09T21:59:01.000Z (about 1 year ago)
- Last Synced: 2025-04-06T01:15:34.273Z (about 1 year ago)
- Topics: cpp, forensics-tools, intrusion-detection, network-analysis, npcap-sdk, packet-capture, packet-sniffer, windows-11
- Language: C++
- Homepage:
- Size: 16.6 KB
- Stars: 3
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# 🚀 Internet Packet Sniffer - Network Traffic Analyzer
## 🌐 Overview
Internet Packet Sniffer is a powerful network traffic analyzer for Windows, built with C++. It captures live network packets, detects malicious activities, and integrates GeoIP tracking using PostgreSQL/PostGIS. This tool is designed for cybersecurity professionals to analyze DDoS attacks, port scans, TLS handshakes, and blocklisted IPs in real-time.
## 🔥 Features
✅ **Live Packet Capture** - Monitors network packets in real-time using Npcap.
✅ **DDoS & UDP Flood Detection** - Alerts when excessive traffic is detected.
✅ **Port Scan Detection** - Identifies potential reconnaissance activities.
✅ **Blocklisted IP Alerts** - Flags known malicious IP addresses.
✅ **TLS/SSL Detection** - Detects encrypted connections.
✅ **ICMP (Ping) Monitoring** - Identifies ping scans and network probing.
✅ **GeoIP Lookup** - Determines the geographical location of IPs.
✅ **JSON Logging** - Stores alerts for post-analysis.
✅ **Portable & Lightweight** - Runs efficiently without additional dependencies.
---
## 🛠 Installation
### **Prerequisites**
- **Windows 10/11 (64-bit)**
- **Npcap** (for packet capturing)
- **PostgreSQL + PostGIS** *(optional, for GeoIP lookup)*
- **C++ Compiler** *(Clang64, MSVC, or MinGW)*
### **Step 1: Install Dependencies**
1. Install **Npcap** (Ensure *"WinPcap API-compatible mode"* is checked).
2. Install **PostgreSQL** and **PostGIS** (if using GeoIP detection).
3. Set PostgreSQL password as an environment variable:
```cmd
setx PG_PASSWORD "your_database_password"
```
### **Step 2: Setup the GeoIP Database (Optional but Recommended)**
If you want GeoIP tracking, you need to:
1. **Download** GeoLite2 databases (City, Country, ASN) from [MaxMind](https://dev.maxmind.com/geoip/geolite2-free-geolocation-data).
2. **Create a PostgreSQL database and tables**:
```sql
CREATE DATABASE geoip;
\c geoip;
CREATE EXTENSION postgis;
CREATE TABLE geoip_city (
network CIDR PRIMARY KEY,
geoname_id INT,
registered_country_geoname_id INT,
represented_country_geoname_id INT,
is_anonymous_proxy BOOLEAN,
is_satellite_provider BOOLEAN
);
CREATE TABLE geoip_asn (
network CIDR PRIMARY KEY,
autonomous_system_number INT,
autonomous_system_organization TEXT
);
CREATE TABLE geoname_location (
geoname_id INT PRIMARY KEY,
locale_code TEXT,
continent_name TEXT,
country_name TEXT,
subdivision_name TEXT,
city_name TEXT,
metro_code INT,
time_zone TEXT
);
```
3. **Import GeoIP data** from CSV files into the respective tables.
### **Step 3: Clone and Build**
```cmd
git clone https://github.com/yourusername/internet-packet-sniffer.git
cd internet-packet-sniffer
mkdir build && cd build
cmake ..
cmake --build .
```
---
## 🎯 Usage
Run the application with administrator privileges:
```cmd
./packet_sniffer.exe
```
Example output:
```log
[INFO] IP Layer:
Src IP: 192.168.1.10 (United States) -> Dest IP: 192.168.1.1
[ALERT] 🚨 Possible DDoS from: 203.0.113.5 (Packets: 105)
```
---
## 🌟 Alert System
| Alert Type | Severity | Description |
|-----------------|-----------|---------------------------------------|
| DDoS Attack | 🔴 Critical | High packet rate detected |
| UDP Flood | 🔴 High | Unusual UDP packet burst |
| Port Scan | 🟠 Medium | Multiple connection attempts detected |
| Blocklisted IP | 🔴 Critical | Malicious IP detected |
| TLS Handshake | 🟡 Medium | Encrypted connection detected |
| ICMP Ping Scan | 🟡 Low | Possible reconnaissance |
---
## 📂 Log Files
- **Security Alerts** - Stored in JSON format.
- **Packet Captures** - Saved in `Packet_Captures/` with timestamps.
---
## 🛡 Security Considerations
- Run with **admin privileges** to capture all packets.
- Use a **secure PostgreSQL connection** for GeoIP queries.
---
## 🚀 Future Enhancements
- 📌 **GUI Support** (for better user experience)
- 📌 **More Protocol Analysis** (HTTP, DNS, etc.)
- 📌 **Machine Learning-based Intrusion Detection**
---
## 🤝 Contributing
Want to improve this project? Contributions are welcome!
1. Fork the repository.
2. Create a new branch:
```cmd
git checkout -b feature-branch
```
3. Commit your changes:
```cmd
git commit -m 'Add new feature'
```
4. Push to the branch:
```cmd
git push origin feature-branch
```
5. Create a Pull Request.
---
## 🐝 License
This project is licensed under the **MIT License**.
---
## ❤️ Support & Feedback
🌟 **Star this repo** if you found it useful!
🐛 **Report issues** via GitHub Issues.
🤝 **Join discussions** in the community.
---
🚀 **Internet Packet Sniffer - Empowering Cybersecurity Enthusiasts!** 🔥