Skip to content

README.md

Latest commit

 

History

History
90 lines (64 loc) · 2.43 KB

README.md

File metadata and controls

90 lines (64 loc) · 2.43 KB

Smart PCAP Analysis

Smart PCAP Analysis, branded in the CLI as PacketProbe, is a Python command-line tool for fast packet capture triage. It loads a .pcap file, summarizes IP activity, highlights top talkers, counts protocols, and reports packet size statistics in a clean terminal-friendly format.

PacketProbe flow

Why this project is portfolio-worthy

  • It turns raw packet captures into an approachable forensic summary.
  • It balances beginner-friendly code with enough structure to discuss design decisions.
  • It includes an example .pcap file so reviewers can run it immediately.
  • It now includes a small automated test suite for the reporting logic.

What the tool reports

  • Total packet count
  • Unique IP addresses
  • Protocol distribution for TCP, UDP, ICMP, and Other
  • Top 5 talkers by packet frequency
  • Packet size statistics

Sample CLI preview

PacketProbe terminal preview

Repository structure

smart_pcap_analysis/
|-- pcap_analyser.py
|-- auto-install_requirements.py
|-- ipv4frags.pcap
|-- requirements.txt
|-- tests/
|-- assets/
|-- README.md

Run locally

git clone https://github.com/Neth766/smart_pcap_analysis.git
cd smart_pcap_analysis
pip install -r requirements.txt
python pcap_analyser.py

To analyze a different packet capture:

python pcap_analyser.py path/to/capture.pcap

If you want a guided dependency bootstrap first:

python auto-install_requirements.py

Run tests

python -m unittest discover -s tests

How it works

  1. Load a packet capture with Scapy.
  2. Inspect each packet for IP, TCP, UDP, or ICMP layers.
  3. Count communicating addresses and protocol usage.
  4. Compute packet size statistics.
  5. Print a concise report for quick human review.

Interview talking points

  • Why packet summaries are useful before deeper packet-by-packet analysis.
  • The tradeoff between a fast CLI summary and a full-featured forensic GUI.
  • How to refactor scripts into testable functions without overengineering them.
  • How you would extend this into CSV export, graphs, or anomaly detection.

Future improvements

  • Export reports to JSON or CSV.
  • Add filter flags for protocol-specific analysis.
  • Surface conversation pairs and flows.
  • Add richer sample captures and regression tests.

License

This project is licensed under the MIT License. See LICENSE for details.