Basic Network Sniffer

An educational Python/Scapy program that captures packets visible to your computer and displays their timestamp, source and destination addresses, protocol, ports or ICMP fields, and a short printable payload preview.

Only capture traffic on networks and devices you own or have explicit permission to inspect. Payloads can contain private information. Modern HTTPS payloads are encrypted, so their content will usually be unreadable.

Windows setup

1. Install Python 3.10 or newer.

2. Install Npcap with its WinPcap-compatible API option enabled.

3. Open PowerShell as Administrator in this folder.

4. Install the dependency:

   python -m pip install -r requirements.txt

5. Start a short capture:

   python network_sniffer.py --count 20

On Linux/macOS, install the requirements and run with sudo if capture permissions require it.

Useful commands

# Show available network interfaces
python network_sniffer.py --list-interfaces

# Capture for 15 seconds on a selected interface
python network_sniffer.py --interface "Wi-Fi" --timeout 15

# Show only DNS traffic
python network_sniffer.py --filter "udp port 53" --count 20

# Save packets for later analysis in Wireshark
python network_sniffer.py --count 100 --write capture.pcap

# Run the tests (no live capture required)
python -m unittest -v

Filters use Berkeley Packet Filter syntax and require Npcap/libpcap. Examples include tcp, udp port 53, host 192.168.1.10, and not port 22.

What the output means

• ARP maps local IPv4 addresses to hardware addresses.
• IP/IPv6 carries packets between addresses.
• TCP provides an ordered, reliable byte stream; ports identify applications and flags show connection state.
• UDP sends independent datagrams without TCP's delivery guarantees.
• DNS commonly translates domain names to IP addresses.
• ICMP carries diagnostics and errors, including ping messages.
• Payload is application data after protocol headers. This tool replaces non-printable bytes with dots and limits the preview length.

This project was developed as part of my internship tasks at #CodeAlpha.The program only observes packets delivered to the selected interface. On a switched network, it normally cannot see unrelated devices' unicast traffic.