Smart Network Traffic Analyzer

A Flask-based network traffic analyzer that captures packets with Tshark, extracts DNS and TLS SNI domains, classifies app usage with multi-signal rules, detects anomalies, and visualizes insights in a modern dashboard.

What It Does

• Captures traffic from a user-selected interface (from Tshark interface list).
• Parses DNS query names and TLS SNI hostnames from a PCAP file.
• Uses multi-signal app detection with:
  • domain patterns
  • destination port hints
  • frequency-based refinement for repeated unknown domains
• Groups and classifies traffic into categories such as Streaming, Social Media, Messaging, Browsing, Shopping, Cloud/Work, and System/Infra.
• Generates behavior summaries and anomaly alerts.
• Computes a session Threat Score with Safe / Moderate / Risky levels.
• Tracks device-wise behavior summaries.
• Shows protocol distribution (HTTP, HTTPS, DNS, TCP, UDP).
• Provides live graphs (Chart.js):
  • Requests per second
  • Domains per second
  • Protocol usage over time
• Shows Top Apps Used (table + bar chart).
• Produces downloadable CSV and PDF reports.

Tech Stack

• Python 3.11+
• Flask (web backend)
• Tshark (packet capture and protocol field extraction)
• Matplotlib (bar and pie charts)
• Chart.js (live and app charts)
• ReportLab (PDF report generation)
• HTML/CSS/JavaScript (dashboard UI)

Project Structure

• app.py: Flask app, routes, capture lifecycle, history, API endpoints.
• analyzer.py: packet/domain extraction, classification, threat scoring, chart generation.
• templates/index.html: dashboard layout.
• static/style.css: UI styling.
• static/app.js: live dashboard polling and updates.
• captures/latest_capture.pcap: latest capture file.
• captures/history.json: recent run history.
• requirements.txt: Python dependencies.

Prerequisites

1. Install Python 3.11 or later.
2. Install Wireshark (includes Tshark):
   • Make sure Tshark is available in PATH, or installed in a standard location.
3. On Windows, run terminal as Administrator for packet capture access.

Installation

pip install -r requirements.txt

Run

python app.py

Open:

• http://127.0.0.1:5000

Typical Workflow

1. Select capture interface and duration (or manual stop).
2. Click Start Capture.
3. Generate traffic (open websites/apps).
4. Click Stop Capture and Analyze.
5. Review top domains/apps, categories, device behavior, threat score, alerts, and charts.
6. Optionally download CSV or PDF report.

API Endpoints

• GET /api/live: live packet/hit totals, rates, protocol stats, and top apps/domains.
• GET /api/interfaces: available capture interfaces and selected interface.

Important Limitations

• Capturing on a client Wi-Fi adapter usually shows mostly local-device traffic, not full traffic of all devices on the same Wi-Fi.
• On WPA2/WPA3 networks, per-device unicast traffic is encrypted and often not visible from another client machine.
• Domain extraction relies on DNS/TLS visibility; encrypted DNS or missing SNI can reduce visibility.
• Classification quality depends on domain rule coverage.
• Threat score and intrusion outputs are heuristic indicators, not definitive attack proof.

Troubleshooting

1) Tshark not found

• Error: tshark was not found...
• Fix: install Wireshark/Tshark and ensure PATH is correct.

2) Permission issues

• Run terminal as Administrator on Windows.

3) Corrupt capture errors

• The app now handles common partial/corrupt capture read cases more gracefully.
• Start a fresh capture if analysis data is empty or inconsistent.

4) No domains found

• Some traffic may not expose DNS/SNI fields (DoH/DoT, QUIC patterns, cache hits).
• Try longer capture duration and generate diverse web traffic.

5) PDF export not working

• Install dependencies again: pip install -r requirements.txt
• Ensure reportlab is installed in the active Python environment.

License

Educational/demo project.