An advanced, security-focused network traffic analysis tool designed for system administrators, cybersecurity professionals, and network engineers. The xsukax PCAP Analyzer provides comprehensive insights into network behavior while maintaining strong privacy protections and offering advanced threat detection capabilities.
The xsukax PCAP Network Traffic Analyzer is a powerful command-line tool that performs deep analysis of network packet capture files (PCAP format). Built with Python and the Scapy library, it extracts valuable network intelligence including protocol distributions, communication patterns, DNS activities, and security threats. The tool generates detailed reports in multiple formats to support various operational workflows and incident response activities.
Core Capabilities:
- Multi-Layer Protocol Analysis: Comprehensive examination of network protocols from Layer 2 through Layer 7
- Advanced DNS Intelligence: Deep DNS query analysis with sophisticated threat detection algorithms
- Real-time Security Monitoring: Automated identification of suspicious activities, port scans, and potential threats
- Comprehensive Traffic Profiling: Detailed conversation tracking, bandwidth analysis, and communication pattern mapping
- Flexible Multi-Format Reporting: Export capabilities for JSON, HTML, Markdown, and CSV formats
Target Use Cases:
- Network security assessment and monitoring
- Incident response and forensic analysis
- Network performance optimization
- Compliance reporting and documentation
- Threat hunting and behavioral analysis
- Complete Local Processing: All analysis operations are performed locally on your system with zero data transmission to external services
- Memory-Only Operations: Sensitive network data is processed in memory without persistent storage beyond the analysis session
- No External Dependencies: Analysis functions independently without requiring internet connectivity or cloud services
- Configurable Privacy Controls: Four distinct analysis levels allow granular control over inspection depth based on privacy requirements
-
Multi-Vector Threat Identification:
- Automated port scan detection with configurable thresholds
- DNS-based threat detection including tunneling attempts
- Malformed packet identification for potential attack detection
- Behavioral anomaly detection for unusual communication patterns
-
DNS Security Analytics:
- Detection of suspicious top-level domains (.tk, .ml, .ga, .cf, .bit, .onion)
- Identification of abnormally long domain names indicative of data exfiltration
- DNS tunneling detection through query pattern analysis
- NXDOMAIN response tracking for reconnaissance detection
- Comprehensive DNS server mapping and analysis
-
Network Behavior Analysis:
- Service fingerprinting for unauthorized service detection
- Communication flow analysis for lateral movement detection
- Protocol anomaly detection for protocol abuse identification
- Traffic volume analysis for data exfiltration detection
- Minimal Data Exposure: Reports are designed to include only operationally necessary information
- Built-in Anonymization Support: IP addresses and sensitive identifiers can be easily redacted from reports
- Secure Local Export: All report formats are generated locally without external API calls or cloud dependencies
- User-Controlled Data Retention: No automatic data persistence beyond user-specified output files
- Protocol Support Matrix: TCP, UDP, ICMP, IPv4/IPv6, ARP, DNS, HTTP/HTTPS analysis
- Advanced Conversation Tracking: Bidirectional communication flow analysis with protocol identification
- Statistical Analysis Suite: Packet size distribution, timing analysis, and volume statistics
- Service Discovery Engine: Automatic identification of network services and usage patterns across 25+ common protocols
- HTTP/HTTPS Traffic Analysis: Method tracking, status code analysis, and host identification
- Multi-Level Analysis Modes:
- Basic: Essential protocol statistics with fundamental threat detection
- Standard: Comprehensive analysis with moderate detail level (recommended default)
- Deep: Extended analysis including advanced behavioral pattern recognition
- Forensic: Maximum detail extraction for incident response and forensic investigations
- JSON Export: Machine-readable format optimized for SIEM integration and automated processing
- Interactive HTML Reports: Rich visualizations with Chart.js integration for executive presentations
- Markdown Documentation: Professional documentation format ideal for sharing technical findings
- CSV Data Exports: Structured datasets for spreadsheet analysis and further data processing
- Batch Processing Support: Efficient handling of multiple PCAP files with consistent output formatting
- Memory-Efficient Processing: Optimized algorithms for handling large PCAP files without excessive resource consumption
- Real-time Progress Tracking: Detailed progress indication for long-running analysis operations
- Concurrent Analysis Support: Capability to process multiple files simultaneously
- Incremental Processing: Support for streaming analysis of large datasets
- Zero-Configuration Setup: Ready to use immediately after dependency installation
- Minimal External Dependencies: Only requires Python and Scapy for full functionality
- Cross-Platform Compatibility: Consistent operation across Linux, macOS, and Windows
- Professional-Grade Output: Report formats suitable for executive briefings and technical documentation
- Python: Version 3.7 or higher
- Memory: Minimum 2GB RAM (8GB+ recommended for large PCAP files)
- Storage: Varies based on PCAP file sizes and output format selection
- Privileges: Administrator/root access required for some advanced Scapy operations
# Clone the repository
git clone https://github.com/xsukax/xsukax-PCAP-Network-Traffic-Analyzer.git
cd xsukax-PCAP-Network-Traffic-Analyzer
# Verify Python version
python3 --version # Should be 3.7+# Core dependency installation
pip install scapy
# Optional: Enhanced functionality packages
pip install matplotlib plotly # For advanced visualizations
pip install pandas # For enhanced data processing# Test basic functionality
python pcap_analyzer.py --help
# Verify Scapy installation
python -c "from scapy.all import *; print('Scapy installation verified')"# Install additional dependencies for optimal performance
sudo apt-get update
sudo apt-get install python3-dev libpcap-dev
# Grant necessary permissions (alternative to running as root)
sudo setcap cap_net_raw=eip /usr/bin/python3# Install via Homebrew (recommended)
brew install libpcap
# Alternative: Install via MacPorts
sudo port install libpcap +universal# Install Npcap (recommended) - Download from https://nmap.org/npcap/
# Or install WinPcap as alternative
# Install Python dependencies
pip install scapy pywin32# Build the container
docker build -t xsukax-pcap-analyzer .
# Run analysis with volume mounting
docker run -v /path/to/pcaps:/data -v /path/to/output:/output \
xsukax-pcap-analyzer /data/capture.pcap --output-dir /output
# Interactive container for multiple analyses
docker run -it -v /path/to/pcaps:/data xsukax-pcap-analyzer bash# Create isolated environment
python3 -m venv xsukax-analyzer
source xsukax-analyzer/bin/activate # Linux/macOS
# or
xsukax-analyzer\Scripts\activate # Windows
# Install dependencies in isolated environment
pip install scapy# Standard analysis with default settings
python pcap_analyzer.py network_capture.pcap
# Specify custom output format
python pcap_analyzer.py capture.pcap --output html
# Configure analysis depth
python pcap_analyzer.py capture.pcap --level forensic# Generate comprehensive report suite
python pcap_analyzer.py capture.pcap --output all --output-dir ./investigation
# High-detail forensic analysis
python pcap_analyzer.py suspicious.pcap --level forensic --output html --output-dir ./case-2024-001
# Batch processing for multiple files
for file in *.pcap; do
python pcap_analyzer.py "$file" --output json --output-dir ./batch_results
donepositional arguments:
pcap_file Path to PCAP file for analysis
optional arguments:
-h, --help Show detailed help message and exit
-o, --output Output format selection (default: markdown)
Choices: json, html, markdown, csv, all
-d, --output-dir Output directory specification (default: current directory)
-l, --level Analysis depth configuration (default: standard)
Choices: basic, standard, deep, forensic
graph TD
A[PCAP File Input] --> B[Packet Loading & Validation]
B --> C[Multi-Layer Protocol Analysis]
C --> D[Layer 2: Ethernet Frame Analysis]
C --> E[Layer 3: Network Protocol Analysis]
C --> F[Layer 4: Transport Protocol Analysis]
C --> G[Layer 7: Application Protocol Analysis]
D --> H[Statistics Aggregation Engine]
E --> H
F --> H
G --> H
H --> I[Advanced Threat Detection]
I --> J[Port Scan Detection Algorithm]
I --> K[DNS Security Analysis]
I --> L[Behavioral Pattern Analysis]
I --> M[Malformed Packet Detection]
J --> N[Comprehensive Report Generation]
K --> N
L --> N
M --> N
N --> O[JSON Export]
N --> P[Interactive HTML Report]
N --> Q[Technical Markdown Report]
N --> R[Structured CSV Datasets]
graph LR
A[DNS Packet Stream] --> B{Packet Classification}
B -->|DNS Query| C[Domain Extraction & Parsing]
B -->|DNS Response| D[Response Code Analysis]
C --> E[Suspicious Pattern Detection]
C --> F[Domain Length Analysis]
C --> G[TLD Security Classification]
C --> H[Character Pattern Analysis]
E --> I[Threat Intelligence Database]
F --> I
G --> I
H --> I
D --> J[Response Pattern Analysis]
J --> K[NXDOMAIN Tracking]
J --> L[Resolution Time Analysis]
I --> M[Security Threat Report]
K --> M
L --> M
M --> N[Threat Scoring & Prioritization]
N --> O[Final Security Assessment]
graph TB
A[Network Traffic Analysis] --> B[Multi-Vector Threat Detection]
B --> C[Port Scan Detection]
B --> D[DNS Threat Analysis]
B --> E[Protocol Anomaly Detection]
B --> F[Behavioral Analysis]
C --> G[Connection Pattern Analysis]
C --> H[Port Access Frequency]
C --> I[Scan Velocity Calculation]
D --> J[Domain Reputation Check]
D --> K[DNS Tunneling Detection]
D --> L[Query Pattern Analysis]
E --> M[Protocol Violation Detection]
E --> N[Malformed Packet Analysis]
F --> O[Communication Flow Analysis]
F --> P[Volume Anomaly Detection]
G --> Q[Threat Severity Scoring]
H --> Q
I --> Q
J --> Q
K --> Q
L --> Q
M --> Q
N --> Q
O --> Q
P --> Q
Q --> R[Prioritized Threat Report]
- Total Packets: Complete count of analyzed network packets
- Data Volume: Total bytes processed with bandwidth calculations
- Network Scope: Number of unique IP addresses and communication pairs
- Security Status: Count and severity of identified threats
- Service Coverage: Number of detected network services and protocols
- Query Distribution: Comprehensive ranking of most frequently requested domains
- Threat Indicators: Domains matching suspicious patterns or known threat signatures
- Resolution Failures: NXDOMAIN responses indicating potential reconnaissance activities
- Server Analysis: Identification and analysis of DNS infrastructure
- Query Type Distribution: Breakdown of DNS record types requested (A, AAAA, MX, TXT, etc.)
- Port Scan Detection: Systematic identification of port scanning activities with source attribution
- DNS-Based Threats: Advanced detection of DNS tunneling, domain generation algorithms, and malicious domains
- Protocol Violations: Detection of malformed packets and protocol abuse attempts
- Behavioral Anomalies: Identification of unusual communication patterns indicating potential compromise
============================================================
PCAP Analysis: network_traffic_sample.pcap
Level: STANDARD
============================================================
Loading packets...
Loaded 127,449 packets
Processed 5,000/127,449 packets...
Processed 25,000/127,449 packets...
Processed 50,000/127,449 packets...
Processed 100,000/127,449 packets...
Analysis completed in 28.74s
============================================================
ANALYSIS SUMMARY
============================================================
Statistics:
Packets: 127,449
Bytes: 189,234,567
Bandwidth: 24.7 Mbps
IPs: 342
Conversations: 156
DNS:
Queries: 8,934
Domains: 1,247
Suspicious: 7
NXDOMAIN: 23
Security:
Port Scan: 10.0.1.15 accessed 47 ports
Suspicious DNS: Domain: ad7f923kj.tk
DNS Tunneling: 12 abnormally long queries
Malformed Packets: 3 malformed packets detected
============================================================
The generated reports provide multi-layered analysis results:
Executive Level: High-level statistics and threat summaries suitable for management briefings Technical Level: Detailed protocol analysis, conversation tracking, and service identification Security Level: Comprehensive threat detection results with actionable intelligence Forensic Level: Granular packet-level analysis for incident response activities
This project is licensed under the GNU General Public License v3.0 (GPL-3.0).
The GPL-3.0 license ensures that the xsukax PCAP Network Traffic Analyzer remains free and open source while providing comprehensive rights and responsibilities for users and contributors.
- Unrestricted Use: Deploy the software for any purpose, including commercial network security operations
- Source Code Access: Complete access to source code for security auditing and customization
- Modification Rights: Full freedom to adapt and enhance the software for specific requirements
- Distribution Freedom: Ability to share the software and improvements with the community
- Copyleft Compliance: Modified versions must be distributed under GPL-3.0 with source code access
- Attribution Requirements: Original copyright notices and license information must be preserved
- Patent Grant: Users receive explicit patent rights for any patents covering the software
- Derivative Work Licensing: All derivative works must be licensed under compatible terms
- Commercial Deployment: Full permission for commercial use without licensing fees or royalties
- Redistribution Requirements: Organizations distributing the software must provide source code access
- Integration Considerations: Carefully evaluate GPL-3.0 implications when integrating with proprietary systems
- Compliance Support: Detailed compliance guidance available for enterprise deployments
- License Compatibility: All contributions will be licensed under GPL-3.0 terms
- Rights Confirmation: Contributors must confirm legal authority to license their contributions
- Copyright Retention: Individual contributors retain copyright ownership of their specific contributions
- Community Standards: All contributions must adhere to project coding standards and security practices
The GPL-3.0 license choice reflects our commitment to:
- Transparency: Complete source code visibility for security auditing
- Community Security: Collaborative identification and resolution of security vulnerabilities
- Trust Building: Open development process that builds user confidence
- Long-term Availability: Protection against proprietary capture or abandonment
For the complete license text and legal requirements, see the LICENSE file in this repository or visit https://www.gnu.org/licenses/gpl-3.0.html.
xsukax PCAP Network Traffic Analyzer - Advanced network security analysis with privacy protection and comprehensive threat detection capabilities.