Table of Contents

Network Traffic Analyzer

Platform Requirements

Features

Core Functionality
Analysis & Reporting
Security Relevance

Architecture
Quick Start
Project Structure
Development
Source Code

Network Traffic Analyzer

Real-time packet capture and analysis tool with protocol identification, bandwidth tracking, and visualization.

Overview

A Python-based packet capture and analysis tool that sniffs network traffic in real time, identifies protocols, tracks bandwidth usage, and generates visual reports. Uses a producer-consumer threading pattern for wire-speed capture without dropping packets.

Status: Complete | Difficulty: Beginner

Legal Disclaimer

This tool is for authorized network analysis only. Only capture traffic on networks you own or have explicit permission to monitor. Unauthorized packet capture is illegal.

Tech Stack

Technology	Version	Purpose
Python	3.14+	Modern syntax
Scapy	-	Packet capture and dissection
Rich	-	Real-time terminal dashboards
Matplotlib	-	Protocol charts, bandwidth timelines
Typer	-	CLI framework

Platform Requirements

Root/admin access required for packet capture
Linux: root or CAP_NET_RAW capability
macOS: root or /dev/bpf access
Windows: Administrator + Npcap installed

Features

Core Functionality

Real-time packet capture with BPF kernel-level filtering
Protocol identification across Layers 2-7
Active interface discovery
Top talker analysis by traffic volume
Bandwidth sampling at configurable intervals

Analysis & Reporting

Protocol distribution pie charts
Bandwidth timeline graphs
Top talker bar charts
JSON/CSV data export
PCAP file analysis

Security Relevance

Network baseline establishment for anomaly detection
Data exfiltration detection
DDoS traffic identification
Incident response packet analysis

Architecture

┌─────────────────────────────────────────────┐
│         Producer Thread (capture.py)         │
│  Scapy sniff() → BPF filter → Queue         │
└──────────────────────┬──────────────────────┘
                       │ Thread-safe Queue
┌──────────────────────▼──────────────────────┐
│         Consumer Thread (analyzer.py)        │
│  Protocol ID → Statistics → Export           │
└──────────────────────┬──────────────────────┘
                       │
         ┌─────────────┼─────────────┐
         ▼             ▼             ▼
┌─────────────┐ ┌───────────┐ ┌───────────┐
│ statistics  │ │  output   │ │ visualize │
│ Thread-safe │ │  Rich     │ │ Matplotlib│
│ collector   │ │  console  │ │  charts   │
└─────────────┘ └───────────┘ └───────────┘

Quick Start

cd PROJECTS/beginner/network-traffic-analyzer

# Install dependencies
uv sync

# List available interfaces
sudo uv run netanal interfaces

# Capture 50 packets on loopback
sudo uv run netanal capture -i lo -c 50 --verbose

# Analyze an existing pcap file
uv run netanal analyze traffic.pcap --top-talkers 20

# Generate charts
uv run netanal chart traffic.pcap --type all -d ./charts/

Project Structure

network-traffic-analyzer/
├── src/netanal/
│   ├── capture.py        # Producer-consumer packet capture engine
│   ├── analyzer.py       # Protocol identification and parsing
│   ├── filters.py        # BPF filter builder with validation
│   ├── statistics.py     # Thread-safe stats collector
│   ├── models.py         # Data structures (PacketInfo, Protocol enum)
│   ├── visualization.py  # Matplotlib chart generation
│   ├── export.py         # JSON/CSV export
│   ├── output.py         # Rich console formatting
│   ├── main.py           # Typer CLI commands
│   ├── constants.py      # Configuration values
│   └── exceptions.py     # Custom exception hierarchy
├── tests/
└── pyproject.toml

Development

# Run tests
uv run pytest tests/ -v

# Linting
uv run ruff check .

# Format
uv run ruff format .

Source Code

View on GitHub

Home

Beginner Projects

Intermediate Projects

Advanced Projects

Guides

Resources

Progress: 14/60