Skip to content

README.md

Latest commit

 

History

History
153 lines (102 loc) · 3.79 KB

README.md

File metadata and controls

153 lines (102 loc) · 3.79 KB

CodeAVS

Real-Time Network Analyzer using Python and Wireshark

This project leverages Software-Defined Networking (SDN) principles to monitor, detect, and respond to network traffic anomalies in real-time. It enhances network security through DDoS attack detection (SYN flood) and offers both forensic logging and live web-based visualization.

🔐 Key Features

  • ✅ Real-time network traffic monitoring with Mininet.
  • ✅ Anomaly detection targeting SYN flood DDoS attacks.
  • ✅ Alerts shown on terminal and live web interface.
  • ✅ IP blocking using iptables when attacks are detected.
  • ✅ Logs suspicious traffic in structured JSON format.
  • ✅ Live traffic visualizations using dynamic charts.

🛠 Tools and Technologies

Tool Purpose
Mininet Simulated network topology with SDN
Scapy Packet sniffing and analysis
Wireshark Packet validation and deep inspection
Flask Backend server for dashboard
Chart.js Real-time line/pie chart visualization
iptables Blocking suspicious IPs dynamically

📦 Requirements

  • Ubuntu 22.04 (VM recommended)

  • Python 3.10.6

  • Mininet

  • hping3, iperf, and iptables

  • Python libraries:

    • Flask
    • Scapy
    • Chart.js (frontend)
    • json, time, os, collections (built-in)

Install Python dependencies using:

pip install -r requirements.txt

▶️ How to Run the System

There are three main components to launch for the complete system:

1. Launch Custom Mininet Topology

Run the topology file (e.g., topology.py) to simulate your network:

sudo python3 topology.py

✅ This sets up hosts (like h1 to h8) and connects them via SDN.

2. Run Real-Time DDoS Detection Script

Run the detection script (realtime_attack_detection.py) inside the h8 host (or the relevant host receiving traffic):

xterm h8
sudo python3 realtime_attack_detection.py

✅ This will:

  • Monitor incoming packets.
  • Detect potential SYN flood attacks.
  • Log alerts to terminal and JSON files.
  • Block attacker IPs dynamically.

3. Start the Flask Web Dashboard

From your main machine (not inside Mininet), run:

python3 app.py

✅ This opens a real-time dashboard at http://localhost:5000/ displaying:

  • Line chart of live SYN packets.
  • Pie chart of attack source distribution.
  • Table of blocked IPs.

🚀 Testing the System

You can generate test traffic using:

Example 1: DDoS Simulation with hping3

xterm h1
hping3 -S -p 80 --flood 10.0.0.8

Example 2: Normal Traffic with iperf

xterm h2
iperf -s
xterm h3
iperf -c 10.0.0.2

📁 File Structure Overview

File Purpose
topology.py Custom Mininet topology script
realtime_attack_detection.py Packet sniffer + DDoS detection + blocking
app.py Flask web server to display dashboard
requirements.txt List of required Python packages

📌 Notes

  • This system assumes the attacking target is host h8 (10.0.0.8) by default. Adjust IPs as per your topology.
  • If iptables rules persist after blocking, you may clear them with:
sudo iptables -F
  • Run detection script as root due to packet sniffing and firewall manipulation.

🤝 Contribution

Feel free to fork this project, suggest improvements, or contribute to future versions with advanced ML-based detection or a more scalable dashboard.