How alperenugurlu/network_assessment works
This is a command-line network traffic assessment script. A user supplies a capture file; the script opens it, discovers source IPs, then scans packets from each source for the documented attack patterns and suspicious keywords, printing matches to the console. Detection functions are implemented in one file and called directly by main(). The README documents the detection capabilities; the sampled source supports the packet-processing and output relationships shown here.
Main entry points: Network_Compromise_Assessment.py Assessment main
Components 18
Assessment workflow
- Assessment main
Network_Compromise_Assessment.py - Capture path input
Network_Compromise_Assessment.py - PyShark capture
Network_Compromise_Assessment.py - IP enumeration
Network_Compromise_Assessment.py
Protocol detections
- DNS tunneling
Network_Compromise_Assessment.py - SSH tunneling
Network_Compromise_Assessment.py - SMB attack
Network_Compromise_Assessment.py - SMTP/DNS attack
Network_Compromise_Assessment.py
Traffic attacks
- TCP hijacking
Network_Compromise_Assessment.py - IPv6 fragmentation
Network_Compromise_Assessment.py - TCP RST attack
Network_Compromise_Assessment.py - SYN flood
Network_Compromise_Assessment.py - UDP flood
Network_Compromise_Assessment.py - Slowloris attack
Network_Compromise_Assessment.py
Content inspection
- Keyword inspection
Network_Compromise_Assessment.py
Other components
- User
- Capture file
- Console
Connections 28
- User → Capture path input: enters path
- Capture path input → Assessment main: returns path
- Assessment main → PyShark capture: opens capture
- Capture file → PyShark capture: packet data
- Assessment main → IP enumeration: enumerates IPs
- PyShark capture → IP enumeration: reads packets
- Assessment main → DNS tunneling: checks packets
- Assessment main → SSH tunneling: checks packets
- Assessment main → SMB attack: checks packets
- Assessment main → SMTP/DNS attack: checks packets
- Assessment main → TCP hijacking: checks packets
- Assessment main → IPv6 fragmentation: checks packets
- Assessment main → TCP RST attack: checks packets
- Assessment main → SYN flood: checks packets
- Assessment main → UDP flood: checks packets
- Assessment main → Slowloris attack: checks packets
- Assessment main → Keyword inspection: checks packet text
- DNS tunneling → Console: prints finding
- SSH tunneling → Console: prints finding
- SMB attack → Console: prints finding
- SMTP/DNS attack → Console: prints finding
- TCP hijacking → Console: prints finding
- IPv6 fragmentation → Console: prints finding
- TCP RST attack → Console: prints finding
- SYN flood → Console: prints finding
- UDP flood → Console: prints finding
- Slowloris attack → Console: prints finding
- Keyword inspection → Console: prints finding