How halildeniz/networkassessment works
NetworkAssessment is a command-line tool that scans a supplied PCAP/PCAPNG capture for suspicious traffic. The user provides the capture and optional protocol, packet-count, and output settings; the assessment opens the capture, builds a set of IPv4 addresses, then revisits packets by source address and applies protocol filtering before running detection checks and keyword searches. Findings are printed and, when configured, appended to a file. README capabilities are represented, but several detection methods are unsampled beyond the monolithic source excerpt, so their internal wiring is not expanded.
Main entry points: networkassessment.py Assessment runner · figletstyle.py Colored display
Components 16
Input and capture
- CLI entry
networkassessment.py - Capture reader
networkassessment.py
Assessment
- Assessment runner
networkassessment.py - Address indexing
networkassessment.py - Protocol filter
networkassessment.py
Findings and output
- DNS tunneling
networkassessment.py - SSH tunneling
networkassessment.py - TCP hijacking
networkassessment.py - Attack signatures
networkassessment.py - Keyword search
networkassessment.py - Colored display
style/figletstyle.py - Result logging
networkassessment.py
Other components
- Analyst
- PCAP file
- Terminal
- Output file
Connections 27
- Analyst → CLI entry: supplies options
- Analyst → PCAP file: selects capture
- CLI entry → Assessment runner: constructs and starts
- Assessment runner → Capture reader: opens and scans
- PCAP file → Capture reader: packet data
- Capture reader → Address indexing: indexes IPs
- Assessment runner → Capture reader: resets and iterates
- Assessment runner → Protocol filter: filters packets
- Assessment runner → DNS tunneling: checks packets
- Assessment runner → SSH tunneling: checks packets
- Assessment runner → TCP hijacking: checks packets
- Assessment runner → Attack signatures: checks packets
- Assessment runner → Keyword search: searches packets
- Assessment runner → Colored display: shows banner
- Assessment runner → Terminal: prints progress
- DNS tunneling → Terminal: prints findings
- SSH tunneling → Terminal: prints findings
- TCP hijacking → Terminal: prints findings
- Attack signatures → Terminal: prints findings
- Keyword search → Terminal: prints findings
- DNS tunneling → Result logging: saves findings
- SSH tunneling → Result logging: saves findings
- TCP hijacking → Result logging: saves findings
- Attack signatures → Result logging: saves findings
- Keyword search → Result logging: saves findings
- Assessment runner → Result logging: saves completion
- Result logging → Output file: appends results