# halildeniz/networkassessment architecture

> Architecture diagram of the GitHub repository halildeniz/networkassessment, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/halildeniz/networkassessment
- Repository: https://github.com/halildeniz/networkassessment

## Overview

NetworkAssessment is a command-line tool that scans a supplied PCAP/PCAPNG capture for suspicious traffic. The user provides the capture and optional protocol, packet-count, and output settings; the assessment opens the capture, builds a set of IPv4 addresses, then revisits packets by source address and applies protocol filtering before running detection checks and keyword searches. Findings are printed and, when configured, appended to a file. README capabilities are represented, but several detection methods are unsampled beyond the monolithic source excerpt, so their internal wiring is not expanded.

Main entry points: [`networkassessment.py`](https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/networkassessment.py) (Assessment runner), [`style/figletstyle.py`](https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/style/figletstyle.py) (Colored display)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_input["Input and capture"]
  node_cli["CLI entry"]
  node_capture_reader["Capture reader"]
end

subgraph group_analysis["Assessment"]
  node_assessment["Assessment runner"]
  node_address_scan["Address indexing"]
  node_protocol_filter["Protocol filter"]
end

subgraph group_results["Findings and output"]
  node_dns_detection["DNS tunneling"]
  node_ssh_detection["SSH tunneling"]
  node_tcp_detection["TCP hijacking"]
  node_attack_detection["Attack signatures"]
  node_keyword_search["Keyword search"]
  node_display["Colored display<br/>[figletstyle.py]"]
  node_logger["Result logging"]
end

node_user(("Analyst"))
node_capture_file["PCAP file"]
node_terminal["Terminal"]
node_output_file["Output file"]

node_user -->|"supplies options"| node_cli
node_user -->|"selects capture"| node_capture_file
node_cli -->|"constructs and starts"| node_assessment
node_assessment -->|"opens and scans"| node_capture_reader
node_capture_file -->|"packet data"| node_capture_reader
node_capture_reader -->|"indexes IPs"| node_address_scan
node_assessment -->|"resets and iterates"| node_capture_reader
node_assessment -->|"filters packets"| node_protocol_filter
node_assessment -->|"checks packets"| node_dns_detection
node_assessment -->|"checks packets"| node_ssh_detection
node_assessment -->|"checks packets"| node_tcp_detection
node_assessment -->|"checks packets"| node_attack_detection
node_assessment -->|"searches packets"| node_keyword_search
node_assessment -->|"shows banner"| node_display
node_assessment -->|"prints progress"| node_terminal
node_dns_detection -->|"prints findings"| node_terminal
node_ssh_detection -->|"prints findings"| node_terminal
node_tcp_detection -->|"prints findings"| node_terminal
node_attack_detection -->|"prints findings"| node_terminal
node_keyword_search -->|"prints findings"| node_terminal
node_dns_detection -->|"saves findings"| node_logger
node_ssh_detection -->|"saves findings"| node_logger
node_tcp_detection -->|"saves findings"| node_logger
node_attack_detection -->|"saves findings"| node_logger
node_keyword_search -->|"saves findings"| node_logger
node_assessment -->|"saves completion"| node_logger
node_logger -->|"appends results"| node_output_file

click node_cli "https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/networkassessment.py"
click node_assessment "https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/networkassessment.py"
click node_capture_reader "https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/networkassessment.py"
click node_address_scan "https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/networkassessment.py"
click node_protocol_filter "https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/networkassessment.py"
click node_dns_detection "https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/networkassessment.py"
click node_ssh_detection "https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/networkassessment.py"
click node_tcp_detection "https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/networkassessment.py"
click node_attack_detection "https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/networkassessment.py"
click node_keyword_search "https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/networkassessment.py"
click node_display "https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/style/figletstyle.py"
click node_logger "https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/networkassessment.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_capture_reader toneBlue
class node_assessment,node_address_scan,node_protocol_filter toneAmber
class node_dns_detection,node_ssh_detection,node_tcp_detection,node_attack_detection,node_keyword_search,node_display,node_logger toneMint
class node_user,node_capture_file,node_terminal,node_output_file toneIndigo
```

## Components

### Input and capture

- [CLI entry](https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/networkassessment.py): `networkassessment.py`
- [Capture reader](https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/networkassessment.py): `networkassessment.py`

### Assessment

- [Assessment runner](https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/networkassessment.py): `networkassessment.py`
- [Address indexing](https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/networkassessment.py): `networkassessment.py`
- [Protocol filter](https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/networkassessment.py): `networkassessment.py`

### Findings and output

- [DNS tunneling](https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/networkassessment.py): `networkassessment.py`
- [SSH tunneling](https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/networkassessment.py): `networkassessment.py`
- [TCP hijacking](https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/networkassessment.py): `networkassessment.py`
- [Attack signatures](https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/networkassessment.py): `networkassessment.py`
- [Keyword search](https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/networkassessment.py): `networkassessment.py`
- [Colored display](https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/style/figletstyle.py): `style/figletstyle.py`
- [Result logging](https://github.com/halildeniz/networkassessment/blob/alperen_ugurlu_hack/networkassessment.py): `networkassessment.py`

### Other components

- **Analyst**
- **PCAP file**
- **Terminal**
- **Output file**

## Connections

- Analyst → CLI entry: supplies options
- Analyst → PCAP file: selects capture
- CLI entry → Assessment runner: constructs and starts
- Assessment runner → Capture reader: opens and scans
- PCAP file → Capture reader: packet data
- Capture reader → Address indexing: indexes IPs
- Assessment runner → Capture reader: resets and iterates
- Assessment runner → Protocol filter: filters packets
- Assessment runner → DNS tunneling: checks packets
- Assessment runner → SSH tunneling: checks packets
- Assessment runner → TCP hijacking: checks packets
- Assessment runner → Attack signatures: checks packets
- Assessment runner → Keyword search: searches packets
- Assessment runner → Colored display: shows banner
- Assessment runner → Terminal: prints progress
- DNS tunneling → Terminal: prints findings
- SSH tunneling → Terminal: prints findings
- TCP hijacking → Terminal: prints findings
- Attack signatures → Terminal: prints findings
- Keyword search → Terminal: prints findings
- DNS tunneling → Result logging: saves findings
- SSH tunneling → Result logging: saves findings
- TCP hijacking → Result logging: saves findings
- Attack signatures → Result logging: saves findings
- Keyword search → Result logging: saves findings
- Assessment runner → Result logging: saves completion
- Result logging → Output file: appends results