How vidura2/project-psd works
A single-file passive detector captures TCP traffic, filters eligible SYN packets and ignored sources, then tracks unique destinations in sliding windows to detect vertical and horizontal scans. Per-source cooldown controls alert emission; alerts go to stdout and a log file. The README also describes deployment visibility and distributed log aggregation, but those are operational arrangements rather than implemented subsystems. The graph reflects the sampled implementation in the sole source file.
Main entry points: port_scan_detector.py Alert formatting
Components 15
Packet capture
- CLI setup
port_scan_detector.py - Detector startup
port_scan_detector.py
Scan detection
- Packet filtering
port_scan_detector.py - Ignore sources
port_scan_detector.py - Window trackers
port_scan_detector.py - Window pruning
port_scan_detector.py - Vertical detection
port_scan_detector.py - Horizontal detection
port_scan_detector.py
Alerting
- Cooldown tracking
port_scan_detector.py - Alert formatting
port_scan_detector.py - Alert logging
port_scan_detector.py
Other components
- Operator
- Scapy sniff
- Standard output
- Alert log file
Connections 15
- Operator → CLI setup: configures
- CLI setup → Detector startup: constructs
- Detector startup → Scapy sniff: starts capture
- Scapy sniff → Packet filtering: delivers packets
- Packet filtering → Ignore sources: checks source
- Ignore sources → Window trackers: records eligible
- Window trackers → Window pruning: supplies timestamps
- Window pruning → Vertical detection: counts ports
- Window pruning → Horizontal detection: counts hosts
- Vertical detection → Alert formatting: triggers
- Horizontal detection → Alert formatting: triggers
- Alert formatting → Cooldown tracking: checks cooldown
- Alert formatting → Alert logging: emits message
- Alert logging → Standard output: writes
- Alert logging → Alert log file: writes