Network Analyzer
Live traffic capture and inspection that turns raw packets into security insight.
Overview
Network Analyzer is a network monitoring tool I built in Python to answer a simple question: what is actually happening on this network right now? It captures live traffic straight off the wire and inspects it packet by packet, surfacing security insights, flagging anomalies, and mapping activity across the hosts on the network. Instead of trusting that everything is fine, it gives me a ground-truth view of the conversations taking place between machines.
This project sits at the intersection of my two main interests: networking and security. I hold CompTIA Network+ and Security+ certifications, and this tool is where that knowledge gets applied hands-on — reading TCP/IP traffic at the protocol level, reasoning about what normal looks like, and paying attention when something deviates from it. It also connects to my IT and automation work at Thomas Howell Ferguson, where understanding what is moving across a network is part of the day-to-day reality of supporting real infrastructure.
Under the hood, the tool leans on Scapy for packet capture and dissection, works directly with TCP/IP protocol structures to make sense of each packet, and uses SQLite to keep a lightweight local record of what it observes. The result is a self-contained analyzer that runs without heavyweight infrastructure — point it at a network interface and start seeing what your network is really doing.
Key Features
- Live packet capture. Captures traffic directly from the network in real time, so analysis is based on what is actually crossing the wire rather than logs or summaries.
- Deep traffic inspection. Inspects captured packets at the TCP/IP protocol level, decoding headers and connection details to understand who is talking to whom and how.
- Anomaly flagging. Watches for traffic that deviates from expected patterns and flags it, turning a raw packet stream into signals worth investigating.
- Security insights. Surfaces security-relevant findings from the traffic it inspects, informed by the same fundamentals covered by my Network+ and Security+ certifications.
- Network activity mapping. Builds a picture of activity across the network — which hosts are active and how traffic flows between them — instead of showing packets in isolation.
- Lightweight local storage. Persists observations in SQLite, keeping the tool self-contained with a queryable record of network activity and no external database to stand up.
How It Works
- Attach to a network interface and capture live packets using Scapy.
- Dissect each packet, decoding TCP/IP headers and protocol details into structured data.
- Analyze the decoded traffic to evaluate it against expected behavior on the network.
- Flag anomalies and surface security insights from traffic that stands out.
- Record observations in a local SQLite database for persistence and later review.
- Aggregate the results into a map of activity across hosts on the network.