Network Traffic Analysis with Python

Parsing packet captures with DPKT, mapping addresses to places with GeoIP, recognising the fingerprint of a denial-of-service attack, and writing a simple intrusion detection rule.

Learning outcomes

Parse a packet capture layer by layer with DPKT
Map IP addresses to locations with GeoIP
Detect denial-of-service traffic with a rate-based rule
Write a simple intrusion detection rule

Topics

4.1

Network Traffic Analysis Fundamentals

The aircraft black box: a packet capture records every frame that crossed an interface, replayable long after the event. DPKT reads it, and a generator keeps memory flat no matter how large the file is.

5 min

4.2

Parsing Packets with DPKT

The parcel inside the parcel: a captured packet is wrapped in layers, Ethernet around IP around TCP around the payload. DPKT unwraps them from the outside in, and two defensive habits are what let the script survive a real, messy capture.

6 min

Assessments

Sign in to see your unlock progress.

Unit Assessment

Network Traffic Analysis with Python

20 questions30 minPass: 60%

Start exam →

Comprehensive Assessment

4.3

Correlating IP Addresses to Physical Locations

The STD code: an IP address's range reveals an approximate location the same way an old landline number's area code did. Correlating every source in a capture with a place turns a bare list of addresses into a map of where traffic is actually coming from.

6 min

4.4

Recognising Denial-of-Service Traffic

The prank call flood: a denial-of-service attack exhausts a target's capacity to answer, not by breaking anything. The four main families, and the fingerprint a simple volumetric flood leaves in a capture: one request, repeated far more than any browser would.

9 min

4.5

Parsing Command-and-Control Traffic

The radio frequency: before botnets moved onto encrypted HTTP, many coordinated over IRC, one operator typing a command every infected machine in the channel would receive at once. Filtering on the port first and the command second finds it.

5 min

4.6

Identifying a DDoS in Progress

The turnstile: catching an attack while it happens means watching the rate of traffic, not the running total. A sliding window built from a deque counts only the last few seconds, and the GitHub attack shows exactly this kind of detector surviving a record-breaking flood.

7 min

4.7

Writing a Simple Intrusion Detection Rule

The night guard's checklist: a signature-based rule checks for one precise, known pattern, cheap and reliable for exactly what it targets. Paired with the rate-based detection from the last two articles, it is one half of a complete, complementary defence.

5 min

4.8

Unit 4 Quick Reference, Self-Study and Lab

Every DPKT call of this unit in one table, the self-study questions worked through, and three lab exercises that capture, parse, map and detect traffic of your own.

6 min

Python for Cyber Security: Complete Assessment

100 questions120 minPass: 60%

Start final exam →