Network Traffic Monitor & Rule-Based Firewall Simulator

A real-time network traffic monitor and rule-based packet filtering engine built with Python and Scapy. This project captures live TCP/IP packets, extracts key information (IPs, ports, protocols), and simulates firewall/IDS behavior by flagging traffic based on configurable rules.

Features

• Real-time Packet Capture: Uses Scapy to capture and parse live TCP/UDP/ICMP packets.
• Rule-Based Filtering Engine: Simulates a firewall by applying configurable allow/block rules for IPs and ports using a JSON configuration file.
• Anomaly Detection: Tracks connection frequencies per source IP to flag potential port-scanning or brute-force patterns (e.g., SYN floods).
• Traffic Statistics: Logs and analyzes protocol distributions and "top talkers" to identify network activity trends.

Prerequisites

• Python 3.x
• Administrator/root privileges (required for packet sniffing)
• Npcap (Windows) or libpcap (Linux)

Installation

1. Clone the repository:

   git clone <your-repo-url>
   cd network_monitor

2. Install the required dependencies:

   pip install -r requirements.txt

Usage

Run the monitor using Python (ensure you run your terminal as Administrator/root):

python monitor.py

Optional Arguments

• -i or --interface: Specify the network interface to sniff on (e.g., eth0, Wi-Fi).
• -r or --rules: Path to a custom rules JSON file (defaults to rules.json).
• -c or --count: Number of packets to capture (default is 0 for infinite).

Example:

python monitor.py -i "Wi-Fi" -r rules.json

Configuration (rules.json)

You can configure allowed/blocked traffic and anomaly thresholds in the rules.json file.

Example:

{
    "default_action": "ALLOW",
    "rules": [
        {
            "action": "BLOCK",
            "dst_port": 22,
            "protocol": "TCP"
        }
    ],
    "anomaly_thresholds": {
        "max_connections_per_minute": 100,
        "max_syn_per_minute": 50
    }
}