Python-базиран алгоритъм за мрежов анализ и обработка на сурови пакетни записи
Автори:
Васил
Андонов
Национален военен универси- тет „Васил Левски“, България
Страници:
36-
44
DOI: https://doi.org/10.54664/YAWE8900
Резюме:
Modern network analysis places demands on tools that transform raw packet captures into actionable intelligence with minimal manual effort. The algorithm in this paper rises to this challenge through its innovative dual engine approach, combining the efficiency of dpkt for packet parsing with PyShark’s depth for DNS analysis. The tool automatically classifies 21 application protocols, maps traffic geolocations via GeoIP2, and distinguishes intranet, VPN, and internet communications—all while generating structured Excel reports. Unlike conventional analyzers, it detects protocols through both port and payload inspection, revealing hidden traffic patterns. This solution reduces the time for analysing the raw data and the focus goes to the already filtered data.
Ключови думи:
python, analysis, monitoring, network traffic.
Изтегляне