Skip to content
sourabh mane
All projects

project / 02Network security

Packet Sentinel

A Flask dashboard that reads Wireshark exports and flags port scans, DoS-like volume and odd ports.

View source updated
Year
2025
Stack
  • Python
  • Flask
  • Pandas
  • Wireshark
  • Chart.js

Overview

Packet Sentinel takes a Wireshark CSV export and turns it into a traffic summary with security alerts. It counts packets and unique hosts, charts the top talkers and protocols, and runs three detection rules over the capture: port scanning, possible DoS volume, and traffic on non-standard ports.

Problem

A raw packet capture is thousands of rows. Spotting a scanner or a flood by scrolling through Wireshark is slow, and easy to miss.

Approach

Parse the export with Pandas, compute per-source statistics, and apply simple, explainable rules that point an analyst at the IPs worth looking at first.

Implementation

  • Flask app with a single upload endpoint that validates the CSV has Source, Destination, Protocol and Info columns.
  • Destination ports are extracted from Wireshark's Info column with a regular expression.
  • Summary metrics and top-5 source/protocol counts are computed with Pandas and returned as JSON.
  • The front end renders the charts with Chart.js and lists any alerts raised.

Detection logic

Detection rules — excerpt from App.py, comments added · python
# Port scan: one source touching more than 20 unique destination ports
port_scan = df.groupby('Source')['Destination_Port'].nunique()
scanners = port_scan[port_scan > 20]

# Possible DoS: one source generating more than 1000 packets
heavy_traffic = df['Source'].value_counts()
dos_ips = heavy_traffic[heavy_traffic > 1000]

# Unusual ports: anything outside 80, 443, 53, 22
common_ports = [80, 443, 53, 22]

Key features

  • Upload a Wireshark CSV export (capped at 10 MB)
  • Summary: total packets, unique source and destination IPs
  • Top 5 source IPs and protocol distribution charts
  • Port-scan, possible-DoS and unusual-port alerts

Security concepts

  • Port-scan detection
  • Denial-of-service indicators
  • Unusual port activity
  • Network traffic analysis