siddharth2440/network-detection-engineLightweight network intrusion detection engine capturing live traffic with libpcap. Detects SYN/ICMP floods, port scans, and signature-based web attacks (SQLi, XSS, command injection) in real time.
version: 0.001
A lightweight 'Network Intrusion Detecion Engine' captures Live Traffic and detects real-world live attacks in real time.( Zig0.15.2 ).
- Live packet capture using libpcap
- Custom packet parsing:
- Ethernet
- IPv4
- TCP / UDP / ICMP
- Attack Detection:
- SYN Flood Detection
- ICMP Flood Detection
- TCP/UDP Port Scan Detection
- Ping of Death
- Signature-Based Detection:
- SQL Injection (UNION, DROP, 1=1)
- Cross-Site Scripting (XSS)
- Command Injection
- Path Traversal
- Real-time alert system
- Detection statistics tracking
<!-- Interfaces -->
```ip link```
bash```sudo zig build run -- -i wlan0
bash```sudo zig build run -- -i <interface>
1. Use nping/nmap for port scans
2. Use hping3 for SYN floods
3. Use curl/wget to generate normal traffic
4. Use iperf for network traffic
5. Use scapy in Python to craft custom packets
6. Use ping for ICMP.
```Here are some ways to generate test traffic```
1. Port Scan (test detection):
# TCP SYN scan (should trigger "TCP SYN scan" alert)
bash```sudo nmap -sS <PRIVATE_IP_ADDR>
bash```sudo nmap -sS <PRIVATE_IP_ADDR>
# UDP scan
bash```sudo nmap -sU PRIVATE_IP_ADDR
2. SYN Flood (test SYN flood detection):
bash```sudo hping3 -S --flood -V PRIVATE_IP_ADDR
3. ICMP Flood (test ICMP detection):
bash```sudo hping3 --icmp --flood PRIVATE_IP_ADDR
4. Normal traffic (see packets printed):
# Generate some HTTP traffic
bash```curl http://example.com
# Or ping
bash```ping PRIVATE_IP_ADDR```
5. Python script for custom payloads (test signature detection):
from scapy.all import *
# Send packet with SQL injection pattern
```send(IP(dst="PRIVATE_IP_ADDR")/TCP()/b"GET /?id=1 UNION SELECT * FROM users")```
Disclaimer:
Run the detector first, then generate traffic from another terminal. You'll see:
- Packet details printed for all traffic
- Alerts printed when attacks are detected (threshold: ~10+ ports for scans, 200+ for SYN flood)