Network-Analyzer

An interactive, menu-driven tool for analyzing and monitoring activity on a network you own or are authorized to assess. It discovers active hosts, profiles devices by their traffic, captures packets, and flags common anomalies (rogue access points, unrecognized devices, DNS spoofing/poisoning, SYN floods, and suspicious inbound traffic). Results can be exported to CSV, plain-text, or JSON reports.

This is a defensive network-analysis and monitoring utility. Use it only on networks and devices you own or have explicit written permission to test.

How It Works

flowchart LR
    subgraph CD["Capture / Discovery"]
        D["ARP Host Discovery<br/>+ Vendor Lookup"]
        C["Packet Capture<br/>sniff / pcap"]
    end

    subgraph AN["Analysis"]
        P["Traffic Profiling"]
        A["Anomaly Detectors<br/>Rogue AP / Rogue Device<br/>DNS Spoof / SYN Flood<br/>Suspicious Activity"]
    end

    subgraph OUT["Mapping / Reporting"]
        M["NetworkMapper<br/>topology graph"]
        R["ReportGenerator"]
        R --> CSV["CSV"]
        R --> TXT["TXT"]
        R --> JSON["JSON"]
    end

    D --> P
    D --> A
    C --> P
    C --> A
    D --> M
    P --> M
    P --> R
    A --> R
    M --> R

Loading

Features

• Host discovery (ARP): scan the local subnet for active hosts and resolve vendor names from a bundled OUI database (MAC.CSV) with an optional online vendor-lookup fallback. Available directly from the Analyzer menu, with options to build a topology map and export a report.
• Device identification by traffic: profile hosts by how many unique destinations they communicate with.
• Network topology mapping: build a simple host graph (via networkx) that links the local network to each discovered host (NetworkMapper). Enabled by answering yes to the "build topology map" prompt on the ARP host-discovery menu action.
• Traffic monitoring / capture: sniff a chosen interface for a set duration, optionally filter by TCP/UDP, print statistics, and save to a .pcap file.
• Rogue access point detection: compare observed 802.11 beacons/probe responses against a list of known (SSID, BSSID) pairs. Requires a Wi-Fi adapter in monitor mode.
• Rogue device detection: compare discovered MAC addresses against a list of known devices.
• DNS spoofing / poisoning checks: query multiple public resolvers and compare answers against expected IPs.
• SYN-flood detection: count SYN packets over a window and alert past a threshold.
• Suspicious-activity monitoring: count inbound flows toward the local host.
• Reporting: export findings to CSV, TXT, and JSON via ReportGenerator. Generated when you answer yes to the "save report" prompt on the ARP host-discovery menu action; all three formats are written.

Requirements

• Python 3.7–3.11 (Linux recommended; several features rely on Linux interfaces and raw sockets). Note: the pinned netifaces==0.11.0 has no wheels for Python 3.12+ and generally fails to build there; use 3.11 or earlier, or supply a netifaces build compatible with your interpreter.
• The curl command (used for best-effort public-IP lookup; optional — the tool degrades gracefully if it is missing).
• Python packages (see requirements.txt):
  • scapy, requests, netifaces, networkx

Install dependencies:

pip install -r requirements.txt

Privileges (sudo / packet capture)

Packet capture and crafting raw ARP/DNS/802.11 frames require elevated privileges. Run with sudo:

sudo python3 Analyzer.py

Alternatively, grant raw-socket capabilities to the Python interpreter so you can run without full root (advanced):

sudo setcap cap_net_raw,cap_net_admin+eip $(readlink -f $(which python3))

Rogue-AP detection additionally requires a wireless interface placed in monitor mode.

Getting Started

git clone https://github.com/kassam-99/Network-Analyzer.git
cd Network-Analyzer
pip install -r requirements.txt
sudo python3 Analyzer.py

Usage

Launch the tool and follow the interactive menu:

sudo python3 Analyzer.py

From the main menu choose Analyzer to list the available analysis functions, then select one by number. Each function prompts for its parameters (scan duration, interface, verbosity, whether to save a report, etc.); press Enter to accept the shown default. Choose Help to print the descriptions in Analyzer.txt, or Exit to quit.

Some detectors need a list of known-good baselines. Provide these at the prompt using the following formats (leave blank to check against an empty baseline):

• Rogue devices — comma-separated MAC addresses: AA:BB:CC:11:22:33, AA:BB:CC:44:55:66
• Rogue access points — comma-separated SSID/BSSID pairs: HomeWiFi/AA:BB:CC:11:22:33, Office/AA:BB:CC:44:55:66
• DNS spoofing — comma-separated domain=ip1;ip2 entries: example.com=93.184.216.34, mybank.com=1.2.3.4;1.2.3.5

Generated reports and packet captures are written to the current working directory and are ignored by git (see .gitignore).

Running with Docker

A Dockerfile is provided for reproducible dependencies — it bundles the correct Python version (3.11, so the pinned netifaces==0.11.0 installs cleanly) plus the required system packages (libpcap0.8, tcpdump, iproute2, net-tools, curl). Docker is used here for a consistent build environment, not for isolation: packet capture and raw-socket crafting require the container to share the host network and hold raw-socket capabilities, so the container is intentionally given broad access to the host network stack.

Build the image:

docker build -t network-analyzer .

Run the interactive analyzer:

docker run --rm -it \
    --net=host \
    --cap-add=NET_RAW \
    --cap-add=NET_ADMIN \
    -v "$(pwd)/reports:/reports" \
    network-analyzer

• --net=host — the tool must see the host's real interfaces to discover hosts and sniff traffic.
• --cap-add=NET_RAW --cap-add=NET_ADMIN — required to craft/capture raw ARP/DNS/802.11 frames without running as full root.
• -v "$(pwd)/reports:/reports" — the container's working directory is /reports; this bind mount persists exported CSV/TXT/JSON reports and .pcap captures onto the host.

Authorized use only. As with the non-Docker workflow, use this tool only on networks and devices you own or are explicitly authorized to analyze. Running it under Docker does not change your legal responsibilities.

Rogue-AP detection still requires a wireless interface in monitor mode on the host.

Screenshots

Files

• Analyzer.py — main application, discovery/analysis logic, and interactive menu.
• ReportGenerator.py — CSV / TXT / JSON report writer.
• MAC.CSV — bundled IEEE OUI-to-vendor lookup table.
• Analyzer.txt — long-form description of the classes and methods (shown via Help).

Authorized Use

This project is intended for legitimate network administration, security monitoring, and educational use on networks you own or are explicitly authorized to analyze. Scanning, sniffing, or probing networks or devices without permission may be illegal in your jurisdiction. You are solely responsible for ensuring your use complies with all applicable laws and policies.

Contributing

Contributions, bug reports, and feature requests are welcome. Feel free to fork the repository, make your changes, and submit a pull request.

Author

Kassam Dakhlalah — GitHub: kassam-99