NetScope — Network Packet Analyzer
A live SOC-style browser console for real network traffic: protocol dissection, per-host threat scoring with time-decay, encrypted-payload detection via Shannon entropy, and 12+ attack detectors — SYN floods, port scans, ARP spoofing, DNS tunneling, C2 beaconing — streamed over WebSocket to an animated network map.
The Problem
Most packet-sniffing tools are either CLI-only (tcpdump, raw Scapy scripts) or require Wireshark's steep learning curve, and almost none give a live, SOC-style read on which hosts are actually dangerous right now, not just which packets went by.
Architecture & Approach
Split the system into a stateful detection core (protocol dissector, anomaly engine, entropy/crypto detector, per-host threat scorer) reused unchanged across three front ends: a colour-coded terminal mode, a local pure-stdlib WebSocket dashboard, and a production split — a hand-rolled single-port Flask + WebSocket API on Render, and a static SOC-console frontend on Vercel — so the same detection logic drives a CLI demo, a laptop dashboard, or a public link without duplicating it.
Engineering Challenges & Solutions
- Deploying a *packet* analyzer to hosts with no raw-socket access — Render containers can't sniff real traffic, so the production backend runs a realistic simulated-traffic demo mode reusing the exact same anomaly/scoring engine a live capture would drive
- Scoring threats fairly over time — a single old port-scan alert shouldn't permanently brand a host malicious, so scores decay on a 90-second half-life instead of accumulating forever
- Classifying encryption without deep packet inspection — combined Shannon entropy, TLS/SSH signature bytes, Fernet magic bytes, and port inference into one heuristic instead of relying on any single signal
Outcome & Results
A working three-mode analyzer — terminal, local dashboard, and a decoupled Render+Vercel public deployment — detecting SYN floods, port scans, ARP spoofing, DNS tunneling, C2 beaconing, and cleartext credential exposure in real time, with 32 passing unit tests and an HTML/JSON report exporter.
Lessons Learned
Keeping the detection core UI-agnostic from day one — the exact same anomaly/threat-scoring module now drives a terminal printout, a local WebSocket dashboard, and a public production API — turned out to matter more than any single feature, since it meant deploying a new front end never touched the actual detection logic.
