sniff

Command line HTTP sniffer and alerter for Python 3.5

Installation

git clone https://github.com/stephengroat/sniff
cd sniff
pip install -r requirements.txt
sudo python3 sniff.py --help
usage: sniff.py [-h] --alertsection ALERTSECTION --alertsize ALERTSIZE

Sniff HTTP traffic for sections and alert

optional arguments:
  -h, --help            show this help message and exit
  --alertsection ALERTSECTION
                        website section for alert (i.e. test.com/test or
                        test.com)
  --alertsize ALERTSIZE
                        number of hits within 2 minutes to generate alert

Usage

Example:

sudo python3 sniff.py --alertsection=www.bbc.com --alertsize=2

NOTE Set with BPF to monitor (tcp and dst port 80) or (tcp and src port 80) for speed (avoiding unnecessary traffic). If HTTP traffic is be sent over a non-standard port, this filter should be reconfigured.

NOTE maxcachesize is currently set to 1024 for performance, allowing for that many hits in 10 seconds or alert hits in 2 minutes. If a more hits to track are required, the value should be modified

NOTE sudo or other root access may be required for network interface sniffing

TODO

• work on making application more event based
• seperate out sniffing and alerting notification to assure sniffing thread is not interrupted
• check interaction of Python GIL on app to assure that scapy sniff and other thread are not blocking each other
• continue to improve test coverage
• create a setup.py for better installation methods
• fix python2 floating point division issue for cross compatability
• try to get https://github.com/stephengroat/cachetools/commit/0b4337076b642857cb4ecd63ffe4fe3bec53bf2c push to upstream project