Skip to content
This repository has been archived by the owner on Aug 30, 2019. It is now read-only.

Latest commit

 

History

History
48 lines (35 loc) · 1.88 KB

README.md

File metadata and controls

48 lines (35 loc) · 1.88 KB
Raw

sniff

Build Status

Command line HTTP sniffer and alerter for Python 3.5

Installation

git clone https://github.com/stephengroat/sniff
cd sniff
pip install -r requirements.txt
sudo python3 sniff.py --help
usage: sniff.py [-h] --alertsection ALERTSECTION --alertsize ALERTSIZE

Sniff HTTP traffic for sections and alert

optional arguments:
  -h, --help            show this help message and exit
  --alertsection ALERTSECTION
                        website section for alert (i.e. test.com/test or
                        test.com)
  --alertsize ALERTSIZE
                        number of hits within 2 minutes to generate alert

Usage

Example:

sudo python3 sniff.py --alertsection=www.bbc.com --alertsize=2

NOTE Set with BPF to monitor (tcp and dst port 80) or (tcp and src port 80) for speed (avoiding unnecessary traffic). If HTTP traffic is be sent over a non-standard port, this filter should be reconfigured.

NOTE maxcachesize is currently set to 1024 for performance, allowing for that many hits in 10 seconds or alert hits in 2 minutes. If a more hits to track are required, the value should be modified

NOTE sudo or other root access may be required for network interface sniffing

TODO

  • work on making application more event based
  • seperate out sniffing and alerting notification to assure sniffing thread is not interrupted
  • check interaction of Python GIL on app to assure that scapy sniff and other thread are not blocking each other
  • continue to improve test coverage
  • create a setup.py for better installation methods
  • fix python2 floating point division issue for cross compatability
  • try to get https://github.com/stephengroat/cachetools/commit/0b4337076b642857cb4ecd63ffe4fe3bec53bf2c push to upstream project