Personal project / 2026

Network traffic analysis

Three attacks caught. One documented miss.

PythonScapyWireshark

Table of ten packet captures and the alerts each detector raised. Nine were answered correctly and one real beacon with 40% timing jitter was missed.

THE PROJECT

Wrote three Scapy detectors and tested them on synthetic captures and on real ones: nmap scans of my own computer and of a Kali VM on an isolated network, random-name DNS lookups, a timed beacon program, and five minutes of normal traffic.

HOW IT WORKS

01
Capture
Record real traffic from my own machines, and build synthetic captures with known contents.
02
Detect
Flag port scans, DNS tunneling, and beaconing with simple, explainable rules.
03
Check
Compare against Wireshark, measure the margins, and show where the rules fail.

WHAT I DELIVERED

Each detector caught its attack in synthetic and real captures, except one real beacon with 40% timing jitter, and none fired on 5 minutes of real normal traffic (12,340 packets).
Cross-checked the counts against Wireshark’s tshark, and every figure matched.
Documented the miss: loosening the beacon rule enough to catch the 40% jitter beacon also flags a simulated mail poller with 30% jitter.
Reported how close normal traffic came to each threshold, since zero alerts alone means little.

EVIDENCE

Table comparing Wireshark’s tshark with my detector: 1000 and 999 probed ports in two scans, 37 and 35 beacon connections, timing variation 0.024 and 0.215, and 67 suspicious DNS questions. Every row agrees, including DNS at 67 vs 67. — The same captures, counted independently by Wireshark’s tshark.

Connection times over 180 seconds. A regular beacon with timing variation 0.024 was caught. A jittery beacon with variation 0.215 was missed. — Two real beacons: one regular, one jittery.

Bar chart of timing variation: real beacon 0.024, synthetic mail poller 0.186, jittery real beacon 0.215. The threshold used is 0.1. A 0.3 threshold would catch both beacons but also flag the poller. — Loosening the rule would flag harmless traffic.

PROJECT SCOPE

Only my own computer and virtual machine were scanned. The only outside traffic was ordinary browsing and test DNS lookups for example.com names.

KEEP EXPLORINGPrompt injection lab →KEEP EXPLORINGLLM red teaming with garak →