Network detection with Python: live monitoring and protocol parsing
You build detection tools that watch live traffic in Python, parse protocols with your own dissectors and catch attacks such as ARP poisoning.
Level 401 · 13 lessons · 12 practice labs
Lessons
Live monitoring
- Live capture with sniff and BPF filters
- A monitor that catches ARP poisoning
- Spotting a rogue DHCP server
- Short task: raise an alert when a new device joins the network
Protocol parsing
- Defining your own protocol layer in Scapy
- Extracting SNI and a fingerprint from a TLS Client Hello
- Industrial traffic: reading Modbus commands
- Short task: decode an undocumented application protocol
Scale and accuracy
- Stream processing without exhausting memory
- Enriching Zeek logs with Python
- Measuring false positives and tuning thresholds
- Short task: tune the scan detector around backup traffic without silencing it
Wrap-up
- Capstone: a small network intrusion detection system in Python
Practice labs
- A new device joined the network: Write a sniff-based watcher that raises a timestamped alert when a device not on the known MAC list appears on the lab network.
- An ARP poisoning alarm: Write a monitor that alerts when the gateway’s MAC changes or one MAC answers for several IPs, and show it fires on the simulated attack in the lab.
- A rogue DHCP server: Write a detector that watches DHCP offers on the lab network and finds a source other than the authorised server, without flagging the authorised backup server.
- Your own Scapy layer: Define a Scapy layer for the small documented protocol used by the lab’s sensor devices, and show the fields of packets in the capture in readable form.
- An SNI inventory from TLS connections: Extract SNI and a client fingerprint from TLS Client Hello messages in the capture, group hosts by fingerprint and flag the unexpected client.
- Decode an undocumented protocol: Work out the field layout of the undocumented application protocol on the Demirhan Machinery production line from sample packets, write a Scapy layer and show it separates command types correctly.
- Add asset data to Zeek logs: Write a script that joins the given Zeek conn.log with the inventory table and adds owner and criticality to each connection.
- Unauthorised Modbus write commands: Decode the Modbus functions in an industrial traffic capture and list write commands from anywhere other than the engineering workstation with source, register and value.
- Memory blow-up on days of logs: Rewrite an analysis script that loads all Zeek logs into memory and crashes so it streams line by line with bounded state, and show the result is unchanged.
- Measure the false-positive rate: Write a measurement script that runs the scan detector on a labelled test capture, counts true and false alarms and reports the rates.
- Do not let the backup server silence the detector: Tune a scan detector that keeps firing on nightly backups so only backup traffic is excluded, and show a real scan is still caught.
- A small three-rule intrusion detector: Write a detection tool with rules for port scans, ARP poisoning and DNS exfiltration, and report all three incidents in the Harborview Hospital lab capture as one JSON output.
About this course
You build detection tools that watch live traffic in Python, parse protocols with your own dissectors and catch attacks such as ARP poisoning.
What you will learn
- Live monitoring
- Protocol parsing
- Scale and accuracy
- Wrap-up
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.