🌐 Network Traffic Analyzer

A Python-powered Network Traffic Analyzer that captures real-time network packets, classifies payloads, maps geolocations of IP addresses, and detects suspicious traffic.
Designed for cybersecurity research, educational purposes, and network monitoring.

---

✨ Features

• 📡 Live Packet Sniffing using Scapy
• 🌍 IP Geolocation Lookup via ipinfo.io & ip-api.com
• 🖼 Payload Classification:
  • Websites
  • Images
  • Videos
  • File downloads
  • JSON/API data
  • Encrypted or unknown payloads
• 🗺 Interactive Map of network connections (powered by Folium)
• ⚠️ Malicious IP Detection (customizable ruleset)
• 📊 Traffic Dashboard with packet count & protocol breakdown
• 🎨 Colored Console Output using Colorama

---

🛠 Technologies Used

Technology	Purpose
Python 3	Core programming language
Scapy	Packet sniffing & manipulation
Requests	HTTP requests for APIs
Folium	Interactive maps
Colorama	Console color formatting
ipinfo.io	IP-to-country lookups
ip-api.com	Location & ISP data
Datetime	Timestamp management
Regex (re)	IP & protocol parsing
JSON	Data serialization

---

⚙️ Installation

1. Clone Repository

git clone https://github.com/yourusername/network-traffic-analyzer.git
cd network-traffic-analyzer

2. Create Virtual Environment (Recommended)

python -m venv venv
source venv/bin/activate   # Linux/Mac
venv\Scripts\activate      # Windows

3. Install Dependencies

pip install -r requirements.txt

---

▶️ Usage

Run the analyzer (requires Admin/Root privileges):

sudo python main.py   # Linux/Mac
python main.py        # Windows (Run as Administrator)

Program Workflow:

1. Starts sniffing packets for 15 seconds
2. Logs each packet’s source, destination, and protocol
3. Detects payload type (if present)
4. Saves logs to packets.txt
5. Generates network_map.html (interactive map)
6. Scans for malicious IPs → logs in alerts.json
7. Creates a dashboard summary in stats.json

---

📊 Example Output

Network Traffic Analyzer Started!

From: 192.168.1.5 (US) --> To: 142.250.190.78 (US) | Protocol: TCP
Payload: b'GET / HTTP/1.1\r\nHost: www.google.com\r\n\r\n'
Payload Type: Website/Surfing

Dashboard:
Total Packets: 128
TCP: 97 packets
UDP: 23 packets
ICMP: 8 packets

---

🌍 IP Mapping

After execution, open network_map.html in your browser.
Each detected IP is marked with:

• 📍 Location (latitude/longitude)
• 🌎 Country
• 🏢 ISP/Organization

---

🚨 Malicious Traffic Detection

The script checks against a predefined list:

known_malicious = ["1.2.3.4", "123.123.123.123"]

If a match is found:

• 🚩 Printed as alerts
• 📂 Logged in alerts.json

➡️ You can expand this list using threat intelligence feeds.

---

🔒 Permissions & Security

• Linux/Mac: Run with sudo
• Windows: Run terminal as Administrator
  ⚠️ Do NOT use this tool on networks you don’t own or have explicit permission to analyze.

---

📜 License

This project is licensed under the MIT License.
You are free to use, modify, and distribute it with attribution.

---

⚠️ Disclaimer

This tool is intended for educational & research purposes only.
Unauthorized monitoring or traffic interception may violate privacy laws or policies.
✅ Use only on networks where you have explicit permission.