# Network Assessment | With Wireshark Or TCPdump

**URL:** <https://onehack.st/t/network-assessment-with-wireshark-or-tcpdump/252030>\
**Category:** Tools & Scripts\
**Tags:** tools, networking, technology\
**Created:** [July 22, 2023, 7:41pm UTC](https://onehack.st/t/network-assessment-with-wireshark-or-tcpdump/252030 "2023-07-22T19:41:16Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\
**Post date:** [July 22, 2023, 7:41pm UTC](https://onehack.st/t/network-assessment-with-wireshark-or-tcpdump/252030/1 "2023-07-22T19:41:16Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/d/a/da9b9b78d9a6749fa733b7058f563816beb5581b.jpeg)

# Network Assessment

With Wireshark or TCPdump, you can determine whether there is harmful activity on your network traffic that you have recorded on the network you monitor.

This Python script analyzes network traffic in a given .pcap file and attempts to detect the following suspicious network activities and attacks:

1. DNS Tunneling
2. SSH Tunneling
3. TCP Session Hijacking
4. SMB Attack
5. SMTP or DNS Attack
6. IPv6 Fragmentation Attack
7. TCP RST Attack
8. SYN Flood Attack
9. UDP Flood Attack
10. Slowloris Attack

The script also tries to detect packages containing suspicious keywords (eg “password”, “login”, “admin”, etc.). Detected suspicious activities and attacks are displayed to the user in the console.

The main functions are:

- `get_user_input()`: Gets the path of the .pcap file from the user.
- `get_all_ip_addresses(capture)`: Returns a set containing all source and destination IP addresses.
- `detect_*` functions: Used to detect specific attacks and suspicious activities.
- `main()`: Performs the main operations of the script. First, it gets the path of the .pcap file from the user, and then analyzes the file to try to detect the specified attacks and suspicious activity.

# How to Install Script?

`git clone https://github.com/alperenugurlu/Network_Assessment.git`

`pip3 install -r requirements.txt`

# How to Run the Script?

`python3 Network_Compromise_Assessment.py`

`Please enter the path to the .pcap or .pcapng file: /root/Desktop/TCP_RST_Attack.pcap` (Example)

[![image](https://user-images.githubusercontent.com/64872731/234106703-c88a71c8-9150-47ae-a93e-d266426ce5e8.png)](https://user-images.githubusercontent.com/64872731/234106703-c88a71c8-9150-47ae-a93e-d266426ce5e8.png)

# Script Creator

`Alperen Ugurlu`

# Social Media:

`https://www.linkedin.com/in/alperen-ugurlu-7b57b7178/`

## GitHub:

[https://github.com/alperenugurlu/Network\_Assessment](https://github.com/alperenugurlu/Network_Assessment)

---

<div class="post-metadata">

**Author:** ![sfhussain8](https://onehack.st/letter_avatar_proxy/v4/letter/s/48db29/32.png) [@sfhussain8](https://onehack.st/u/sfhussain8)\
**Post date:** [July 24, 2023, 12:44am UTC](https://onehack.st/t/network-assessment-with-wireshark-or-tcpdump/252030/2 "2023-07-24T00:44:52Z")

</div>

Something to try Hands-on! Keep you posted 🙂

Thank you