Python Cybersecurity Mastery: Encryption & Threat Detection

A port scan is a common technique hackers use to discover open doors or weak points in a network. A port scan attack helps cyber criminals find open ports and figure out whether they are receiving or sending data. It can also reveal whether active security devices like firewalls are being used by an organization.

Network sniffing is a process that involves capturing, examining, and observing data packets as they travel through a network. This method is frequently employed by network administrators to detect network problems, oversee bandwidth consumption, and address performance issues.

With the protocol filter you can influence the handling of certain protocols for transmissions between interfaces, eg from the WLAN to the LAN.

saving the Captured packets to PCAP file

Network scanning is a procedure for identifying active devices on a network by employing a feature or features in the network protocol to signal to devices and await a response.

An intrusion detection system (IDS) is a device or software application that monitors a network for malicious activity or policy violations. Any malicious activity or violation is typically reported or collected centrally using a security information and event management system.

Analyzing network traffic for unusual patterns or unexpected data flows between devices is another effective detection method. By examining the volume, timing, and direction of traffic, network administrators can identify anomalies that may suggest an ongoing ARP spoofing attack.

SYN scanning is a tactic that a malicious hacker can use to determine the state of a communications port without establishing a full connection.

A denial of service (DoS) attack is an attempt to overload a website or network, with the aim of degrading its performance or even making it completely inaccessible.

adding alarm notification when the attack happened

Address Resolution Protocol (ARP) MeaningAddress Resolution Protocol (ARP) is a protocol or procedure that connects an ever-changing Internet Protocol (IP) address to a fixed physical machine address, also known as a media access control (MAC) address, in a local-area network (LAN).

The ping of death (PoD) attack is a DDoS attack that sends out abnormally large packets in order to disrupt a web server. Common DDoS attacks.

A SYN Flood is a common form of Distributed-Denial-of-Service (DDoS) attack that sends a large amount of SYN requests to a server to overwhelm the open connections.

Python wrapper for tshark, allowing python packet parsing using wireshark dissectors.