NetGuard
A from-scratch PCAP analyzer that reads TCP traffic and flags port scans - and tells you why, not just yes/no.
Overview
A Python + Scapy tool built to learn network security from the packet up. Give it a PCAP; it parses the TCP traffic, groups flows by source and destination, decides whether the activity looks like a port scan, and explains the call. The goal was to understand traffic and detection logic hands-on rather than drive a black-box IDS.
How the detection works
For every source/destination pair it measures three signals - the number of unique destination ports touched, the ratio of SYN packets, and how tightly the activity clusters in time. Each condition that trips scores a point, and the total (0-3) maps to a severity. It is deliberately rule-based and legible: you can read exactly why a flow was flagged.
Built to be verified
NetGuard ships with automated tests for both the analyzer and the detector, so parsing and scoring are pinned down rather than assumed. The code is split cleanly into analysis, detection and inspection modules - the kind of structure a reviewer can actually follow.
| Score | Severity | Meaning |
|---|---|---|
| 0-1 | LOW | normal traffic |
| 2 | MEDIUM | suspicious |
| 3 | HIGH | classified as a port scan |