CodeAlpha Cyber Security Internship · Task 1
Python-based network traffic capture, packet inspection, filtering, offline PCAP analysis, and data export.
Overview • Architecture • Features • Quick Start • Evidence • Security & Ethical Use
Authorized-use notice: Capture or inspect network traffic only on systems, devices, and networks for which you have explicit permission. Do not use this project to monitor or intercept unauthorized traffic.
The CodeAlpha Basic Network Sniffer is an educational Python application developed for the CodeAlpha Cyber Security Internship, Task 1: Basic Network Sniffer.
The application uses Scapy for packet capture and analysis and provides a desktop GUI built with Tkinter / ttk. It supports both live and offline workflows, with protocol filtering, packet inspection, statistics, PCAP handling, and CSV/JSON export.
The project also includes a command-line sniffer and an automated pytest suite for validating the packet-analysis backend.
┌──────────────────────────────┐
│ Authorized Network │
│ Traffic │
└──────────────┬───────────────┘
│
▼
┌──────────────────────────────┐
│ Scapy │
│ Packet Capture │
└──────────────┬───────────────┘
│
▼
┌──────────────────────────────┐
│ Packet Analysis │
│ Protocol / IP / Ports / TTL │
│ Length / Payload Preview │
└──────────────┬───────────────┘
│
▼
┌──────────────────────────────┐
│ Tkinter / ttk GUI │
│ Capture / Filter / Inspect │
│ Statistics / Import / Export │
└──────────────┬───────────────┘
│
┌──────┴───────────────┐
▼ ▼
PCAP Storage CSV / JSON
│
▼
Offline PCAP Analysis
Live Network Traffic
↓
Packet Capture
↓
Packet Analysis
↓
GUI Visualization
↓
Filtering / Inspection / Statistics
PCAP / PCAPNG / CAP
↓
File Import
↓
Offline Analysis
↓
Packet Inspection
↓
CSV / JSON Export
The project is designed to:
- Demonstrate practical network packet capture using Scapy.
- Analyze packet metadata and common protocol information.
- Display source and destination addresses and ports.
- Inspect packet length, TTL / Hop Limit, and limited payload data.
- Filter packets by protocol.
- Support offline analysis of previously captured traffic.
- Save captures in PCAP format.
- Export analyzed packet data to CSV and JSON.
- Provide automated tests for the packet-analysis backend.
- Live packet capture using Scapy
- IPv4 and IPv6 packet support
- TCP, UDP, DNS, ICMP, and ARP identification
- Source and destination IP extraction
- Source and destination port extraction
- Packet length detection
- TTL / Hop Limit detection
- Structured packet summaries
- Packet-level detail inspection
- Protocol identification
- Protocol statistics and percentages
- Limited payload preview
- Payload displayed in hexadecimal form
- Printable payload preview
Supported filters:
ALL
TCP
UDP
DNS
ICMP
ARP
Supported capture formats:
.pcap
.pcapng
.cap
Capabilities include:
- PCAP import
- PCAPNG import
- CAP import
- offline packet analysis
- packet timestamp preservation
- offline protocol filtering
- offline packet inspection
- Save live captures as PCAP
- Export analyzed packet data to CSV
- Export analyzed packet data to JSON
- Background packet capture and analysis
- Responsive GUI during long-running operations
- Error handling for capture and file operations
- Automated pytest test suite
| Component | Technology |
|---|---|
| Programming Language | Python 3 |
| Packet Processing | Scapy |
| Desktop GUI | Tkinter / ttk |
| Automated Testing | pytest |
| Capture Formats | PCAP / PCAPNG / CAP |
| Export Formats | CSV / JSON |
CodeAlpha_BasicNetworkSniffer/
│
├── docs/
│ └── TEST_RESULTS.md
│
├── sample_data/
│ └── README.md
│
├── screenshots/
│ ├── 00_project_banner.png
│ ├── 01_live_capture.jpeg
│ ├── 02_packet_details.jpeg
│ ├── 03_protocol_filter.jpeg
│ ├── 04_pcap_analysis.jpeg
│ ├── 05_tests_and_export.jpeg
│ └── README.md
│
├── src/
│ ├── __init__.py
│ ├── gui.py
│ └── sniffer.py
│
├── tests/
│ └── test_sniffer.py
│
├── .gitignore
├── LICENSE
├── README.md
└── requirements.txt
| Directory | Responsibility |
|---|---|
src/ |
Core sniffer and desktop GUI implementation |
tests/ |
Automated packet-analysis tests |
docs/ |
Test and project documentation |
sample_data/ |
Guidance for sample capture data |
screenshots/ |
Visual execution evidence |
Generated local files and environment-specific artifacts are excluded through
.gitignore.
- Python 3.10 or newer
- Windows, Linux, or macOS
- Scapy
- pytest
- Compatible packet-capture driver for live capture where required
On Windows, live packet capture may require a compatible packet-capture driver such as Npcap.
Depending on the operating system and capture-driver configuration, administrator or root privileges may also be required.
From the project root:
cd CodeAlpha_BasicNetworkSnifferpython -m pip install -r requirements.txtpython -c "import scapy, pytest; print('Scapy:', scapy.__version__); print('Pytest:', pytest.__version__)"Start the main application:
python src\gui.pyThe GUI provides controls for:
Live packet capture
Protocol filtering
Packet inspection
Protocol statistics
PCAP import
PCAP saving
CSV export
JSON export
Run the terminal sniffer:
python src\sniffer.pyFor a limited capture:
python src\sniffer.py --count 10To analyze an existing authorized capture:
python src\sniffer.py --read "path\to\capture.pcap"Press:
Ctrl+C
to stop an unlimited live capture.
- Launch the application.
- Select a protocol filter.
- Click Start Capture.
- Observe packets in the packet table.
- Select a packet to inspect its details.
- Click Stop when the capture is complete.
Selecting a captured packet can display:
Timestamp
Source IP
Destination IP
Protocol
Source Port
Destination Port
Packet Length
TTL / Hop Limit
Payload (HEX)
Payload (TEXT)
- Click Open PCAP.
- Select a
.pcap,.pcapng, or.capfile. - Wait for offline analysis to finish.
- Review the packet table and protocol statistics.
- Select packets to inspect their details.
The main packet table can display:
Timestamp
Source IP
Destination IP
Protocol
Source Port
Destination Port
Packet Length
TTL / Hop Limit
The packet inspector additionally provides:
Payload (HEX)
Payload (TEXT)
The payload preview is intentionally limited to the first 64 bytes to keep the interface readable and avoid unnecessarily displaying large packet contents.
The application supports:
ALL
TCP
UDP
DNS
ICMP
ARP
Selecting a filter limits the packets displayed and updates the protocol statistics accordingly.
The command-line sniffer supports:
.pcap
.pcapng
.cap
Example:
python src\sniffer.py --read "path\to\capture.pcap"The offline workflow is useful for:
- testing
- demonstrations
- analysis of saved traffic
- repeatable packet inspection without starting a new live capture
Use only captures that you are authorized to access and analyze.
Live captures can be stored as PCAP files.
Example filename:
network_capture_YYYYMMDD_HHMMSS.pcap
CSV output contains structured packet information such as:
timestamp
source
destination
protocol
source_port
destination_port
length
ttl
payload_hex
payload_text
JSON output stores analyzed packet information in structured JSON form.
CSV and JSON export are available for analyzed packets from both live-capture sessions and imported PCAP data.
The project includes an automated pytest-based backend test suite.
Run:
python -m pytest -q21 passed
The test suite covers:
Protocol detection
Payload extraction
Payload preview handling
Packet summary generation
Protocol filtering
Invalid filter handling
PCAP creation and analysis
Filtered PCAP analysis
Missing PCAP error handling
CSV export
JSON export
Multiple-record export
PCAP -> analysis -> export integration
Detailed test information is available in:
docs/TEST_RESULTS.md
The repository contains five visual evidence screenshots documenting the main functionality of the application.
Demonstrates real-time packets being captured and displayed through the desktop GUI.
Demonstrates inspection of a selected packet, including source and destination, protocol, ports, packet length, TTL, and the limited payload preview.
Demonstrates protocol filtering and packet statistics through the GUI.
Demonstrates importing and analyzing a saved capture through the offline workflow.
Demonstrates export functionality and automated test verification.
See screenshots/README.md for the screenshot evidence
index.
This project is intended strictly for educational, authorized, and defensive network analysis.
Only capture or inspect traffic on:
Owned systems
Authorized laboratory environments
Explicitly authorized networks
Do not use this application to intercept, monitor, or inspect traffic belonging to other users or networks without authorization.
The project provides only a limited payload preview and is not intended to bypass encryption or gain unauthorized access to protected communications.
You are responsible for complying with applicable laws, regulations, organizational policies, and network-usage requirements.
Treat packet captures and exported results as potentially sensitive data.
Do not publish:
Credentials
Authentication tokens
Private payload data
Production traffic
Unauthorized packet captures
Personally identifiable information
Confidential network telemetry
Use sanitized test data and evidence for public repositories.
The implementation is aligned with the CodeAlpha Cyber Security Internship, Task 1: Basic Network Sniffer workflow.
| CodeAlpha Requirement | Implementation |
|---|---|
| Capture network traffic packets | Scapy-based live packet capture |
| Analyze captured packets | Structured packet analysis and summaries |
| Understand packet structure/content | Packet inspector and limited payload preview |
| Use Scapy or Socket | Scapy |
| Display source/destination IPs | Packet table and packet inspector |
| Display protocols | Protocol detection and statistics |
| Display source/destination ports | Packet table and packet inspector |
| Display packet length | Packet table and packet inspector |
| Display TTL / Hop Limit | Packet table and packet inspector |
| Display payload information | Limited HEX and printable-text preview |
| Provide filtering | ALL, TCP, UDP, DNS, ICMP, and ARP filters |
| Support saved captures | PCAP / PCAPNG / CAP offline analysis |
| Export analyzed results | CSV and JSON |
Core implementation ✅ Complete
Live packet capture ✅
Packet analysis ✅
Protocol identification ✅
Protocol filtering ✅
Desktop GUI ✅
Packet inspector ✅
PCAP import ✅
Offline analysis ✅
PCAP saving ✅
CSV export ✅
JSON export ✅
Automated tests ✅ 21 passed
Documentation ✅
Evidence screenshots ✅
GitHub repository ✅ Published
The technical Task 1 implementation, testing, documentation, evidence collection, and GitHub publication are complete.
Repository:
CodeAlpha_BasicNetworkSniffer
GitHub:
The project is prepared for the CodeAlpha internship submission workflow with the published repository, demonstration material, testing evidence, and supporting documentation.
Subhadeep Adhikary
CodeAlpha Cyber Security Intern
This project is licensed under the MIT License.
See LICENSE for the complete license text.