Network Connection Watcher

A real-time watcher for your machine's active network connections. It polls the system's connection table, flags anything that looks off, and prints live, color-coded alerts:

• Connections to known malware/RAT-associated ports (Metasploit's default handler, Back Orifice, NetBus, common IRC botnet C2 ports, etc.)
• Repeated connections to the same remote IP in a short window — a pattern associated with beaconing or scanning behaviour

Flagged events are also appended to a CSV so there's a record of what was caught, not just a line that scrolled past.

Why this exists

Practice project for network-based anomaly detection — a step beyond log parsing, into watching live system state and reasoning about what's normal versus what's worth a second look.

How it works

1. Polls the OS connection table every few seconds (psutil), diffing against the previous poll to catch only genuinely new connections.
2. For each new connection, checks the remote port against a curated list of ports commonly tied to malware and remote-access trojans.
3. Tracks connection counts per remote IP in a sliding time window (default: 4 connections in 30 seconds) to catch repeated/rapid connections to one host.
4. Anything flagged prints as a red [ALERT] line and gets appended to alerts/alerts.csv.

Usage

# Try it instantly with bundled sample data — no setup needed
python net_watcher.py --demo

# Watch your real live connections
python net_watcher.py

# Tune sensitivity
python net_watcher.py --interval 2 --threshold 3 --window 20

Requires psutil (see requirements.txt).

pip install -r requirements.txt

A note on permissions

On Windows, most of your own user's connections are visible without elevation. Seeing connections owned by other users/system processes may require running from an elevated (Administrator) terminal. On Linux/macOS, psutil.net_connections() typically needs root for full visibility — --demo mode sidesteps this entirely for a quick look at how it behaves.

Project structure

network-connection-watcher/
├── net_watcher.py              # main script
├── sample_data/
│   └── sample_connections.json # sample data for --demo mode
├── alerts/                     # generated alert CSVs (gitignored)
├── docs/
│   └── demo.png                # screenshot/GIF referenced above
├── requirements.txt
├── LICENSE
└── README.md

Possible next steps

• Cross-reference flagged IPs against a threat-intel feed or GeoIP lookup
• Live terminal dashboard instead of scrolling text (e.g. with rich)
• Persist a rolling baseline across runs instead of resetting each start
• Slack/email notification on alert

---

Author: Ashik A · github.com/ashihh07