Class TrafficAnalyzer

traffic_analyzer.py:155–1704

Real-time traffic analyzer for Ragnar server mode. Uses tcpdump for packet capture and provides: - Live connection tracking - Per-host bandwidth statistics - Protocol distribution analysis - Suspicious pattern detection

            'bytes_in': self.bytes_in,
            'bytes_out': self.bytes_out,
            'protocols': self.protocols,
            'ports_contacted': list(self.ports_contacted)[:100],  # Limit for API
            'ports_targeted': list(self.ports_targeted)[:100],
            'connections_active': self.connections_active,
            'first_seen': self.first_seen.isoformat(),
            'last_seen': self.last_seen.isoformat(),
            'dns_queries': self.dns_queries[-50:],  # Last 50 queries
        }


class TrafficAnalyzer:
    """
    Real-time traffic analyzer.

    Uses tcpdump for packet capture and provides:
    - Live connection tracking
    - Per-host bandwidth statistics
    - Protocol distribution analysis
    - Suspicious pattern detection
    """
    
    # Suspicious ports with descriptions for analyst context
    SUSPICIOUS_PORTS = {
        4444: "Metasploit default listener",
        5555: "Android ADB / common backdoor",
        6666: "IRC backdoor / DarkComet",
        1234: "Generic backdoor",
        31337: "Back Orifice / 'elite' port",
        12345: "NetBus trojan",
        65535: "Uncommon max port (evasion)",
        6667: "IRC (C2 channel)",
        6697: "IRC over TLS",
        8080: "HTTP proxy (if unexpected)",
        9001: "Tor default",
        9050: "Tor SOCKS proxy",
        1337: "Common hacker port",
        5900: "VNC (if unauthorized)",
        2222: "SSH alternate (dropbear)",
    }

    # Ports whose "suspicious" classification only makes sense over TCP +
    # unicast. UDP broadcasts on these are almost always a custom IoT /
    # discovery protocol that happened to pick the port — not C2.
    TCP_UNICAST_ONLY_PORTS = frozenset({
        4444, 5555, 6666, 6667, 6697, 9001, 9050, 5900, 2222,
    })

    # DNS tunneling detection threshold
    DNS_TUNNEL_THRESHOLD = 100  # Queries per minute from single host
    DNS_QUERY_TRACKING_WINDOW = 60  # Seconds to track DNS query rate

    # C2 beacon detection
    # A flow is considered a beacon candidate when a local host repeatedly
    # contacts the same external (ip, port) at low-jitter intervals with
    # similar payload sizes. See _sweep_beacons() for the scoring.
    BEACON_MIN_SAMPLES = 6           # Need this many hits before scoring
    BEACON_HISTORY_MAX = 64          # Ring buffer length per flow
    BEACON_MIN_INTERVAL = 5.0        # Ignore sub-5s noise (HTTP keepalive)