Overview
A CLI packet sniffer built to actually understand how networks move data — not just to have a Wireshark clone. Captures live traffic on any interface, decodes protocol headers, and flags patterns that usually mean something is off.
The problem
- Wireshark is powerful but a firehose — hard to focus on one thing when learning.
- I wanted to see, per packet, exactly what a TCP or ICMP header actually contains, not just a pretty summary.
- Existing hobby sniffers didn't do any pattern detection — just a raw dump.
Approach
- Built directly on Scapy so the packet objects are inspectable end-to-end.
- Focused the CLI on three modes: live tail, protocol filter, and anomaly scan.
- Kept output plain-text and grep-friendly so it composes with the rest of a shell workflow.
What I built
Live capture
Binds to any interface, decodes Ethernet → IP → TCP/UDP/ICMP → payload with per-layer summaries.
Protocol filtering
Command-line flags to focus on one protocol, port, or source/dest IP — keeps the noise down while investigating.
Anomaly patterns
Detects a small set of suspicious patterns out of the box: SYN floods, ARP spoofing signatures, unusual ICMP volume, DNS spikes.
Session log
Every capture session writes a rolling log with timestamps so you can go back and inspect what happened at 3am.
Outcomes
- Made TCP handshake, ARP resolution, and ICMP behaviour visceral — going from textbook diagrams to actually seeing them on the wire.
- Detected a misconfigured device on my home network sending thousands of ARP broadcasts a minute — first real-world find.
- Became a study aid for the Network+ and Cybersecurity certifications listed elsewhere on this site.
What I learned
- Building your own tool teaches you the protocol in a way that reading a book cannot.
- Simple, composable CLI output beats a fancy UI when the goal is learning and grep-ability.
- Scapy's packet-object model is a hidden gem — everything is Python, everything is inspectable.