A Lightweight, Dependency-Free Network Packet Analyzer and Rule-Based Threat Detection Engine in Python

This report presents the design and implementation of a lightweight, dependency-free Network Packet Analyzer written entirely in the Python standard library. The tool captures live IPv4 traffic through raw sockets, dissects Ethernet, IPv4, TCP, UDP, and ICMP headers, and applies four rule-based heuristics to detect SYN floods, port scans, ICMP floods, and traffic on known high-risk ports (e.g., Metasploit listeners, backdoors, unencrypted legacy protocols). Captured sessions are summarized into structured JSON reports that can be viewed in the terminal or exported to HTML. A built-in demonstration mode replays synthetic traffic — including a scripted attack scenario — so the full detection pipeline can be exercised without root privileges or a live network interface, making the tool suitable for security education, classroom demonstrations, and low-resource network monitoring. This paper documents the system architecture, packet-parsing pipeline, threat detection methodology, reporting format, current limitations, and directions for future work (including a web dashboard, GeoIP enrichment, PCAP export, and ML-based anomaly detection). Source code: https://github.com/jatin8318/Network-Packet-analyzer (MIT License)