Network analyzer (packet sniffer)

Aim of the project is to intercept incoming and outgoing traffic through a user specified network interface of his computer.

The application will generate a textual report, providing statistics about the observed network packets.

The executable file path is packet_sniffer/target/debug/packet_sniffer.

Below you can find the available command line options, the structure of the report file generated by the application, and the possible error conditions that may occurr.

Command line options

• -a, --adapter

          Name of the network adapter to be inspected, if omitted the default adapter is chosen.

          If a non-existing adapter is provided, the application raises an error and terminates.

          This option must be followed by a textual value.

• -d, --device-list

          Prints list of the available network interfaces.

          Immediately terminates the program.

          This option does not need to be followed by a value.

• -h, --highest-port

          Sets the maximum port value to be considered, if omitted there is not ports higher bound.

          If the highest-port provided value is lower than the lowest-port provided value, the application raises an error and terminates.

          This option must be followed by an integer value between 0 and 65535.

          default: 65535

• -i, --interval

          Sets the interval of time between report updates (value in seconds).

          This option must be followed by a positive integer value.

          default: 5

• -l, --lowest-port

          Sets the minimum port value to be considered, if omitted there is not ports lower bound.

          If the lowest-port provided value is higher than the highest-port provided value, the application raises an error and terminates.

          This option must be followed by an integer value between 0 and 65535.

          default: 0

• -m, --minimum-packets

          Sets the minimum value of transited packets for an address:port to be printed in the report.

          This option must be followed by a positive integer value.

          default: 0

• -n, --network-layer-filter

          Filters packets on the basis of the IP version address (IPv4 or IPv6).

          If a string different from "IPv4" or "IPv6" is provided (not case sensitive), the application raises an error and terminates.

          This option must be followed by a textual value.

          default: "no filter"

• -o, --output-file

          Name of output file to contain the textual report, if omitted a default file is chosen.

          This option must be followed by a textual value.

          default: report.txt

• -t, --transport-layer-filter

          Filters packets on the basis of the transport layer protocol (TCP or UDP).

          If a string different from "TCP" or "UDP" is provided (not case sensitive), the application raises an error and terminates.

          This option must be followed by a textual value.

          default: "no filter"

Textual report structure

Report header

The first section of the textual report contains an header summarizing different useful informations.

First of all, it specifies the name of the network adapter analyzed during the sniffing process.

Then there is a detail about the initial timestamp of the sniffing process, the last timestamp in which the report was updated, the frequency of updates and the number of times the report was updated (re-written from scratch with updated data).

Finally, it describes the status of the possible filters applicable by the user through the command line: minimum number of packets for and address:port pair to be printed in the report, IP address version, transport layer protocol and port minimum and maximum number.

Note that an application layer protocol filter is not provided since the user can use the lowest and highest port options to this purpose (e.g., to filter DNS traffic a user can specify packet_sniffer -l 53 -h 53, to filter HTTPS traffic a user can specify packet sniffer -l 443 -h 443 and so on).

Report address:port list

The second section of the textual report is dedicated to the packets stream analysis for each address:port pair.

This analysis results in a list in which each element represents an address:port pair with the relative statistics.

For each element it is reported the amount of sent data (relatively to packets in which the address:pair is the source) and received data (relatively to packets in which the address:port is the destination) measured in number of packets and in number of bytes.

For each address:port pair are reported the first and the last timestamp in which a packet was transmitted from/to that address:port.

Level 4 and level 7 carried protocols are also described (respectively transport layer and application layer protocols).

Both the transport layer protocols and application layer protocols fields could report a single or multiple protocols for each address:port pair, based on the traffic type.

Specifically, the transport layer protocols field is based on an Enum with only two values (TCP and UDP), while the application layer protocols field is based on an Enum with some of the most common level 7 protocols (listed in the table below); please note that application level protocols are just inferred from the transport port numbers.

Port number(s)	Application protocol	Description
20, 21	FTP	File Transfer Protocol
22	SSH	Secure Shell
23	Telnet	Telnet
25	SMTP	Simple Mail Transfer Protocol
53	DNS	Domain Name System
67, 68	DHCP	Dynamic Host Configuration Protocol
69	TFTP	Trivial File Transfer Protocol
80	HTTP	Hypertext Transfer Protocol
110	POP	Post Office Protocol
123	NTP	Network Time Protocol
137, 138, 139	NetBIOS	NetBIOS
143	IMAP	Internet Message Access Protocol
161,162	SNMP	Simple Network Management Protocol
179	BGP	Border Gateway Protocol
389	LDAP	Lightweight Directory Access Protocol
443	HTTPS	Hypertext Transfer Protocol over SSL/TLS
636	LDAPS	Lightweight Directory Access Protocol over TLS/SSL
989, 990	FTPS	File Transfer Protocol over TLS/SSL

Error conditions

...