Packet Sniffing and Network Traffic Analysis Using TCP—A New Approach

Address Resolution Protocol (ARP) is a communication protocol to map the computer's addresses to the Media Access Control (MAC) address. In its implementation, ARP is abused, known as ARP poisoning Attack. The impact of ARP poisoning attacks is a deadlock to communicate on the network, identity fraud from addressing a computer through illegal access to steal important and confidential information. Several ARP poisoning attack detection models have been introduced. Still, they depend on application tools requiring complex configuration and mostly state ARP poisoning attacks as normal activity. In this paper, a model for detecting ARP poisoning attacks is proposed using the K-NN classification. The proposed model has a contribution to the feature extraction process based on network traffic flows analysis. The results show that the proposed model can detect ARP poisoning attacks more accurately than some classification algorithms with a TPR value of 97.67% and a detection accuracy of 98.7%.

- Performance and Secuity analysis is essential in the communication systems in the digital world we live in today. This paper discusses the creation of a Network Traffic Tracer, a network system written in Python with integrated Wireshark for capturing packets and performing automated traffic analysis. It employs Scapy and PyShark libraries to capture, f ilter, and process network packets to analyze crucial data about the traffic patterns, unusual activities, and possible security threats. Furthermore, it uses GeoLiteCity IP address geolocation database to enable visual mapping of suspicious network activities all over the world. Such visualization is plenty in identifying strange patterns such as unauthorized invasion or flooding the network which is known as Distributed Denial of Service (DDoS). Furthermore, the system supports real-time monitoring along with statistical report generation for traffic anomaly detection to increase the level of secuity and optimize performance of the network. In this paper, we show how effective the combination of automation in Python and traditional network analysis methods is in addressing issues pertaining to security and monitoring of networks.Keywords: Network Traffic Analysis, Python, Wireshark, Cybersecurity, Scapy, PyShark, Anomaly Detection. Keywords: Network Traffic Analysis, Packet Capture, Python, Wireshark, Scapy, PyShark, Cybersecurity, GeoIP, Anomaly Detection

Spatially partitioning heterogeneous traffic networks into multiple subnetworks is crucial for practical tasks, such as distributed signal control and model parallel processing. Existing partitioning methods that account for traffic characteristics over a certain period typically require calculating similarities between the time series of all sensors. Due to the quadratic increase in complexity with network size, these methods are inefficient for large-scale networks and extended time periods. Additionally, calculating similarities requires complete data, making such methods highly sensitive to missing data and lacking robustness. To address these issues, this article proposes a four-step fundamental-diagram-informed traffic network partitioning method. First, spatially adjacent sensors are clustered into subclusters. Next, the S3 speed-occupancy function is used to fit the aggregated data of each subcluster to extract fundamental diagram information. Then, this information is used to perform secondary clustering to form clusters. Finally, the cluster boundaries are fine-tuned to produce subnetworks with smooth boundaries. The proposed method calculates the parameter similarity between subclusters instead of the time series similarity between all sensors. This reduces computational costs and effectively handles data missing. A case study using real-world data verifies the effectiveness of the proposed method and its stability in the presence of missing data. Compared to spectral clustering, the total within-cluster variance and NcutSilhouette metric decrease by 5.7% and 17.8%, respectively. The proposed method enhances distributed or parallel tasks on traffic networks by providing stable and meaningful partitioning results. This method is beneficial for the analysis and effective management of complex heterogeneous traffic networks.

Cognitive radio technology has been used to efficiently utilize the spectrum in wireless networks. Although many research studies have been done recently in the area of cognitive radio networks (CRNs), little effort has been made to propose a simulation framework for CRNs. In this paper, a simulation framework based on NS2 (CogNS) for cognitive radio networks is proposed. This framework can be used to investigate and evaluate the impact of lower layers, i.e., MAC and physical layer, on the transport and network layers protocols. Due to the importance of packet drop probability, end-to-end delay and throughput as QoS requirements in real-time reliable applications, these metrics are evaluated over CRNs through CogNS framework. Our simulations demonstrate that the design of new network and transport layer protocols over CRNs should be considered based on CR-related parameters such as activity model of primary users, sensing time and frequency.

Network Traffic Analysis (NTA) helps identify security threats, monitor network performance, and plan for future capacity. While real-time analysis is ideal, it can be difficult due to high data volume and complexity. Large amounts of traffic require parsing, and real-time data may miss hidden threats. Post-analysis can address these challenges. It hardly depends on choosing an effective and appropriate storage solutions. A variety of storage systems exist, each employing different approaches and formats to retain data. This article explores the applications of various storage systems for NTA results. Three different types of storage systems considered, including Greenplum, Nebula graph and OpenSearch. A comparative approach is employed, analyzing the same dataset across various storage systems.This allows to examine how different database structures and query capabilities influence the efficiency and accuracy of NTA. The resulting insights will not only provide valuable guidance for selecting the optimal storage solution for specific NTA tasks, but also serve as a foundation for future research in this area.

ABSTRAK Penelitian ini bertujuan untuk mengevaluasi tingkat keamanan jaringan WLAN yang telah diterapkan di SMK Kristen Getsemani Manado dengan menggunakan metode Penetration Testing. Dalam Analisa keamanan jaringan WLAN dilakukan dengan menggunakan metode Penetration Testing dengan mensimulasikan bentuk serangan terhadap jaringan menggunakan sistem operasi yang biasa digunakan dalam penetration yaitu Kali Linux. Berdasarkan hasil pengujian ditemukan bahwa jaringan WLAN di SMK Kristen Getsemani Manado masih memiliki kerentanan yang dapat dimanfaatkan oleh pihak yang tidak bertanggung jawab.Dua jenis serangan yang berhasil dilakukan dalam penelitian ini adalah Analisis Lalu lintas Jaringan(Traffic Network) dan Man In The Middle Attack. Dari temuan tersebut disimpulkan bahwa Jaringan WLAN di SMK Kristen Getsemani Manado belum memberikan perilndungan yang optimal bagi pengguna yang terhubung, sehingga masih memungkinkan terjadinya gangguan saat mengakses layanan internet. ABSTRACT This study aims to broadcast the level of WLAN network security that has been implemented at SMK Kristen Getsemani Manado using the Penetration Testing method. In the WLAN network security analysis is carried out using the Penetration Testing method with a copy of the form of attack on the network using the operating system commonly used in penetration, namely Kali Linux. Based on the test results, it was found that the WLAN network at SMK Kristen Getsemani Manado still has vulnerabilities that can be exploited by irresponsible parties. Two types of attacks that were successfully carried out in this study were Network Traffic Analysis and Man In The Middle Attack. From these findings, it is concluded that the WLAN Network at SMK Kristen Getsemani Manado has not provided optimal protection for connected users, so it is still possible for disruptions to occur when accessing internet services.

Abstract—The rapid expansion of interconnected smart devices has enabled widespread automation and connectivity across smart homes, healthcare, manufacturing, and industrial control systems. However, this large-scale connectivity has significantly increased vulnerabilities, leading to a sharp rise in IoT botnet attacks. Compromised devices are remotely controlled and used to perform cyber-crimes such as Distributed Denial of Ser- vice (DDoS), unauthorized data access, and aggressive network flooding. Traditional signature-based detection methods fail to identify evolving botnet families due to rapid mutation of attack patterns. This paper introduces a machine learning-based intelligent detection framework capable of identifying IoT botnet behavior through traffic flow analysis. The proposed system preprocesses collected network traffic, extracts relevant features, classifies flows as benign (0) or malicious (1), and triggers an automated alert notification when malicious activity is detected. Experimental evaluation demonstrates highly reliable perfor- mance and strong prediction accuracy, proving the suitability of machine learning methods for real-time IoT botnet detection and prevention. Additional discussions include feature selection techniques, model optimization, and deployment considerations for scalable and robust IoT security solutions. Index Terms—IoT Security, Botnet Detection, Machine Learn- ing, Network Traffic Analysis, Intrusion Detection System, Real- Time Alerting, Flow-Based Detection.

Network Packet Sniffer and Traffic Analyzer for Real-Time Data Monitoring

The traffic flow theory is concerned with finding a relation among the variables of traffic flow. We propose a new approach which consists of representing these variables by those of continuous Petri nets with variable speed (VCPN). A model of VCPN is suggested for the analysis and control design in urban and interurban networks. The proposed model provides representation for both motorway corridors and complex road junctions.

Malware is a software or computer program that is used to carry out malicious activity. Malware is made with the aim of harming users because it can change users' data, use up bandwidth and other resources without the user's permission. Some research has been done before to identify the type of malware and its effects. But previous research only focused on grouping the types of malware that attack via network traffic. P. This research analyzes the impact of malware on network traffic using behavior-based detection techniques. This technique analyzes malware by running malware samples into an environment and monitoring the activities caused by malware samples. To obtain accurate results, the analysis is carried out by retrieving API call network information and network traffic activities. From the analysis of the malware call network API , information is generated about the order of the call network API used by malware . Then from the network traffic, obtained malware activities by analyzing the behavior of network traffic malware, payload, and bandwidth of infected traffic. Furthermore, the results of the call network API sequence used by malware and the results of network traffic analysis, are analyzed so that the impact of malware can be determined on network traffic.

A Cross-layer Loss Discrimination Scheme for DCCP over the Wireless Network

The rapid expansion of digital communication and entertainment services like Over The Top (OTT) platforms have become a dominant force in the media and telecommunication industry. These platforms offer a wide range of services such as video streaming , voice calls and messaging which are delivered over the internet without the involvement of traditional service providers. Accurate Classification of network traffic into OTT and non-OTT helps in prioritizing and managing network resources such as bandwidth, server capacity and also ensures a better quality of Service(QoS). This project explores the appli- cation of machine learning techniques to classify network traffic into two primary categories: OTT and non-OTT. The primary objective is to develop a robust and accurate classification model that can automatically differentiate between these categories based on the analysis of network data packets.

While quantum computing offers the promise of exponential advantages, limited quantum speedups are known, especially for practical applications. To open new avenues for quantum advantages, we propose Unconventional Quantum Advantages for Computation (U-QuACs), with respect to unconventional resources such as space (number of bits or quantum bits of memory required to solve a problem), accuracy of solution, communication, or energy consumption. We focus on space-efficient quantum algorithms, where we seek to design algorithms that solve a problem using much less space than the total size of the input. A natural setting in which space is critical is the streaming model of computation, where the input data arrives sequentially in pieces that must each be processed individually. Streaming is motivated by a variety of problems including analysis of internet traffic or social networks. We design the first exponential quantum space advantage for a natural streaming problem, which also constitutes the first quantum advantage for approximating a discrete optimization problem, albeit with respect to space.

Introduction: Anomaly detection in network traffic is a critical component in multiple domains like IoT, Cloud Computing, cybersecurity and other field, focusing on the identification of malicious activities to preserve the integrity of network systems. Objectives: This research investigates the performance of both parametric and non-parametric machine learning algorithms in detecting anomalies within network traffic datasets. Parametric models such as Logistic Regression and Support Vector Machines (SVM) were evaluated alongside non-parametric methods, including Random Forest and K-Nearest Neighbors (KNN). Methods: The dataset underwent an extensive preprocessing pipeline to address issues such as missing data, feature normalization, and categorical encoding to improve model accuracy. Results: Among the different algorithms assessed, Random Forest demonstrated the highest efficacy, achieving an accuracy rate of 98.68%. This notable performance highlights the advantages of ensemble techniques in capturing complex, non-linear patterns inherent in network traffic. The results underscore the significant contribution of machine learning, particularly non-parametric methods, in enhancing anomaly detection systems within cybersecurity. Conclusions: Furthermore, this study provides valuable insights into algorithm selection for network traffic analysis, facilitating the development of more robust and efficient intrusion detection systems.

The wireless mesh networks (WMNs) have become one of the popular technologies of the wireless network utilization. WMN provides reliable and scalable wireless network because of its features such as dynamic self-organizing, self-configuring, Self-managing and self-healing. Routing protocols play an essential role in finding and establishing an active route from a source to a destination in WMNs. This article focuses on the performance evaluation and comparison of some routing protocols commonly used in WMNs for VoIP application: AODV, DSR, OLSR and TORA has been investigated over client Wireless Mesh Networks based on OPNET simulation in a different network sizes and mobility. This article presents a background of some designs and solutions based on an elaborated simulation investigation. The performance comparisons are carried out with regard to the node variation in network sizing and mobility. Based on the empirical outputs, the authors suggested that to utilize a specific routing protocol in certain situations.