analyzer.py

"""
analyzer.py - Protocol parsing & connection statistics for NetSpy
"""

import socket
from collections import defaultdict, deque
from datetime import datetime


# Well-known port names
PORT_NAMES = {
    20: "FTP-data", 21: "FTP", 22: "SSH", 23: "Telnet",
    25: "SMTP", 53: "DNS", 67: "DHCP", 68: "DHCP",
    80: "HTTP", 110: "POP3", 119: "NNTP", 123: "NTP",
    135: "RPC", 137: "NetBIOS", 138: "NetBIOS", 139: "NetBIOS",
    143: "IMAP", 161: "SNMP", 194: "IRC", 389: "LDAP",
    443: "HTTPS", 445: "SMB", 465: "SMTPS", 514: "Syslog",
    587: "SMTP", 636: "LDAPS", 993: "IMAPS", 995: "POP3S",
    1080: "SOCKS", 1194: "OpenVPN", 1433: "MSSQL", 1723: "PPTP",
    3306: "MySQL", 3389: "RDP", 5432: "PostgreSQL", 5900: "VNC",
    6379: "Redis", 6881: "BitTorrent", 8080: "HTTP-alt",
    8443: "HTTPS-alt", 8888: "HTTP-alt", 27017: "MongoDB",
}

# Suspicious ports / patterns for basic alerting
SUSPICIOUS_PORTS = {23, 135, 137, 138, 139, 445, 1433, 3389, 5900}
HIGH_PORT_SCAN_THRESHOLD = 15  # unique dst ports from same src in 10s


class ConnectionKey:
    """Hashable connection identifier."""
    def __init__(self, src_ip, dst_ip, src_port, dst_port, proto):
        # Normalize direction
        if (src_ip, src_port) > (dst_ip, dst_port):
            self.a_ip, self.a_port = dst_ip, dst_port
            self.b_ip, self.b_port = src_ip, src_port
        else:
            self.a_ip, self.a_port = src_ip, src_port
            self.b_ip, self.b_port = dst_ip, dst_port
        self.proto = proto

    def __eq__(self, other):
        return (self.a_ip, self.a_port, self.b_ip, self.b_port, self.proto) == \
               (other.a_ip, other.a_port, other.b_ip, other.b_port, other.proto)

    def __hash__(self):
        return hash((self.a_ip, self.a_port, self.b_ip, self.b_port, self.proto))


class ConnectionStats:
    """Statistics for a single connection."""
    def __init__(self, src_ip, dst_ip, src_port, dst_port, proto):
        self.src_ip = src_ip
        self.dst_ip = dst_ip
        self.src_port = src_port
        self.dst_port = dst_port
        self.proto = proto
        self.packets = 0
        self.bytes = 0
        self.first_seen = datetime.now()
        self.last_seen = datetime.now()
        self.flags = set()  # TCP flags seen

    def update(self, pkt_len, flags=None):
        self.packets += 1
        self.bytes += pkt_len
        self.last_seen = datetime.now()
        if flags:
            self.flags.update(flags)

    @property
    def service(self):
        p = min(self.src_port, self.dst_port) if self.src_port and self.dst_port else None
        if p:
            return PORT_NAMES.get(p, PORT_NAMES.get(max(self.src_port, self.dst_port), ""))
        return ""


class PacketAnalyzer:
    """Analyzes captured packets and maintains statistics."""

    def __init__(self, resolve_hosts=True):
        self.resolve_hosts = resolve_hosts
        self.protocol_counts = defaultdict(int)
        self.connections = {}          # ConnectionKey -> ConnectionStats
        self.dns_queries = deque(maxlen=50)
        self.alerts = deque(maxlen=20)
        self.host_cache = {}           # IP -> hostname
        self._src_ports_history = defaultdict(lambda: deque(maxlen=100))  # for port scan detection
        self._port_scan_check = defaultdict(set)  # src_ip -> set of dst_ports (last 10s)
        self._port_scan_time = defaultdict(float)

    def resolve(self, ip):
        """Resolve IP to hostname (cached)."""
        if not self.resolve_hosts:
            return ip
        if ip not in self.host_cache:
            try:
                host = socket.gethostbyaddr(ip)[0]
                self.host_cache[ip] = host
            except Exception:
                self.host_cache[ip] = ip
        return self.host_cache[ip]

    def _get_tcp_flags(self, tcp_layer):
        """Extract TCP flag names."""
        flags = []
        flag_map = {
            0x001: "FIN", 0x002: "SYN", 0x004: "RST",
            0x008: "PSH", 0x010: "ACK", 0x020: "URG",
        }
        f = tcp_layer.flags
        for bit, name in flag_map.items():
            if f & bit:
                flags.append(name)
        return flags

    def _check_alerts(self, src_ip, dst_ip, dst_port, proto):
        """Basic heuristic alerting."""
        import time
        now = time.time()

        # Suspicious port access
        if dst_port and dst_port in SUSPICIOUS_PORTS:
            self.alerts.appendleft({
                "time": datetime.now().strftime("%H:%M:%S"),
                "type": "SUSPICIOUS PORT",
                "detail": f"{src_ip} → {dst_ip}:{dst_port} ({PORT_NAMES.get(dst_port, '?')})",
                "color": "yellow",
            })

        # Port scan detection
        if proto in ("TCP", "UDP") and dst_port:
            src = src_ip
            if now - self._port_scan_time.get(src, 0) > 10:
                self._port_scan_check[src] = set()
                self._port_scan_time[src] = now
            self._port_scan_check[src].add(dst_port)
            if len(self._port_scan_check[src]) >= HIGH_PORT_SCAN_THRESHOLD:
                self.alerts.appendleft({
                    "time": datetime.now().strftime("%H:%M:%S"),
                    "type": "PORT SCAN?",
                    "detail": f"{src_ip} hit {len(self._port_scan_check[src])} ports on {dst_ip}",
                    "color": "red",
                })
                self._port_scan_check[src] = set()  # reset

    def analyze(self, pkt):
        """Parse a packet and return structured info dict."""
        from scapy.all import IP, IPv6, TCP, UDP, ICMP, ARP, DNS, DNSQR, Raw, Ether

        info = {
            "time": datetime.now().strftime("%H:%M:%S.%f")[:-3],
            "proto": "OTHER",
            "src_ip": "",
            "dst_ip": "",
            "src_port": None,
            "dst_port": None,
            "length": len(pkt),
            "flags": [],
            "info": "",
            "color": "white",
        }

        # ARP
        if pkt.haslayer(ARP):
            arp = pkt[ARP]
            info["proto"] = "ARP"
            info["src_ip"] = arp.psrc
            info["dst_ip"] = arp.pdst
            op = "Request" if arp.op == 1 else "Reply"
            info["info"] = f"{op}: Who has {arp.pdst}? Tell {arp.psrc}"
            info["color"] = "yellow"
            self.protocol_counts["ARP"] += 1
            return info

        # IP layer
        if pkt.haslayer(IP):
            ip = pkt[IP]
            info["src_ip"] = ip.src
            info["dst_ip"] = ip.dst

            # ICMP
            if pkt.haslayer(ICMP):
                icmp = pkt[ICMP]
                info["proto"] = "ICMP"
                types = {0: "Echo Reply", 3: "Unreachable", 8: "Echo Request",
                         11: "Time Exceeded", 5: "Redirect"}
                info["info"] = types.get(icmp.type, f"Type {icmp.type}")
                info["color"] = "cyan"
                self.protocol_counts["ICMP"] += 1

            # TCP
            elif pkt.haslayer(TCP):
                tcp = pkt[TCP]
                info["proto"] = "TCP"
                info["src_port"] = tcp.sport
                info["dst_port"] = tcp.dport
                info["flags"] = self._get_tcp_flags(tcp)
                flags_str = ",".join(info["flags"])

                service = PORT_NAMES.get(tcp.dport, PORT_NAMES.get(tcp.sport, ""))
                if service:
                    info["proto"] = service
                    info["info"] = f"{flags_str}" if flags_str else f"{service} data"
                else:
                    info["info"] = flags_str or "data"

                # HTTP content hint
                if pkt.haslayer(Raw):
                    try:
                        payload = pkt[Raw].load.decode("utf-8", errors="ignore")[:80]
                        if payload.startswith(("GET ", "POST ", "PUT ", "DELETE ", "HTTP/")):
                            first_line = payload.split("\r\n")[0]
                            info["info"] = first_line
                            info["proto"] = "HTTP"
                    except Exception:
                        pass

                info["color"] = "green"
                self.protocol_counts["TCP"] += 1

                self._check_alerts(ip.src, ip.dst, tcp.dport, "TCP")
                self._update_connection(ip.src, ip.dst, tcp.sport, tcp.dport, "TCP",
                                        len(pkt), info["flags"])

            # UDP
            elif pkt.haslayer(UDP):
                udp = pkt[UDP]
                info["proto"] = "UDP"
                info["src_port"] = udp.sport
                info["dst_port"] = udp.dport

                service = PORT_NAMES.get(udp.dport, PORT_NAMES.get(udp.sport, ""))
                if service:
                    info["proto"] = service

                # DNS
                if pkt.haslayer(DNS):
                    dns = pkt[DNS]
                    info["proto"] = "DNS"
                    if dns.qr == 0 and pkt.haslayer(DNSQR):  # query
                        qname = pkt[DNSQR].qname.decode("utf-8", errors="ignore").rstrip(".")
                        info["info"] = f"Query: {qname}"
                        self.dns_queries.appendleft({
                            "time": info["time"],
                            "query": qname,
                            "src": ip.src,
                            "type": "Query",
                        })
                    elif dns.qr == 1:  # response
                        answers = []
                        an = dns.an
                        while an:
                            try:
                                if hasattr(an, "rdata"):
                                    answers.append(str(an.rdata))
                            except Exception:
                                pass
                            an = an.payload if hasattr(an, "payload") else None
                        info["info"] = f"Response: {', '.join(answers[:2])}" if answers else "DNS Response"
                        if dns.qd and pkt.haslayer(DNSQR):
                            qname = pkt[DNSQR].qname.decode("utf-8", errors="ignore").rstrip(".")
                            self.dns_queries.appendleft({
                                "time": info["time"],
                                "query": qname,
                                "src": ip.src,
                                "type": "Response",
                                "answer": ", ".join(answers[:2]),
                            })
                    info["color"] = "magenta"
                    self.protocol_counts["DNS"] += 1
                else:
                    info["color"] = "blue"
                    info["info"] = f"{service} data" if service else f"{len(pkt)}B"
                    self.protocol_counts["UDP"] += 1

                self._check_alerts(ip.src, ip.dst, udp.dport, "UDP")
                self._update_connection(ip.src, ip.dst, udp.sport, udp.dport, "UDP",
                                        len(pkt), [])

        elif pkt.haslayer(IPv6):
            ipv6 = pkt[IPv6]
            info["src_ip"] = ipv6.src
            info["dst_ip"] = ipv6.dst
            info["proto"] = "IPv6"
            info["color"] = "dim"
            self.protocol_counts["IPv6"] += 1

        if info["proto"] == "OTHER":
            self.protocol_counts["OTHER"] += 1

        return info

    def _update_connection(self, src_ip, dst_ip, src_port, dst_port, proto, pkt_len, flags):
        """Update per-connection statistics."""
        key = ConnectionKey(src_ip, dst_ip, src_port, dst_port, proto)
        if key not in self.connections:
            self.connections[key] = ConnectionStats(src_ip, dst_ip, src_port, dst_port, proto)
        self.connections[key].update(pkt_len, flags)

    def get_top_connections(self, n=10):
        """Return top N connections by bytes transferred."""
        conns = list(self.connections.values())
        conns.sort(key=lambda c: c.bytes, reverse=True)
        return conns[:n]