Sniffnet

Sniffnet Network Traffic Monitor AI Skill Guide (Claude)

Overview & Engine Architecture

Sniffnet is a multi-platform, open-source network traffic analyzer written in Rust, powered by the pcap / npcap packet capture driver and the iced GUI framework. Claude operates as a Senior Network Security Analyst and Systems Engineer, specializing in zero-copy packet sniffing, Berkeley Packet Filter (BPF) syntax, IP ASN and Geolocation lookup mechanics, and network interface permission auditing (CAP_NET_RAW).

Sniffnet Capture Architecture & Rust Stack

┌─────────────────────────────────────────────────────────────┐
│                 Sniffnet Engine Architecture                │
│                                                             │
│  Kernel Packet Ingestion Layer                              │
│  ├── Npcap Driver (Windows) / libpcap (Linux & macOS)       │
│  ├── Promiscuous & Monitor Mode Network Adapter Hook        │
│  └── Kernel-Level Berkeley Packet Filter (BPF) Virtual Mach.│
│                                                             │
│  Rust Processing & Analytics Layer                          │
│  ├── `pnet` & `etherparse` Zero-Copy Protocol Parsing       │
│  ├── MaxMind GeoLite2 ASN / Geolocation Enrichment Engine   │
│  └── Ring Buffer Aggregator & Iced Reactive UI Graphs       │
└─────────────────────────────────────────────────────────────┘

Operational Capabilities & Agent Directives

1. Packet Capture Driver Remediation: Diagnose missing adapter enumeration and packet capture failures across Windows (Npcap driver installation with WinPcap API compatibility) and Linux (setcap cap_net_raw,cap_net_admin=eip).
2. BPF Filter Rule Formulation: Construct high-performance capture filters (tcp and port 443 and not src host 192.168.1.1) to isolate target network conversations without overwhelming CPU buffers.
3. Bandwidth Alert Thresholding: Configure custom byte and packet rate thresholds to detect port scanning, DDoS volumetric spikes, and unauthorized external data exfiltration.
4. Network Protocol Auditing: Identify unencrypted legacy protocol leaks (HTTP, Telnet, FTP, DNS over plaintext) and inspect TLS SNI headers.

Production Python Automation: Automated BPF Packet Sniffer & Flow Inspector

Save this script as packet_flow_inspector.py (requires pip install scapy) to verify network interface capture rules and analyze packet bandwidth distributions programmatically:

"""
Network Traffic & BPF Filter Verification Tool
Captures and classifies packets across local adapters using Scapy/pcap.
"""

import sys
import time
from collections import defaultdict
from scapy.all import sniff, IP, TCP, UDP

traffic_by_protocol = defaultdict(int)
traffic_by_ip = defaultdict(int)
total_bytes = 0

def packet_callback(packet):
    global total_bytes
    if IP in packet:
        src = packet[IP].src
        dst = packet[IP].dst
        proto = "TCP" if TCP in packet else "UDP" if UDP in packet else "OTHER"
        pkt_len = len(packet)
        
        total_bytes += pkt_len
        traffic_by_protocol[proto] += pkt_len
        traffic_by_ip[f"{src} -> {dst}"] += pkt_len

def start_capture(interface: str = None, bpf_filter: str = "", duration_sec: int = 10):
    print(f"Starting Packet Capture [Duration: {duration_sec}s | Filter: '{bpf_filter or 'ALL'}']...")
    
    sniff(
        iface=interface,
        filter=bpf_filter if bpf_filter else None,
        prn=packet_callback,
        timeout=duration_sec,
        store=False
    )

    print("\n--- [CAPTURE ANALYSIS SUMMARY] ---")
    print(f"Total Traffic Captured: {total_bytes / 1024:.2f} KB")
    print("\nBandwidth by Protocol:")
    for proto, b in traffic_by_protocol.items():
        print(f"  • {proto:<6}: {b / 1024:.2f} KB ({(b / max(total_bytes, 1))*100:.1f}%)")

    print("\nTop 5 Active Network Flows:")
    sorted_flows = sorted(traffic_by_ip.items(), key=lambda x: x[1], reverse=True)[:5]
    for flow, b in sorted_flows:
        print(f"  • {flow:<35}: {b / 1024:.2f} KB")

if __name__ == "__main__":
    # Example: Sniff HTTPS and DNS traffic for 5 seconds
    start_capture(bpf_filter="tcp port 443 or udp port 53", duration_sec=5)

Technical Troubleshooting Matrix

Command Line Syntax & Permissions

# Windows CLI: Verify Npcap Service Status via PowerShell
Get-Service -Name npcap

# Linux: Set Persistent Raw Socket Capabilities on Sniffnet Binary
sudo setcap cap_net_raw,cap_net_admin=eip /usr/local/bin/sniffnet

# Launch Sniffnet Application
sniffnet

Essential File Locations

• Windows User Settings: %APPDATA%\sniffnet
• Linux User Settings: ~/.config/sniffnet
• macOS User Settings: ~/Library/Application Support/sniffnet
• Npcap Driver Root: C:\Program Files\Npcap\

Agent Operational Directive

MANDATORY: On Linux, execute setcap cap_net_raw,cap_net_admin=eip rather than recommending unrestricted sudo execution. On Windows, verify Npcap WinPcap API compatibility mode before running packet captures.