packet-analyzer

Inspiration

We wanted to make packet processing easier to understand by building a system that shows how network traffic moves from raw packet bytes to useful connection and application information. Deep Packet Inspection gave us a practical way to explore networking concepts such as protocol parsing, flow tracking, and TLS Server Name Indication (SNI).

What it does

Packet Analyzer reads a PCAP capture, parses Ethernet, IP, TCP, and UDP traffic, and groups packets into flows using their five-tuple. It classifies applications and extracts domain information from TLS SNI or HTTP Host data when available.

Users can filter traffic by source IP, application, or domain. Matching packets are omitted from the output PCAP, and the program reports packet counts, traffic breakdowns, detected domains, and thread statistics.

The project includes a simple single-threaded version for learning and smaller captures, plus a multi-threaded version for parallel processing.

How we built it

We built the analyzer in C++17 with separate components for reading PCAP files, parsing packets, tracking connections, extracting SNI and HTTP Host data, managing rules, and processing traffic.

The multi-threaded version uses load-balancer and fast-path workers connected through thread-safe queues. A Python script generates sample PCAP data for exploring the processing pipeline.

Challenges we ran into

Packet headers can vary in length, so parsing requires careful bounds checks as the analyzer moves through each layer. Application details may not be available until later packets in a flow—for example, until a TLS ClientHello contains an SNI value—so the analyzer must track the flow and apply matching rules consistently once it can classify it.

We also had to design the multi-threaded pipeline so packets could be distributed among workers while keeping flow-level state useful for filtering.

Accomplishments that we're proud of

We built both a straightforward single-threaded analyzer and a multi-threaded version, with a shared set of packet-processing concepts. The system can track flows, apply IP, application, and domain rules, write filtered PCAP output, and produce a summary of its processing.

We’re also proud of the project guide, which explains the networking background and traces how a packet moves through the system.

What we learned

We learned how PCAP files store packet data, how Ethernet and transport headers fit together, and how a five-tuple can identify a network flow. We also explored how TLS SNI can reveal a requested domain during a handshake, even though the rest of an HTTPS session is encrypted.

Building the parallel version helped us understand producer-consumer queues, thread coordination, and the importance of tracking state across packets.

What's next for Packet Analyzer

We’d like to expand application signatures, strengthen handling of incomplete or malformed packets, and add more automated tests and performance measurements. Other ideas include persistent rule configuration, live traffic support, and exploring what analysis is possible for QUIC and HTTP/3 traffic.

Built With

• built-with:-c++17
• cmake
• deep-packet-inspection
• multithreading
• pcap
• python
• tcp/ip
• thread-safe