Problem
Snort-based IDS deployed to monitor and analyze simulated network traffic, identifying malicious patterns using Wireshark for traffic analysis and Python for automation and alert handling.
SnortWiresharkPythonNetwork SecurityIDSCase study / interactive demo
Case study
From problem to working system
My role
Security engineer and full-stack developer
Solution
Snort-based IDS deployed to monitor and analyze simulated network traffic, identifying malicious patterns using Wireshark for traffic analysis and Python for automation and alert handling.
Architecture
The implementation combines the following technologies and system concerns.
SnortWiresharkPythonNetwork SecurityIDS
How it was built
- Wrote custom rules for port scanning, brute-force authentication, and known exploit patterns, with thresholds and suppression to control duplicates.
Security decisions
- Wrote custom rules for port scanning, brute-force authentication, and known exploit patterns, with thresholds and suppression to control duplicates.
Major challenges
- Deployed Snort as an inline and passive sensor against simulated traffic, tuning rules until the alert stream was usable rather than noise.
- Analysed captures in Wireshark to build ground truth for each detection, confirming the packet-level behaviour before writing a rule.
- Automated alert handling in Python, parsing unified output into structured events and correlating repeats from the same source.
Verified evidence
Results and measurable impact
- Automated alert handling in Python, parsing unified output into structured events and correlating repeats from the same source.
Screenshots and access
Product view
Interactive Demo
A scoped, fully functional recreation of this project's core feature runs below, live in your browser. Reset it, resize it, or expand it to full screen.
network-intrusion.zainkhalilkhan.com
Network Intrusion Detection System
Security platform
Sandbox telemetry
Network Intrusion Detection SystemWorkspace5 updates
snort ids console
CAPTURING
A Snort-style engine matching a live packet capture against signature rules. Distinct-port and SYN-burst counters run in sliding windows, so injecting a scan or flood trips detection the same way the real Snort plus Wireshark build does. Toggle any rule to change detection live.
0
packets/sec
0
captured
0
alerts
0
talkers
inject attack:
local.rules
sid:1000001HIGH
SSH brute force / auth scan
alert tcp any any -> $HOME_NET 22 (msg:"SSH auth scan"; flags:S; detection_filter:track by_src, count 5, seconds 10; sid:1000001; rev:3;)
sid:1000002MEDIUM
TCP SYN horizontal port scan
alert tcp any any -> $HOME_NET any (msg:"TCP SYN port scan"; flags:S; threshold:type both, track by_src, count 15, seconds 10; sid:1000002; rev:2;)
sid:1000003HIGH
Oversized ICMP (ping flood / tunnel)
alert icmp any any -> $HOME_NET any (msg:"Oversized ICMP payload"; itype:8; dsize:>1000; sid:1000003; rev:1;)
sid:1000004CRITICAL
Traffic from known-bad host
alert ip [185.220.101.4,45.153.160.2,193.42.33.8] any -> $HOME_NET any (msg:"Known-bad source IP"; sid:1000004; rev:7;)
sid:1000005CRITICAL
Oversized outbound TLS (possible exfil)
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"Possible data exfiltration"; flow:established; dsize:>1400; sid:1000005; rev:1;)
alert feed0 shown
No alerts yet. Inject an attack or enable more rules.
eth0 · live capture0 pkts in view
timesourcedestinationprotoflagslen
Waiting for traffic...
Zain Khalil Khan
Client-side sandbox. State is in memory and nothing is sent to a server.