Python 3 License PyPI - Version

CyberScanAI is an open source AI Agent Tool for Penetration Testing and Network Forensics.

CyberScanAI is a MCP (Model Context Protocol) Server connects LLMs to tools and prompts for intelligent AI analyzing Networks.

Screenshots

Key Features

• MCP Server: Stateless MCP Server Expose tools, resources, and prompts to LLMs
• MCP Tools: Expose Tools to LLMs
• Prompts Analysis: Networking, Security and Forensics
• Protocols Analysis: DNS, DHCP, ICMP, TCP, SIP
• PCAP files Analysis: Analyse PCAP files
• Interactive User Interface (UI): Realtime UI rendered in conversation

Operating Systems Supported

• Windows XP/7/8/8.1/10/11
• GNU/Linux
• MacOSX

Installation

You can install CyberScanAI with pip

$ pip install cyberscanai

CyberScanAI works out of the box with Python version 3.1.x.

The CyberScanAI Module Usage

CyberScanAI connecting LLMs to tools and prompts and data for intelligent Network Analysis.

You can test the installation CyberScanAI in your machine:

$ cyberscanai -h 

---

CyberScanAI MCP Server

Start CyberScanAI as a stateless MCP Server :

CyberScanAI by default the transport is stdio and load all modules.

$ cyberscanai 

CyberScanAI CLI usage :

$ cyberscanai [--modules MODULES] [--transport {stdio,http}] [--host HOST] [--port PORT]

Modules

All Modules (by default)

$ cyberscanai --modules dns,dhcp,icmp,tcp,sip

DNS Analysis Module

$ cyberscanai --modules dns

DHCP Analysis Module

$ cyberscanai --modules dhcp

ICMP Analysis Module

$ cyberscanai --modules icmp

TCP Analysis Module

$ cyberscanai --modules tcp

SIP (VOIP) Analysis Module

$ cyberscanai --modules sip

Transport

stdio (by default)

$ cyberscanai 

HTTP Transport

$ cyberscanai --transport http

HTTP Transport with custom host and port

$ cyberscanai --transport http --host 192.168.1.1 --port 9090

Tools

CyberScanAI supports different Network Analysis Tools.

DNS Analysis Tools

Complete DNS traffic analysis :

• Extract DNS queries and responses
• Track query frequency
• Detect DNS anomalies and security issues

DHCP Analysis Tools

Complete DHCP traffic analysis :

• Extract DHCP translations
• Identify DHCP clients and servers
• Detect DHCP anomalies and security issues

ICMP Analysis Tools

Complete ICMP traffic analysis :

• Analyse ping request and replies
• Identify network connectivity issues
• Detect ICMP attacks issues

TCP Analysis Tools

Complete TCP traffic analysis :

• ANALYSE Client-Server vs Server-Client traffic
• Detect connection issues and behaviors
• Detect TCP anomalies and security issues

SIP (VOIP) Analysis Tools

Complete SIP traffic analysis :

• Extract SIP requests
• Support VOIP troubleshooting
• Detect VOIP security and forensics reconstruction

Prompts

CyberScanAI provides specialised prompts to guide LLM analysis.

DNS Prompts

• Threat detection
• Behavioral Analysis
• Infrastructure Assessment

DHCP Prompts

• Security Threats
• DHCP Attacks
• Client Anomalies

ICMP Prompts

• ICMP Attacks
• Network Connectivity
• Reconstruction Detection

TCP Prompts

• Attack Detection
• Anomaly Identification
• Forensics Evidence

SIP (VOIP) Prompts

• Registration Abuse
• Toll Fraud
• Timeline Reconstruction

CyberScanAI MCP Client

Now, after run the CyberScanAI MCP Server

You can use CyberScanAI MCP Server tools and prompts to AI intelligent analyse for packets (dns,dhcp,icmp,tcp and sip) from captured pcap file.

Run the CyberScanAI Client with MCP Inspector

npm install -g @modelcontextprotocol/inspector
npx @modelcontextprotocol/inspector cyberscanai

DNS Analysis Tools

{
  "file": "PCAP_Files/dns.cap",
  "analysis_timestamp": "2026-04-17T12:11:56.592133",
  "total_packets_in_file": 249,
  "dns_packets_found": 14,
  "dns_packets_analyzed": 14,
  "statistics": {
    "queries": 7,
    "responses": 7,
    "unique_domains_queried": 7,
    "unique_domains": [
      "www.winpcap.org",
      "www.google-analytics.com",
      "www.expoactive.com",
      "www.google.com",
      "pagead2.googlesyndication.com",
      "chrissanders.org",
      "wireshark.org"
    ]
  },
  "packets": [
    {
      "packet_number": 1,
      "timestamp": "2006-12-16T19:22:34.013605",
      "source_ip": "192.168.0.114",
      "destination_ip": "205.152.37.23",
      "protocol": "UDP",
      "dns_id": 25608,
      "flags": {
        "is_response": false,
        "authoritative": false,
        "truncated": false,
        "recursion_desired": true,
        "recursion_available": false
      },
      "questions": [
        {
          "name": "chrissanders.org",
          "type": 1,
          "class": 1
        }
      ],
      "answers": [],
      "summary": "Ether / IP / UDP / DNS Qry b'chrissanders.org.'"
    },
    {
      "packet_number": 2,
      "timestamp": "2006-12-16T19:22:34.125726",
      "source_ip": "205.152.37.23",
      "destination_ip": "192.168.0.114",
      "protocol": "UDP",
      "dns_id": 25608,
      "flags": {
        "is_response": true,
        "authoritative": false,
        "truncated": false,
        "recursion_desired": true,
        "recursion_available": true
      },
      "questions": [
        {
          "name": "chrissanders.org",
          "type": 1,
          "class": 1
        }
      ],
      "answers": [
        {
          "name": "chrissanders.org",
          "type": 1,
          "class": 1,
          "ttl": 14400,
          "address": "208.113.140.24"
        }
      ],
      "summary": "Ether / IP / UDP / DNS Ans 208.113.140.24"
    },
    {
      "packet_number": 3,
      "timestamp": "2006-12-16T19:22:35.160668",
      "source_ip": "192.168.0.114",
      "destination_ip": "205.152.37.23",
      "protocol": "UDP",
      "dns_id": 23048,
      "flags": {
        "is_response": false,
        "authoritative": false,
        "truncated": false,
        "recursion_desired": true,
        "recursion_available": false
      },
      "questions": [
        {
          "name": "www.google-analytics.com",
          "type": 1,
          "class": 1
        }
      ],
      "answers": [],
      "summary": "Ether / IP / UDP / DNS Qry b'www.google-analytics.com.'"
    },
    {
      "packet_number": 4,
      "timestamp": "2006-12-16T19:22:35.188490",
      "source_ip": "205.152.37.23",
      "destination_ip": "192.168.0.114",
      "protocol": "UDP",
      "dns_id": 23048,
      "flags": {
        "is_response": true,
        "authoritative": false,
        "truncated": false,
        "recursion_desired": true,
        "recursion_available": true
      },
      "questions": [
        {
          "name": "www.google-analytics.com",
          "type": 1,
          "class": 1
        }
      ],
      "answers": [
        {
          "name": "www.google-analytics.com",
          "type": 5,
          "class": 1,
          "ttl": 1626,
          "cname": "b'www-google-analytics.l.google.com.'"
        },
        {
          "name": "www-google-analytics.l.google.com",
          "type": 1,
          "class": 1,
          "ttl": 200,
          "address": "216.239.51.99"
        },
        {
          "name": "www-google-analytics.l.google.com",
          "type": 1,
          "class": 1,
          "ttl": 200,
          "address": "216.239.51.104"
        }
      ],
      "summary": "Ether / IP / UDP / DNS Ans b'www-google-analytics.l.google.com.'"
    },
    {
      "packet_number": 5,
      "timestamp": "2006-12-16T19:22:35.216450",
      "source_ip": "192.168.0.114",
      "destination_ip": "205.152.37.23",
      "protocol": "UDP",
      "dns_id": 51209,
      "flags": {
        "is_response": false,
        "authoritative": false,
        "truncated": false,
        "recursion_desired": true,
        "recursion_available": false
      },
      "questions": [
        {
          "name": "pagead2.googlesyndication.com",
          "type": 1,
          "class": 1
        }
      ],
      "answers": [],
      "summary": "Ether / IP / UDP / DNS Qry b'pagead2.googlesyndication.com.'"
    },
    {
      "packet_number": 6,
      "timestamp": "2006-12-16T19:22:35.216911",
      "source_ip": "192.168.0.114",
      "destination_ip": "205.152.37.23",
      "protocol": "UDP",
      "dns_id": 21262,
      "flags": {
        "is_response": false,
        "authoritative": false,
        "truncated": false,
        "recursion_desired": true,
        "recursion_available": false
      },
      "questions": [
        {
          "name": "www.expoactive.com",
          "type": 1,
          "class": 1
        }
      ],
      "answers": [],
      "summary": "Ether / IP / UDP / DNS Qry b'www.expoactive.com.'"
    },
    {
      "packet_number": 7,
      "timestamp": "2006-12-16T19:22:35.242690",
      "source_ip": "205.152.37.23",
      "destination_ip": "192.168.0.114",
      "protocol": "UDP",
      "dns_id": 51209,
      "flags": {
        "is_response": true,
        "authoritative": false,
        "truncated": false,
        "recursion_desired": true,
        "recursion_available": true
      },
      "questions": [
        {
          "name": "pagead2.googlesyndication.com",
          "type": 1,
          "class": 1
        }
      ],
      "answers": [
        {
          "name": "pagead2.googlesyndication.com",
          "type": 5,
          "class": 1,
          "ttl": 46880,
          "cname": "b'pagead2.google.com.'"
        },
        {
          "name": "pagead2.google.com",
          "type": 5,
          "class": 1,
          "ttl": 392313,
          "cname": "b'pagead.l.google.com.'"
        },
        {
          "name": "pagead.l.google.com",
          "type": 1,
          "class": 1,
          "ttl": 37,
          "address": "72.14.211.104"
        },
        {
          "name": "pagead.l.google.com",
          "type": 1,
          "class": 1,
          "ttl": 37,
          "address": "72.14.211.99"
        }
      ],
      "summary": "Ether / IP / UDP / DNS Ans b'pagead2.google.com.'"
    },
    {
      "packet_number": 8,
      "timestamp": "2006-12-16T19:22:35.811703",
      "source_ip": "205.152.37.23",
      "destination_ip": "192.168.0.114",
      "protocol": "UDP",
      "dns_id": 21262,
      "flags": {
        "is_response": true,
        "authoritative": false,
        "truncated": false,
        "recursion_desired": true,
        "recursion_available": true
      },
      "questions": [
        {
          "name": "www.expoactive.com",
          "type": 1,
          "class": 1
        }
      ],
      "answers": [
        {
          "name": "www.expoactive.com",
          "type": 5,
          "class": 1,
          "ttl": 300,
          "cname": "b'expoactive.com.'"
        },
        {
          "name": "expoactive.com",
          "type": 1,
          "class": 1,
          "ttl": 300,
          "address": "72.3.133.240"
        }
      ],
      "summary": "Ether / IP / UDP / DNS Ans b'expoactive.com.'"
    },
    {
      "packet_number": 9,
      "timestamp": "2006-12-16T19:22:47.202144",
      "source_ip": "192.168.0.114",
      "destination_ip": "205.152.37.23",
      "protocol": "UDP",
      "dns_id": 6159,
      "flags": {
        "is_response": false,
        "authoritative": false,
        "truncated": false,
        "recursion_desired": true,
        "recursion_available": false
      },
      "questions": [
        {
          "name": "wireshark.org",
          "type": 1,
          "class": 1
        }
      ],
      "answers": [],
      "summary": "Ether / IP / UDP / DNS Qry b'wireshark.org.'"
    },
    {
      "packet_number": 10,
      "timestamp": "2006-12-16T19:22:47.293308",
      "source_ip": "205.152.37.23",
      "destination_ip": "192.168.0.114",
      "protocol": "UDP",
      "dns_id": 6159,
      "flags": {
        "is_response": true,
        "authoritative": false,
        "truncated": false,
        "recursion_desired": true,
        "recursion_available": true
      },
      "questions": [
        {
          "name": "wireshark.org",
          "type": 1,
          "class": 1
        }
      ],
      "answers": [
        {
          "name": "wireshark.org",
          "type": 1,
          "class": 1,
          "ttl": 14400,
          "address": "128.121.50.122"
        }
      ],
      "summary": "Ether / IP / UDP / DNS Ans 128.121.50.122"
    },
    {
      "packet_number": 11,
      "timestamp": "2006-12-16T19:22:48.084630",
      "source_ip": "192.168.0.114",
      "destination_ip": "205.152.37.23",
      "protocol": "UDP",
      "dns_id": 37644,
      "flags": {
        "is_response": false,
        "authoritative": false,
        "truncated": false,
        "recursion_desired": true,
        "recursion_available": false
      },
      "questions": [
        {
          "name": "www.winpcap.org",
          "type": 1,
          "class": 1
        }
      ],
      "answers": [],
      "summary": "Ether / IP / UDP / DNS Qry b'www.winpcap.org.'"
    },
    {
      "packet_number": 12,
      "timestamp": "2006-12-16T19:22:48.085521",
      "source_ip": "192.168.0.114",
      "destination_ip": "205.152.37.23",
      "protocol": "UDP",
      "dns_id": 56845,
      "flags": {
        "is_response": false,
        "authoritative": false,
        "truncated": false,
        "recursion_desired": true,
        "recursion_available": false
      },
      "questions": [
        {
          "name": "www.google.com",
          "type": 1,
          "class": 1
        }
      ],
      "answers": [],
      "summary": "Ether / IP / UDP / DNS Qry b'www.google.com.'"
    },
    {
      "packet_number": 13,
      "timestamp": "2006-12-16T19:22:48.137861",
      "source_ip": "205.152.37.23",
      "destination_ip": "192.168.0.114",
      "protocol": "UDP",
      "dns_id": 37644,
      "flags": {
        "is_response": true,
        "authoritative": false,
        "truncated": false,
        "recursion_desired": true,
        "recursion_available": true
      },
      "questions": [
        {
          "name": "www.winpcap.org",
          "type": 1,
          "class": 1
        }
      ],
      "answers": [
        {
          "name": "www.winpcap.org",
          "type": 1,
          "class": 1,
          "ttl": 4736,
          "address": "128.121.79.138"
        }
      ],
      "summary": "Ether / IP / UDP / DNS Ans 128.121.79.138"
    },
    {
      "packet_number": 14,
      "timestamp": "2006-12-16T19:22:48.139437",
      "source_ip": "205.152.37.23",
      "destination_ip": "192.168.0.114",
      "protocol": "UDP",
      "dns_id": 56845,
      "flags": {
        "is_response": true,
        "authoritative": false,
        "truncated": false,
        "recursion_desired": true,
        "recursion_available": true
      },
      "questions": [
        {
          "name": "www.google.com",
          "type": 1,
          "class": 1
        }
      ],
      "answers": [
        {
          "name": "www.google.com",
          "type": 5,
          "class": 1,
          "ttl": 393857,
          "cname": "b'www.l.google.com.'"
        },
        {
          "name": "www.l.google.com",
          "type": 1,
          "class": 1,
          "ttl": 120,
          "address": "72.14.209.104"
        },
        {
          "name": "www.l.google.com",
          "type": 1,
          "class": 1,
          "ttl": 120,
          "address": "72.14.209.99"
        }
      ],
      "summary": "Ether / IP / UDP / DNS Ans b'www.l.google.com.'"
    }
  ]
}

DHCP Analysis Tools

{
  "file": "PCAP_Files/dhcp.pcap",
  "total_packets": 4,
  "dhcp_packets_found": 4,
  "dhcp_packets_analyzed": 4,
  "statistics": {
    "unique_clients_count": 1,
    "unique_servers_count": 1,
    "unique_clients": [
      "00:0b:82:01:fc:42"
    ],
    "unique_servers": [
      "192.168.0.1"
    ],
    "message_type_counts": {
      "DISCOVER": 1,
      "OFFER": 1,
      "REQUEST": 1,
      "ACK": 1
    },
    "transaction_count": 2,
    "transactions": {
      "0x00003d1d": [
        {
          "packet_number": 1,
          "message_type": "DISCOVER",
          "timestamp": "1102274184.317453"
        },
        {
          "packet_number": 2,
          "message_type": "OFFER",
          "timestamp": "1102274184.317748"
        }
      ],
      "0x00003d1e": [
        {
          "packet_number": 3,
          "message_type": "REQUEST",
          "timestamp": "1102274184.387484"
        },
        {
          "packet_number": 4,
          "message_type": "ACK",
          "timestamp": "1102274184.387798"
        }
      ]
    }
  },
  "packets": [
    {
      "packet_number": 1,
      "timestamp": "1102274184.317453",
      "src_ip": "0.0.0.0",
      "dst_ip": "255.255.255.255",
      "src_port": 68,
      "dst_port": 67,
      "op": "Request",
      "transaction_id": "0x00003d1d",
      "client_ip": "0.0.0.0",
      "your_ip": "0.0.0.0",
      "server_ip": "0.0.0.0",
      "relay_ip": "0.0.0.0",
      "client_mac": "00:0b:82:01:fc:42",
      "options": {
        "parameter_request_list": [
          1,
          3,
          6,
          42
        ]
      },
      "message_type": "DISCOVER",
      "message_type_code": 1,
      "client_id": "01:00:0b:82:01:fc:42",
      "requested_ip": "0.0.0.0"
    },
    {
      "packet_number": 2,
      "timestamp": "1102274184.317748",
      "src_ip": "192.168.0.1",
      "dst_ip": "192.168.0.10",
      "src_port": 67,
      "dst_port": 68,
      "op": "Reply",
      "transaction_id": "0x00003d1d",
      "client_ip": "0.0.0.0",
      "your_ip": "192.168.0.10",
      "server_ip": "192.168.0.1",
      "relay_ip": "0.0.0.0",
      "client_mac": "00:0b:82:01:fc:42",
      "options": {
        "subnet_mask": "255.255.255.0",
        "renewal_time": "1800 seconds",
        "rebinding_time": "3150 seconds",
        "lease_time": "3600 seconds"
      },
      "message_type": "OFFER",
      "message_type_code": 2,
      "renewal_time": 1800,
      "rebinding_time": 3150,
      "lease_time": 3600,
      "server_id": "192.168.0.1"
    },
    {
      "packet_number": 3,
      "timestamp": "1102274184.387484",
      "src_ip": "0.0.0.0",
      "dst_ip": "255.255.255.255",
      "src_port": 68,
      "dst_port": 67,
      "op": "Request",
      "transaction_id": "0x00003d1e",
      "client_ip": "0.0.0.0",
      "your_ip": "0.0.0.0",
      "server_ip": "0.0.0.0",
      "relay_ip": "0.0.0.0",
      "client_mac": "00:0b:82:01:fc:42",
      "options": {
        "parameter_request_list": [
          1,
          3,
          6,
          42
        ]
      },
      "message_type": "REQUEST",
      "message_type_code": 3,
      "client_id": "01:00:0b:82:01:fc:42",
      "requested_ip": "192.168.0.10",
      "server_id": "192.168.0.1"
    },
    {
      "packet_number": 4,
      "timestamp": "1102274184.387798",
      "src_ip": "192.168.0.1",
      "dst_ip": "192.168.0.10",
      "src_port": 67,
      "dst_port": 68,
      "op": "Reply",
      "transaction_id": "0x00003d1e",
      "client_ip": "0.0.0.0",
      "your_ip": "192.168.0.10",
      "server_ip": "0.0.0.0",
      "relay_ip": "0.0.0.0",
      "client_mac": "00:0b:82:01:fc:42",
      "options": {
        "renewal_time": "1800 seconds",
        "rebinding_time": "3150 seconds",
        "lease_time": "3600 seconds",
        "subnet_mask": "255.255.255.0"
      },
      "message_type": "ACK",
      "message_type_code": 5,
      "renewal_time": 1800,
      "rebinding_time": 3150,
      "lease_time": 3600,
      "server_id": "192.168.0.1"
    }
  ]
}

ICMP Analysis Module

{
  "file": "PCAP_Files/icmp.pcap",
  "analysis_timestamp": "2026-04-17T12:27:53.686138",
  "total_packets": 16,
  "icmp_packets_found": 16,
  "icmp_packets_analyzed": 16,
  "statistics": {
    "icmp_type_counts": {
      "Echo Request": 8,
      "Echo Reply": 8
    },
    "unique_sources_count": 3,
    "unique_destinations_count": 3,
    "unique_sources": [
      "192.168.0.1",
      "192.168.0.114",
      "72.14.207.99"
    ],
    "unique_destinations": [
      "192.168.0.1",
      "192.168.0.114",
      "72.14.207.99"
    ],
    "echo_sessions": 1,
    "echo_pairs": {
      "768": {
        "requests": 8,
        "replies": 8
      }
    },
    "unreachable_destinations_count": 0,
    "unreachable_destinations": []
  },
  "packets": [
    {
      "packet_number": 1,
      "timestamp": "2006-12-29T04:10:10.660442",
      "src_ip": "192.168.0.114",
      "dst_ip": "192.168.0.1",
      "ip_version": 4,
      "ttl": 128,
      "packet_size": 74,
      "icmp_type": 8,
      "icmp_code": 0,
      "icmp_type_name": "Echo Request",
      "icmp_id": 768,
      "icmp_seq": 256,
      "checksum": 18780,
      "icmp_code_name": "Code 0"
    },
    {
      "packet_number": 2,
      "timestamp": "2006-12-29T04:10:10.661527",
      "src_ip": "192.168.0.1",
      "dst_ip": "192.168.0.114",
      "ip_version": 4,
      "ttl": 127,
      "packet_size": 74,
      "icmp_type": 0,
      "icmp_code": 0,
      "icmp_type_name": "Echo Reply",
      "icmp_id": 768,
      "icmp_seq": 256,
      "checksum": 20828,
      "icmp_code_name": "Code 0"
    },
    {
      "packet_number": 3,
      "timestamp": "2006-12-29T04:10:11.657215",
      "src_ip": "192.168.0.114",
      "dst_ip": "192.168.0.1",
      "ip_version": 4,
      "ttl": 128,
      "packet_size": 74,
      "icmp_type": 8,
      "icmp_code": 0,
      "icmp_type_name": "Echo Request",
      "icmp_id": 768,
      "icmp_seq": 512,
      "checksum": 18524,
      "icmp_code_name": "Code 0"
    },
    {
      "packet_number": 4,
      "timestamp": "2006-12-29T04:10:11.659425",
      "src_ip": "192.168.0.1",
      "dst_ip": "192.168.0.114",
      "ip_version": 4,
      "ttl": 127,
      "packet_size": 74,
      "icmp_type": 0,
      "icmp_code": 0,
      "icmp_type_name": "Echo Reply",
      "icmp_id": 768,
      "icmp_seq": 512,
      "checksum": 20572,
      "icmp_code_name": "Code 0"
    },
    {
      "packet_number": 5,
      "timestamp": "2006-12-29T04:10:12.657243",
      "src_ip": "192.168.0.114",
      "dst_ip": "192.168.0.1",
      "ip_version": 4,
      "ttl": 128,
      "packet_size": 74,
      "icmp_type": 8,
      "icmp_code": 0,
      "icmp_type_name": "Echo Request",
      "icmp_id": 768,
      "icmp_seq": 768,
      "checksum": 18268,
      "icmp_code_name": "Code 0"
    },
    {
      "packet_number": 6,
      "timestamp": "2006-12-29T04:10:12.659529",
      "src_ip": "192.168.0.1",
      "dst_ip": "192.168.0.114",
      "ip_version": 4,
      "ttl": 127,
      "packet_size": 74,
      "icmp_type": 0,
      "icmp_code": 0,
      "icmp_type_name": "Echo Reply",
      "icmp_id": 768,
      "icmp_seq": 768,
      "checksum": 20316,
      "icmp_code_name": "Code 0"
    },
    {
      "packet_number": 7,
      "timestamp": "2006-12-29T04:10:13.657282",
      "src_ip": "192.168.0.114",
      "dst_ip": "192.168.0.1",
      "ip_version": 4,
      "ttl": 128,
      "packet_size": 74,
      "icmp_type": 8,
      "icmp_code": 0,
      "icmp_type_name": "Echo Request",
      "icmp_id": 768,
      "icmp_seq": 1024,
      "checksum": 18012,
      "icmp_code_name": "Code 0"
    },
    {
      "packet_number": 8,
      "timestamp": "2006-12-29T04:10:13.659619",
      "src_ip": "192.168.0.1",
      "dst_ip": "192.168.0.114",
      "ip_version": 4,
      "ttl": 127,
      "packet_size": 74,
      "icmp_type": 0,
      "icmp_code": 0,
      "icmp_type_name": "Echo Reply",
      "icmp_id": 768,
      "icmp_seq": 1024,
      "checksum": 20060,
      "icmp_code_name": "Code 0"
    },
    {
      "packet_number": 9,
      "timestamp": "2006-12-29T04:10:16.794628",
      "src_ip": "192.168.0.114",
      "dst_ip": "72.14.207.99",
      "ip_version": 4,
      "ttl": 128,
      "packet_size": 74,
      "icmp_type": 8,
      "icmp_code": 0,
      "icmp_type_name": "Echo Request",
      "icmp_id": 768,
      "icmp_seq": 1280,
      "checksum": 17756,
      "icmp_code_name": "Code 0"
    },
    {
      "packet_number": 10,
      "timestamp": "2006-12-29T04:10:16.875473",
      "src_ip": "72.14.207.99",
      "dst_ip": "192.168.0.114",
      "ip_version": 4,
      "ttl": 232,
      "packet_size": 74,
      "icmp_type": 0,
      "icmp_code": 0,
      "icmp_type_name": "Echo Reply",
      "icmp_id": 768,
      "icmp_seq": 1280,
      "checksum": 19804,
      "icmp_code_name": "Code 0"
    },
    {
      "packet_number": 11,
      "timestamp": "2006-12-29T04:10:17.796100",
      "src_ip": "192.168.0.114",
      "dst_ip": "72.14.207.99",
      "ip_version": 4,
      "ttl": 128,
      "packet_size": 74,
      "icmp_type": 8,
      "icmp_code": 0,
      "icmp_type_name": "Echo Request",
      "icmp_id": 768,
      "icmp_seq": 1536,
      "checksum": 17500,
      "icmp_code_name": "Code 0"
    },
    {
      "packet_number": 12,
      "timestamp": "2006-12-29T04:10:17.858014",
      "src_ip": "72.14.207.99",
      "dst_ip": "192.168.0.114",
      "ip_version": 4,
      "ttl": 232,
      "packet_size": 74,
      "icmp_type": 0,
      "icmp_code": 0,
      "icmp_type_name": "Echo Reply",
      "icmp_id": 768,
      "icmp_seq": 1536,
      "checksum": 19548,
      "icmp_code_name": "Code 0"
    },
    {
      "packet_number": 13,
      "timestamp": "2006-12-29T04:10:18.797110",
      "src_ip": "192.168.0.114",
      "dst_ip": "72.14.207.99",
      "ip_version": 4,
      "ttl": 128,
      "packet_size": 74,
      "icmp_type": 8,
      "icmp_code": 0,
      "icmp_type_name": "Echo Request",
      "icmp_id": 768,
      "icmp_seq": 1792,
      "checksum": 17244,
      "icmp_code_name": "Code 0"
    },
    {
      "packet_number": 14,
      "timestamp": "2006-12-29T04:10:18.859585",
      "src_ip": "72.14.207.99",
      "dst_ip": "192.168.0.114",
      "ip_version": 4,
      "ttl": 232,
      "packet_size": 74,
      "icmp_type": 0,
      "icmp_code": 0,
      "icmp_type_name": "Echo Reply",
      "icmp_id": 768,
      "icmp_seq": 1792,
      "checksum": 19292,
      "icmp_code_name": "Code 0"
    },
    {
      "packet_number": 15,
      "timestamp": "2006-12-29T04:10:19.798127",
      "src_ip": "192.168.0.114",
      "dst_ip": "72.14.207.99",
      "ip_version": 4,
      "ttl": 128,
      "packet_size": 74,
      "icmp_type": 8,
      "icmp_code": 0,
      "icmp_type_name": "Echo Request",
      "icmp_id": 768,
      "icmp_seq": 2048,
      "checksum": 16988,
      "icmp_code_name": "Code 0"
    },
    {
      "packet_number": 16,
      "timestamp": "2006-12-29T04:10:19.859920",
      "src_ip": "72.14.207.99",
      "dst_ip": "192.168.0.114",
      "ip_version": 4,
      "ttl": 232,
      "packet_size": 74,
      "icmp_type": 0,
      "icmp_code": 0,
      "icmp_type_name": "Echo Reply",
      "icmp_id": 768,
      "icmp_seq": 2048,
      "checksum": 19036,
      "icmp_code_name": "Code 0"
    }
  ]
}

TCP Analysis Tools

TCP Analysis Connection

{
  "file": "PCAP_Files/tcp-con-lost.pcap",
  "analysis_timestamp": "2026-04-17T12:36:54.802604",
  "total_packets": 9,
  "tcp_packets_found": 9,
  "filter": {
    "server_ip": null,
    "server_port": null
  },
  "summary": {
    "total_connections": 1,
    "successful_handshakes": 0,
    "failed_handshakes": 1,
    "established_connections": 0,
    "reset_connections": 0,
    "normal_close": 0,
    "active_connections": 1
  },
  "connections": [
    {
      "client": "10.3.71.7:1043",
      "server": "10.3.30.1:1048",
      "state": "active",
      "handshake_completed": false,
      "syn_count": 0,
      "syn_ack_count": 0,
      "ack_count": 9,
      "rst_count": 0,
      "fin_count": 0,
      "data_packets": 9,
      "retransmissions": 7,
      "close_reason": "active",
      "packet_count": 9
    }
  ],
  "issues": [
    "7 retransmissions detected",
    "1 failed handshakes"
  ]
}

TCP Analysis Anomalies

{
  "file": "PCAP_Files/tcp-anomalies.pcap",
  "analysis_timestamp": "2026-04-17T12:55:20.772116",
  "filter": {
    "server_ip": "192.168.1.1",
    "server_port": 80
  },
  "statistics": {
    "total_connections": 0,
    "total_packets": 0,
    "handshake": {
      "successful": 0,
      "failed": 0,
      "incomplete": 0
    },
    "flags": {
      "syn": 0,
      "syn_ack": 0,
      "rst": 0,
      "fin": 0,
      "ack": 0
    },
    "rst_distribution": {
      "by_source": {},
      "by_direction": {
        "to_server": 0,
        "from_server": 0,
        "unknown": 0
      },
      "connections_with_rst": []
    },
    "retransmissions": {
      "total": 0,
      "by_connection": {},
      "rate": 0
    },
    "connection_states": {
      "established": 0,
      "reset": 0,
      "closed": 0,
      "unknown": 0
    }
  },
  "patterns": [],
  "summary": {
    "total_patterns": 0,
    "by_category": {},
    "notable_observations": []
  }
}

TCP Analysis Retransmission

{
  "file": "PCAP_Files/tcp-retransmission.pcap",
  "analysis_timestamp": "2026-04-17T12:42:29.250132",
  "total_packets": 0,
  "total_retransmissions": 0,
  "retransmission_rate": 0,
  "threshold": 0.02,
  "exceeds_threshold": false,
  "by_connection": [],
  "summary": {
    "worst_connection": "",
    "worst_retrans_rate": 0,
    "connections_above_threshold": 0
  }
}

TCP Analysis Traffic

{
  "file": "PCAP_Files/tcp-traffic.pcap",
  "analysis_timestamp": "2026-04-23T09:58:35.223370",
  "server": "10.3.30.1:1048:any",
  "client_to_server": {
    "packet_count": 0,
    "byte_count": 0,
    "syn_count": 0,
    "rst_count": 0,
    "fin_count": 0,
    "data_packets": 0,
    "retransmissions": 0
  },
  "server_to_client": {
    "packet_count": 0,
    "byte_count": 0,
    "syn_count": 0,
    "rst_count": 0,
    "fin_count": 0,
    "data_packets": 0,
    "retransmissions": 0
  },
  "analysis": {
    "asymmetry_ratio": 0,
    "primary_rst_source": "balanced",
    "data_flow_direction": "server_heavy",
    "interpretation": "Balanced RST distribution."
  }
}

SIP (VOIP) Analysis Tools

{
  "file": "PCAP_Files/sip.pcap",
  "analysis_timestamp": "2026-04-17T13:01:15.089593",
  "total_packets_in_file": 84,
  "sip_packets_found": 7,
  "sip_packets_analyzed": 7,
  "statistics": {
    "requests": 3,
    "responses": 4,
    "methods": {
      "ACK": 1,
      "BYE": 1,
      "INVITE": 1
    },
    "response_classes": {
      "1xx": 2,
      "2xx": 2
    },
    "unique_call_ids": 1,
    "call_ids": [
      "[email protected]"
    ],
    "transports": {
      "TCP": 7
    },
    "user_agents": [
      "GW/v.6.20A.027.012",
      "IPP/v.6.20A.027.012"
    ]
  },
  "packets": [
    {
      "packet_number": 1,
      "timestamp": "2011-07-28T13:54:46.562096",
      "source_ip": "10.33.6.100",
      "destination_ip": "10.33.6.101",
      "source_port": 64802,
      "destination_port": 5060,
      "transport": "TCP",
      "message_type": "request",
      "start_line": "INVITE sip:[email protected];user=phone SIP/2.0",
      "call_id": "[email protected]",
      "cseq": "1 INVITE",
      "from": "<sip:[email protected]>;tag=1c1589367133",
      "to": "<sip:[email protected];user=phone>",
      "contact": "<sip:[email protected]:5060;transport=tcp>",
      "user_agent": "IPP/v.6.20A.027.012",
      "server": "",
      "via": "SIP/2.0/TCP 10.33.6.100;branch=z9hG4bKac1589375893;alias",
      "content_type": "application/sdp",
      "content_length": 228,
      "body_length": 217,
      "known_sip_port": true,
      "headers": {
        "via": "SIP/2.0/TCP 10.33.6.100;branch=z9hG4bKac1589375893;alias",
        "max-forwards": "70",
        "from": "<sip:[email protected]>;tag=1c1589367133",
        "to": "<sip:[email protected];user=phone>",
        "call-id": "[email protected]",
        "cseq": "1 INVITE",
        "contact": "<sip:[email protected]:5060;transport=tcp>",
        "supported": "em,timer,replaces,path,resource-priority,sdp-anat",
        "allow": "REGISTER,OPTIONS,INVITE,ACK,CANCEL,BYE,NOTIFY,PRACK,REFER,INFO,SUBSCRIBE,UPDATE",
        "user-agent": "IPP/v.6.20A.027.012",
        "content-type": "application/sdp",
        "content-length": "228"
      },
      "summary": "Ether / IP / TCP 10.33.6.100:64802 > 10.33.6.101:sip PA / Raw",
      "method": "INVITE",
      "request_uri": "sip:[email protected];user=phone",
      "sip_version": "SIP/2.0"
    },
    {
      "packet_number": 2,
      "timestamp": "2011-07-28T13:54:46.602589",
      "source_ip": "10.33.6.101",
      "destination_ip": "10.33.6.100",
      "source_port": 5060,
      "destination_port": 64802,
      "transport": "TCP",
      "message_type": "response",
      "start_line": "SIP/2.0 100 Trying",
      "call_id": "[email protected]",
      "cseq": "1 INVITE",
      "from": "<sip:[email protected]>;tag=1c1589367133",
      "to": "<sip:[email protected];user=phone>;tag=1c342958875",
      "contact": "",
      "user_agent": "",
      "server": "GW/v.6.20A.027.012",
      "via": "SIP/2.0/TCP 10.33.6.100;branch=z9hG4bKac1589375893;alias",
      "content_type": "",
      "content_length": 0,
      "body_length": 0,
      "known_sip_port": true,
      "headers": {
        "via": "SIP/2.0/TCP 10.33.6.100;branch=z9hG4bKac1589375893;alias",
        "from": "<sip:[email protected]>;tag=1c1589367133",
        "to": "<sip:[email protected];user=phone>;tag=1c342958875",
        "call-id": "[email protected]",
        "cseq": "1 INVITE",
        "supported": "em,timer,replaces,path,early-session,resource-priority",
        "allow": "REGISTER,OPTIONS,INVITE,ACK,CANCEL,BYE,NOTIFY,PRACK,REFER,INFO,SUBSCRIBE,UPDATE",
        "server": "GW/v.6.20A.027.012",
        "content-length": "0"
      },
      "summary": "Ether / IP / TCP 10.33.6.101:sip > 10.33.6.100:64802 PA / Raw",
      "status_code": 100,
      "reason_phrase": "Trying"
    },
    {
      "packet_number": 3,
      "timestamp": "2011-07-28T13:54:46.621123",
      "source_ip": "10.33.6.101",
      "destination_ip": "10.33.6.100",
      "source_port": 5060,
      "destination_port": 64802,
      "transport": "TCP",
      "message_type": "response",
      "start_line": "SIP/2.0 180 Ringing",
      "call_id": "[email protected]",
      "cseq": "1 INVITE",
      "from": "<sip:[email protected]>;tag=1c1589367133",
      "to": "<sip:[email protected];user=phone>;tag=1c342958875",
      "contact": "<sip:[email protected]:5060;transport=tcp>",
      "user_agent": "",
      "server": "GW/v.6.20A.027.012",
      "via": "SIP/2.0/TCP 10.33.6.100;branch=z9hG4bKac1589375893;alias",
      "content_type": "",
      "content_length": 0,
      "body_length": 0,
      "known_sip_port": true,
      "headers": {
        "via": "SIP/2.0/TCP 10.33.6.100;branch=z9hG4bKac1589375893;alias",
        "from": "<sip:[email protected]>;tag=1c1589367133",
        "to": "<sip:[email protected];user=phone>;tag=1c342958875",
        "call-id": "[email protected]",
        "cseq": "1 INVITE",
        "contact": "<sip:[email protected]:5060;transport=tcp>",
        "supported": "em,timer,replaces,path,early-session,resource-priority",
        "allow": "REGISTER,OPTIONS,INVITE,ACK,CANCEL,BYE,NOTIFY,PRACK,REFER,INFO,SUBSCRIBE,UPDATE",
        "server": "GW/v.6.20A.027.012",
        "content-length": "0"
      },
      "summary": "Ether / IP / TCP 10.33.6.101:sip > 10.33.6.100:64802 PA / Raw",
      "status_code": 180,
      "reason_phrase": "Ringing"
    },
    {
      "packet_number": 4,
      "timestamp": "2011-07-28T13:54:50.905636",
      "source_ip": "10.33.6.101",
      "destination_ip": "10.33.6.100",
      "source_port": 5060,
      "destination_port": 64802,
      "transport": "TCP",
      "message_type": "response",
      "start_line": "SIP/2.0 200 OK",
      "call_id": "[email protected]",
      "cseq": "1 INVITE",
      "from": "<sip:[email protected]>;tag=1c1589367133",
      "to": "<sip:[email protected];user=phone>;tag=1c342958875",
      "contact": "<sip:[email protected]:5060;transport=tcp>",
      "user_agent": "",
      "server": "GW/v.6.20A.027.012",
      "via": "SIP/2.0/TCP 10.33.6.100;branch=z9hG4bKac1589375893;alias",
      "content_type": "application/sdp",
      "content_length": 225,
      "body_length": 214,
      "known_sip_port": true,
      "headers": {
        "via": "SIP/2.0/TCP 10.33.6.100;branch=z9hG4bKac1589375893;alias",
        "from": "<sip:[email protected]>;tag=1c1589367133",
        "to": "<sip:[email protected];user=phone>;tag=1c342958875",
        "call-id": "[email protected]",
        "cseq": "1 INVITE",
        "contact": "<sip:[email protected]:5060;transport=tcp>",
        "supported": "em,timer,replaces,path,early-session,resource-priority",
        "allow": "REGISTER,OPTIONS,INVITE,ACK,CANCEL,BYE,NOTIFY,PRACK,REFER,INFO,SUBSCRIBE,UPDATE",
        "server": "GW/v.6.20A.027.012",
        "content-type": "application/sdp",
        "content-length": "225"
      },
      "summary": "Ether / IP / TCP 10.33.6.101:sip > 10.33.6.100:64802 PA / Raw",
      "status_code": 200,
      "reason_phrase": "OK"
    },
    {
      "packet_number": 5,
      "timestamp": "2011-07-28T13:54:50.933132",
      "source_ip": "10.33.6.100",
      "destination_ip": "10.33.6.101",
      "source_port": 64802,
      "destination_port": 5060,
      "transport": "TCP",
      "message_type": "request",
      "start_line": "ACK sip:[email protected]:5060;transport=tcp SIP/2.0",
      "call_id": "[email protected]",
      "cseq": "1 ACK",
      "from": "<sip:[email protected]>;tag=1c1589367133",
      "to": "<sip:[email protected];user=phone>;tag=1c342958875",
      "contact": "<sip:[email protected]:5060;transport=tcp>",
      "user_agent": "IPP/v.6.20A.027.012",
      "server": "",
      "via": "SIP/2.0/TCP 10.33.6.100;branch=z9hG4bKac1600323074;alias",
      "content_type": "",
      "content_length": 0,
      "body_length": 0,
      "known_sip_port": true,
      "headers": {
        "via": "SIP/2.0/TCP 10.33.6.100;branch=z9hG4bKac1600323074;alias",
        "max-forwards": "70",
        "from": "<sip:[email protected]>;tag=1c1589367133",
        "to": "<sip:[email protected];user=phone>;tag=1c342958875",
        "call-id": "[email protected]",
        "cseq": "1 ACK",
        "contact": "<sip:[email protected]:5060;transport=tcp>",
        "supported": "em,timer,replaces,path,resource-priority",
        "allow": "REGISTER,OPTIONS,INVITE,ACK,CANCEL,BYE,NOTIFY,PRACK,REFER,INFO,SUBSCRIBE,UPDATE",
        "user-agent": "IPP/v.6.20A.027.012",
        "content-length": "0"
      },
      "summary": "Ether / IP / TCP 10.33.6.100:64802 > 10.33.6.101:sip PA / Raw",
      "method": "ACK",
      "request_uri": "sip:[email protected]:5060;transport=tcp",
      "sip_version": "SIP/2.0"
    },
    {
      "packet_number": 6,
      "timestamp": "2011-07-28T13:54:53.057152",
      "source_ip": "10.33.6.101",
      "destination_ip": "10.33.6.100",
      "source_port": 5060,
      "destination_port": 64802,
      "transport": "TCP",
      "message_type": "request",
      "start_line": "BYE sip:[email protected]:5060;transport=tcp SIP/2.0",
      "call_id": "[email protected]",
      "cseq": "1 BYE",
      "from": "<sip:[email protected];user=phone>;tag=1c342958875",
      "to": "<sip:[email protected]>;tag=1c1589367133",
      "contact": "",
      "user_agent": "GW/v.6.20A.027.012",
      "server": "",
      "via": "SIP/2.0/TCP 10.33.6.101;branch=z9hG4bKac359152811;alias",
      "content_type": "",
      "content_length": 0,
      "body_length": 0,
      "known_sip_port": true,
      "headers": {
        "via": "SIP/2.0/TCP 10.33.6.101;branch=z9hG4bKac359152811;alias",
        "max-forwards": "70",
        "from": "<sip:[email protected];user=phone>;tag=1c342958875",
        "to": "<sip:[email protected]>;tag=1c1589367133",
        "call-id": "[email protected]",
        "cseq": "1 BYE",
        "supported": "em,timer,replaces,path,early-session,resource-priority",
        "allow": "REGISTER,OPTIONS,INVITE,ACK,CANCEL,BYE,NOTIFY,PRACK,REFER,INFO,SUBSCRIBE,UPDATE",
        "user-agent": "GW/v.6.20A.027.012",
        "reason": "Q.850 ;cause=16 ;text=\"local\"",
        "content-length": "0"
      },
      "summary": "Ether / IP / TCP 10.33.6.101:sip > 10.33.6.100:64802 PA / Raw",
      "method": "BYE",
      "request_uri": "sip:[email protected]:5060;transport=tcp",
      "sip_version": "SIP/2.0"
    },
    {
      "packet_number": 7,
      "timestamp": "2011-07-28T13:54:53.088359",
      "source_ip": "10.33.6.100",
      "destination_ip": "10.33.6.101",
      "source_port": 64802,
      "destination_port": 5060,
      "transport": "TCP",
      "message_type": "response",
      "start_line": "SIP/2.0 200 OK",
      "call_id": "[email protected]",
      "cseq": "1 BYE",
      "from": "<sip:[email protected];user=phone>;tag=1c342958875",
      "to": "<sip:[email protected]>;tag=1c1589367133",
      "contact": "<sip:[email protected]:5060;transport=tcp>",
      "user_agent": "",
      "server": "IPP/v.6.20A.027.012",
      "via": "SIP/2.0/TCP 10.33.6.101;branch=z9hG4bKac359152811;alias",
      "content_type": "",
      "content_length": 0,
      "body_length": 0,
      "known_sip_port": true,
      "headers": {
        "via": "SIP/2.0/TCP 10.33.6.101;branch=z9hG4bKac359152811;alias",
        "from": "<sip:[email protected];user=phone>;tag=1c342958875",
        "to": "<sip:[email protected]>;tag=1c1589367133",
        "call-id": "[email protected]",
        "cseq": "1 BYE",
        "contact": "<sip:[email protected]:5060;transport=tcp>",
        "supported": "em,timer,replaces,path,resource-priority",
        "allow": "REGISTER,OPTIONS,INVITE,ACK,CANCEL,BYE,NOTIFY,PRACK,REFER,INFO,SUBSCRIBE,UPDATE",
        "server": "IPP/v.6.20A.027.012",
        "content-length": "0"
      },
      "summary": "Ether / IP / TCP 10.33.6.100:64802 > 10.33.6.101:sip PA / Raw",
      "status_code": 200,
      "reason_phrase": "OK"
    }
  ]
}

Contact

BEN ALI Mohamed

Email : [email protected]

LinkedIn : https://linkedin.com/in/medbenali