IT / SECURITY
Wireshark Log Programming
Using Python to read Wireshark capture logs and detect port scans, beaconing, and brute-force attempts.
NETWORK ANALYSIS
A set of Python analyzers that read Wireshark JSON captures and look for attack patterns. PowerShell calls tshark to record traffic, then Python steps through the logs to flag brute-force login attempts, port scans, and periodic beaconing that can signal command-and-control traffic. When something suspicious is found, a Discord webhook carries the alert.
PowerShell ยท Wireshark log pipeline
PS C:\Users\j_wil\Documents\DevTools> tools port-scan Capturing TCP traffic for 60 seconds... Wrote capture to E:\securitylogs\portscan_capture_20261025_212413.json PS C:\Users\j_wil\Documents\DevTools> python analyzepy\analyzeport.py Reading: portscan_capture_20261025_212413.json Built 199 rows Discord alert sent for source IP: 10.0.0.8 Moved to E:\securitylogs\processed\portscan_capture_20261025_212413.json Done
Capturing traffic with tshark
PowerShell runs tshark with a short display filter, usually TCP or TCP plus UDP, and writes the output as JSON. Each packet keeps the fields: frame time, source and destination IPs, source and destination ports, TCP flags, and the SYN flag. The JSON then becomes the input for the Python side.
Port scan detection
The port scan analyzer groups SYN packets by source and destination IP, then counts how many distinct destination ports the source touched. Once the count passes a threshold, it is flagged as a scan. A single alert is sent per source-target pair with the list of ports that were probed.
Beaconing and C2 detection
The beacon detector looks for a single source talking to the same destination on the same protocol and port at very regular intervals. It parses the frame timestamps, measures the gaps between connections, and uses the coefficient of variation to decide whether the timing is machine-regular. Whitelisted ports and RFC1918 destinations can be skipped.
Brute-force login monitoring
A separate PowerShell collector pulls Windows Security event ID 4625, failed logon, and writes each attempt to JSON with the source IP, targeted username, and timestamp. The Python analyzer groups attempts by source IP and sends an alert when an IP crosses a failure threshold.
SQLite storage and execution tracking
Network flows are stored in a local SQLite database. Each run logs one row to a captures table to track execution, while individual packet records go into a flows table. This keeps a history that can be queried later without re-parsing raw capture files. The total amount of logs will be expanded as I write more capable programs and databases.
Why Python for the analysis
PowerShell is great at collecting Windows events and launching tshark, but Python makes the math and the parsing easier. I am currently rewriting everything in python so that python handles everything. JSON, datetime handling, statistics, and HTTP webhooks all fit cleanly into Python, so the analyzer stays small and readable while still catching real attack patterns.