Skip to content

Latest commit

 

History

History
70 lines (54 loc) · 3.82 KB

README.md

File metadata and controls

70 lines (54 loc) · 3.82 KB
Raw

SYN FLOOD Detection and Email Alert System

This C++ project captures network packets using the libpcap library, detects potential SYN flood attacks, and sends an email alert using libcurl when a SYN flood is detected. The program logs packet information into a file and monitors SYN requests, sending an alert if the number of SYN packets from a particular source IP exceeds a predefined threshold within a specified time window.

Features

  • Packet Capture: Uses libpcap to capture live network packets on a specified interface.
  • SYN Flood Detection: Detects potential SYN floods by tracking SYN packets from source IPs.
  • Email Alerts: Sends an email notification when a SYN flood is detected using libcurl.
  • Logging: Logs packet details, including IP addresses, ports, and timestamps, to a file.

Requirements

Libraries:

  • libpcap: For capturing and analyzing network packets.
  • libcurl: For sending email notifications via SMTP.

To install these libraries:

  • On Ubuntu/Debian: 
    sudo apt-get install libpcap-dev libcurl4-openssl-dev

Environment Variables:

Set the following environment variables before running the program:

  • EMAIL_PASSWORD: Your email app password (e.g., for Gmail, use an app password).
  • SENDER_EMAIL: The email address from which alerts will be sent.
  • RECEIVER_EMAIL: The email address that will receive alerts.
  • PACKETS_FILE_PATH: Path to the file where packet logs will be saved (optional, defaults to packets_file.txt).

How It Works:

  • Packet Capture: The program captures TCP packets using libpcap.
  • SYN Flood Detection: For each TCP packet, it checks if it is a SYN packet. If a source IP sends more than 20 SYN packets within 60 seconds, a potential SYN flood is detected.
  • Email Alert: When a SYN flood is detected, the program sends an email to the specified recipient with details about the attack.
  • Logging: All captured packets are logged to a file, including timestamps, IP addresses, ports, and the number of detected SYN packets.

Code Overview

  • packet_handler(): Callback function that processes each captured packet. It checks if the packet is a TCP packet and logs the information. If it detects SYN packets, it passes the data to handle_tcp_packet().

  • handle_tcp_packet(): Tracks the number of SYN packets from each source IP and detects if a SYN flood is occurring. If a flood is detected, it sends an alert email and resets the count for the source IP.

  • send_email_alert(): Uses libcurl to send an email when a SYN flood is detected. The email contains details about the source IP, SYN count, source, and destination ports.

  • Main Function:

    • Opens the network interface for packet capture using pcap_open_live().
    • Sets up a filter to capture only IP packets.
    • Starts the packet capture loop using pcap_loop().

Constants

  • PACKETS_TO_CAPTURE: Total number of packets to capture (default: 70).
  • SYN_THRESHOLD: Number of SYN packets from a single IP that triggers an alert (default: 20).
  • TIME_WINDOW: Time window in seconds to monitor for SYN floods (default: 60).

Example Email Alert

When a SYN flood is detected, you will receive an email like this

From: sender@example.com
Subject: SYN Flood Detected from IP: 192.168.1.100

Potential SYN flood detected.

--------------------------------------------------
IP address: 192.168.1.100.
SYN Count: 25 under 60s.
Source Port: 53217
Destination Port: 80
--------------------------------------------------

Troubleshooting

  • Error: EMAIL_PASSWORD environment variable not set! Ensure that the environment variables for the email credentials are correctly set.
  • Couldn't open device: ... Check if the network interface is correct. You may need to change "wlp0s20f3" to your network device name (e.g., "eth0" or "en0").