Listen to this Post
Introduction:
In the modern cybersecurity landscape, passive reconnaissance and real-time network monitoring are the first lines of defense against unauthorized access. GhostTrace is an open-source Intrusion Detection System (IDS) that leverages Python, Scapy, and MAC address fingerprinting to create a live web dashboard for network visibility. By analyzing the Organizationally Unique Identifier (OUI) in MAC addresses, this tool maps devices to their vendors and classifies threat levels, turning raw packet data into actionable security intelligence.
Learning Objectives:
- Understand how to perform real-time network device discovery using Python and Scapy.
- Learn how to implement MAC address fingerprinting to identify device vendors.
- Develop a live web dashboard using Flask to visualize network threats.
- Configure threat classification logic to distinguish between safe, suspicious, and high-risk devices.
- Explore the fundamentals of building a custom IDS for cloud and local network defense.
You Should Know:
- Setting Up the Environment and Capturing Network Traffic
GhostTrace relies on the Scapy library to sniff network packets. To begin, we must set up a Linux environment (or Windows with Npcap) and install the necessary dependencies. The core of real-time detection lies in ARP (Address Resolution Protocol) monitoring, as devices on a local network communicate via ARP to map IP addresses to MAC addresses.
Step‑by‑step guide:
First, update your system and install Python3, pip, and Scapy:
sudo apt update && sudo apt upgrade -y sudo apt install python3 python3-pip -y pip install scapy flask
To capture live traffic, you need root privileges. Create a Python script called sniffer.py:
from scapy.all import ARP, sniff
def arp_display(pkt):
if pkt.haslayer(ARP):
if pkt[bash].op == 1: who-has (request)
return f"Request: {pkt[bash].psrc} is asking about {pkt[bash].pdst}"
elif pkt[bash].op == 2: is-at (response)
return f"Response: {pkt[bash].hwsrc} has IP {pkt[bash].psrc}"
sniff(prn=arp_display, filter="arp", store=0)
Run this with `sudo python3 sniffer.py` to see live ARP traffic.
2. MAC Address Fingerprinting and Vendor Lookup
Once a device’s MAC address is captured, the first 24 bits (OUI) reveal the manufacturer. GhostTrace uses a local database or an API to map these OUIs. You can build a simple lookup function using a publicly available OUI list.
Step‑by‑step guide:
Download the IEEE OUI database:
wget http://standards-oui.ieee.org/oui.txt
Parse the file and create a Python dictionary. Here’s a snippet to extract vendor information from a MAC:
def get_vendor(mac):
oui = mac[:8].upper().replace(':', '') Format: xxxxxx
with open('oui.txt', 'r') as f:
for line in f:
if oui in line:
return line.split('(hex)')[bash].strip()
return "Unknown"
For efficiency in a real-time system, load the OUI data into memory at startup.
3. Threat Level Classification Logic
GhostTrace classifies devices based on the vendor and behavior. For example, unknown vendors, spoofed MACs, or devices sending excessive ARP requests can be flagged as “SUSPICIOUS” or “HIGH RISK.”
Step‑by‑step guide:
Implement a scoring function:
def classify_threat(mac, vendor, packet_rate):
score = 0
if vendor == "Unknown":
score += 30
if packet_rate > 10: High ARP rate might indicate scanning
score += 50
if mac.startswith("ff:ff:ff"): Broadcast MACs are normal
score = 0
if score >= 70:
return "HIGH RISK"
elif score >= 30:
return "SUSPICIOUS"
else:
return "SAFE"
This logic can be extended to check against known malicious OUI lists or to detect MAC randomization used by mobile devices.
4. Building the Live Web Dashboard with Flask
GhostTrace uses Flask to serve a real-time dashboard. The captured data is stored in a Python list (or a database for persistence) and updated asynchronously. The dashboard auto-refreshes to display active devices and their threat levels.
Step‑by‑step guide:
Create `app.py`:
from flask import Flask, render_template, jsonify
import threading
import time
app = Flask(<strong>name</strong>)
devices = []
def update_devices():
global devices
while True:
Simulate fetching new data from sniffer
devices = capture_network_devices() Your function here
time.sleep(5)
@app.route('/')
def index():
return render_template('dashboard.html', devices=devices)
@app.route('/api/devices')
def api_devices():
return jsonify(devices)
if <strong>name</strong> == '<strong>main</strong>':
thread = threading.Thread(target=update_devices)
thread.daemon = True
thread.start()
app.run(host='0.0.0.0', port=5000, debug=True)
Create a simple HTML template (templates/dashboard.html) that uses JavaScript to fetch and display data from the `/api/devices` endpoint.
5. Automating Monitoring and Alerting
To transform this script into a robust IDS, you need automation. Use cron jobs or systemd services to ensure the sniffer and dashboard run continuously. Additionally, integrate email or desktop notifications for HIGH RISK devices.
Step‑by‑step guide:
Create a systemd service file `/etc/systemd/system/ghosttrace.service`:
[bash] Description=GhostTrace IDS After=network.target [bash] ExecStart=/usr/bin/python3 /path/to/ghosttrace/app.py WorkingDirectory=/path/to/ghosttrace Restart=always User=root [bash] WantedBy=multi-user.target
Enable and start the service:
sudo systemctl enable ghosttrace.service sudo systemctl start ghosttrace.service
For alerts, use the `smtplib` library in Python to send emails when a HIGH RISK device is detected.
6. Extending to Cloud Security and API Hardening
While GhostTrace is designed for local networks, the principles apply to cloud environments. In a VPC, you can monitor flow logs and apply similar classification logic. For API security, you could integrate with tools like Wireshark or tcpdump to analyze traffic to and from cloud instances, identifying malicious IPs or unusual API call patterns.
Step‑by‑step guide:
On a cloud server, capture traffic on a specific interface:
sudo tcpdump -i eth0 -w capture.pcap
Then, use Scapy to read the pcap and analyze it for suspicious patterns, such as repeated failed SSH login attempts or port scans.
What Undercode Say:
GhostTrace exemplifies how open-source tools and Python can democratize network security. By focusing on MAC fingerprinting and real-time visualization, it provides a lightweight alternative to expensive enterprise IDS solutions. However, its reliance on ARP makes it effective only on local segments; in switched or encrypted networks, visibility is limited. The project also highlights the importance of OUI databases, which must be kept updated to accurately identify new devices.
Key Takeaway 1: Building an IDS from scratch teaches the fundamentals of network protocols (ARP, IP, MAC) and how attackers exploit them for reconnaissance.
Key Takeaway 2: Real-time dashboards and automated alerts bridge the gap between passive monitoring and active defense, enabling swift response to anomalies.
Prediction:
As IoT devices proliferate and networks become more complex, we will see a rise in AI-driven IDS tools that combine MAC fingerprinting with behavioral analysis. Future iterations of GhostTrace could integrate machine learning to detect zero-day attacks and automatically update firewall rules via APIs, turning passive monitoring into an active, self-healing network defense mechanism.
▶️ Related Video (78% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Yuvanandhini T – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
