Turn raw network captures into actionable security insights.
NetShield is a web-based network traffic analysis platform built to make packet capture investigation faster and easier to understand.
Upload a .pcap or .pcapng file and NetShield transforms raw network traffic into packets, flows, DNS activity, HTTP requests, TLS information, traffic statistics, and security alerts through a centralized dashboard.
The project combines network analysis, backend engineering, data processing, and rule-based threat detection into one practical cybersecurity application.
Network packet captures contain a huge amount of low-level information that can be difficult to investigate manually.
NetShield simplifies that process by turning raw traffic into structured security insights:
PCAP / PCAPNG
│
▼
┌─────────────────┐
│ Packet Analysis │
└────────┬────────┘
▼
┌─────────────────┐
│ Flow Analysis │
└────────┬────────┘
▼
┌──────────┼──────────┐
▼ ▼ ▼
DNS HTTP TLS
Analysis Analysis Analysis
└──────────┼──────────┘
▼
┌─────────────────┐
│ Threat Detection│
└────────┬────────┘
▼
┌─────────────────┐
│ Security Alerts │
│ & Dashboard │
└─────────────────┘
- Upload
.pcapand.pcapngfiles - Parse and inspect network packets
- Extract protocol, IP, port, and connection information
- Group packets into meaningful network flows
- Extract DNS queries and domains
- Identify HTTP traffic and request details
- Analyze available TLS SNI information
- Examine communication between network hosts
- Generate traffic statistics and visualizations
NetShield analyzes traffic patterns to identify potentially suspicious behavior, including:
| Detection | What NetShield Looks For |
|---|---|
| 🔴 Port Scanning | Repeated connections across multiple ports |
| 🟠 SYN Anomalies | Repeated SYN packets without completed connections |
| 🟡 Connection Bursts | Unusual spikes in connection attempts |
| 🟡 High Traffic | Abnormally high traffic rates |
| 🔴 Monitored Ports | Activity involving configured suspicious ports |
- Search packets and flows
- Filter security alerts
- Inspect individual network conversations
- Explore traffic statistics
- Move from high-level activity to packet-level details
NetShield brings the analysis into a single investigation dashboard, allowing users to move from overall network activity to individual packets and security alerts.
Tip: Replace the screenshot above with your best dashboard screenshot. A strong visual here makes the project immediately more compelling to recruiters.
NetShield goes beyond a basic CRUD application. It demonstrates practical experience with:
- Network protocol analysis
- Packet-level data processing
- PCAP file handling
- REST API development
- Rule-based anomaly detection
- Data extraction and transformation
- Security-focused application design
- Interactive data visualization
- Backend architecture
The project was designed to bridge the gap between raw network data and human-readable security insights.
┌─────────────────────────────────────┐
│ Web Dashboard │
│ Upload • Search • Filter • Charts │
└──────────────────┬──────────────────┘
│
▼
┌─────────────────────────────────────┐
│ FastAPI REST API │
└──────────────────┬──────────────────┘
│
┌────────┴─────────┐
▼ ▼
┌──────────────────┐ ┌─────────────────┐
│ PCAP Processing │ │ Threat Detection│
│ │ │ Engine │
└────────┬─────────┘ └────────┬────────┘
│ │
└──────────┬─────────┘
▼
┌────────────────────────┐
│ Structured Analysis │
│ Packets • Flows • DNS │
│ HTTP • TLS • Alerts │
└────────────────────────┘
Python • FastAPI • REST API
PCAP / PCAPNG • Packet Analysis • Flow Analysis • DNS • HTTP • TLS
Rule-Based Detection • Network Anomaly Detection • Traffic Analysis
Git • GitHub • REST APIs
git clone https://github.com/aishwarya983/Netsheild.git
cd Netsheildpython -m venv venvWindows
venv\Scripts\activatemacOS / Linux
source venv/bin/activatepip install -r requirements.txtRun the FastAPI application using the project's configured startup command.
Once the backend is running, interactive API documentation is available at:
http://127.0.0.1:8000/docs
NetShield provides a FastAPI REST API that powers the network analysis workflow.
The interactive Swagger documentation makes it easy to explore and test the available endpoints:
http://127.0.0.1:8000/docs
The API supports the core analysis workflow, including:
- PCAP processing
- Packet extraction
- Flow analysis
- DNS analysis
- Traffic statistics
- Security alert generation
1. Upload a PCAP file
↓
2. NetShield processes the capture
↓
3. Packets and flows are extracted
↓
4. DNS / HTTP / TLS information is analyzed
↓
5. Detection rules evaluate network behavior
↓
6. Suspicious patterns generate alerts
↓
7. Results are explored through the dashboard
Packet-Level Visibility Understand what is happening inside a network capture rather than relying only on high-level statistics.
Security-Oriented Analysis Detect suspicious traffic patterns using configurable rule-based detection.
Structured Network Intelligence Convert complex packet captures into searchable packets, flows, domains, protocols, and alerts.
Developer-Focused Architecture Separate API, processing, analysis, and detection responsibilities to keep the system maintainable and extensible.
- Live packet capture
- Real-time traffic monitoring
- Background processing for large PCAP files
- CSV / PDF security reports
- Additional detection rules
- Improved IPv6 analysis
- Dashboard-based rule configuration
- Advanced traffic visualizations
- Real-time security alerts
Computer Science Student • Software Developer
Focused on building practical software projects across backend development, cybersecurity, network analysis, and problem solving.
⭐ If you found NetShield interesting, consider giving the repository a star.