local http_monitor = Proto("HTTPMon", "HTTP Performance Monitor")

-- Felder definieren
local f_response_time = ProtoField.float("httpmon.response_time", "Response Time (ms)")
local f_status_code = ProtoField.uint16("httpmon.status", "Status Code")

function http_monitor.dissector(tvb, pinfo, tree)
    -- Response-Zeit berechnen und anzeigen
    if response_time > 1000 then
        pinfo.cols.info:append(" [SLOW!]")
    end
end

register_postdissector(http_monitor)

-- Protokoll-Format:
-- Bytes 0-1: Message Length (uint16)
-- Byte 2: Message Type (0x01=Text, 0x02=Status)
-- Bytes 3-n: Message Content (string)

import pyshark

class TrafficAnalyzer:
    def analyze_packet(self, packet):
        if 'IP' in packet:
            src_ip = packet.ip.src
            self.traffic_stats[src_ip]['bytes'] += int(packet.length)
            
            if 'HTTP' in packet:
                print(f"HTTP {packet.http.request_method}: {packet.http.host}")
    
    def generate_report(self):
        top_talkers = sorted(self.traffic_stats.items(), 
                           key=lambda x: x[1]['bytes'], 
                           reverse=True)[:10]

from sklearn.ensemble import IsolationForest

class AnomalyDetector:
    def __init__(self):
        self.model = IsolationForest(contamination=0.1)
        
    def detect_anomaly(self, packet):
        features = self.extract_features(packet)
        prediction = self.model.predict([features])
        
        if prediction[0] == -1:
            print(f"🚨 ANOMALIE: {packet.ip.src}")

# Port-Scan Erkennung
tshark -i eth0 -a duration:60 \
    -Y "tcp.flags.syn==1 && tcp.flags.ack==0" \
    -T fields -e ip.src -e tcp.dstport | \
awk '{
    src_counts[$1]++
    if (src_counts[$1] > 20) {
        print "🚨 Port-Scan von " $1
    }
}'

# TCP-Performance-Metriken
tshark -i eth0 -a duration:300 \
    -Y "tcp.analysis.ack_rtt || tcp.analysis.retransmission" \
    -T fields \
    -e ip.src -e ip.dst \
    -e tcp.analysis.ack_rtt \
    -e tcp.analysis.retransmission \
    -E header=y -E separator='|' > tcp_performance.csv

network_monitor/
├── monitor.sh          # Haupt-Framework
├── monitor.conf        # Konfiguration
├── plugins/            # Erweiterbare Plugins
│   ├── ddos_detector.sh
│   ├── anomaly_detector.sh
│   └── performance_monitor.sh
├── logs/               # Strukturierte Logs
└── data/               # Capture-Dateien

DDOS_THRESHOLD_PPS=10000

monitor_ddos() {
    pps=$(tshark -i "$interface" -a duration:1 -q | \
          grep -oE '[0-9]+ packets' | awk '{print $1}')
    
    if [[ $pps -gt $DDOS_THRESHOLD_PPS ]]; then
        alert "DDOS" "Interface $interface: $pps packets/sec"
        activate_mitigation
    fi
}