NAM

The problem

Classifying network traffic without looking at packet contents: inferring what kind of traffic crosses an interface from flow characteristics —sizes, timing, frequencies— rather than from the payload.

Approach

A pipeline of two halves talking over a local UDP socket:

• C, multithreaded: separate threads for capture, analysis and sampling. The sniffer captures with pcap and a BPF filter on the interface you give it; a circular buffer hands packets to the sampler, which computes 15 features per sample and sends them over UDP to localhost:4545.
• Python: the ML module receives the samples, unpacks them with struct and classifies them with a Random Forest loaded through joblib, returning the prediction on the same socket.

Splitting capture from classification keeps the hot path in C (where per-packet cost matters) and the model in Python (where the ML ecosystem lives).

Results

A working real-time traffic classification prototype, submitted as my final degree project in Computer Engineering (UPV/EHU, 2020).

How to reproduce

The repository contains the sniffer, the sampler, the circular buffer, the analyser, the ML module and the trained model compressed as RF_Classifier.tar.xz. The Python module expects features over UDP on port 4545 and the model decompressed as RF_Classifier.sav.

Limits

I wrote this in 2020 and would do it differently today: there is no README or build instructions, the trained model sits in a versioned .tar.xz (where it belongs is Releases), requirements.txt is a freeze of that machine’s environment and there is a duplicated sniffer.c at the root. The classifier was trained on a specific dataset that is not in the repository, so its predictions are not comparable outside it.