How to create a model of malicious traffic on a LAN?

Question

Python

How can you filter malicious and normal traffic in a real-time network to see how they look. How is it possible to give this malicious traffic on vertical machines. Is it possible to do in the Python programming system if yes then how? Are there ready programs?

Answer 1

Ports to pick up

Answer 2

You make a virtual machine with snort / meerkat, start services on it, open a couple of dozen popular ports, and try to scan ports, pentest utilities on the victim, collect all the traffic along the way and then look at the snort logs and analyze the traffic. Or put a victim on the Internet, there will be a lot of different traffic ...

Answer 3

Mill, how much is in this word?
If you just analyze - at least turn on tcpdump and see the traffic with your eyes (wireshark, of course, will be more comfortable with filters and gui). If you need some triggers, then write scripts, or use a ready-made siem and ids / ips. Not necessarily for the money, here they advised a free meerkat and a shareware snort, how you can cheat splunk.
To generate malicious traffic - port scanning is not enough, use metasploit, kali. On the Internet, it’s quite such a decision to put the car at the mercy of. It won't be very representative.

Answer 4

you take nmap and scan aggressively (for all ports) subnet, here's the traffic for you