TCPDump

# CAPTURAR HANDSHAKES TLS
sudo tcpdump -i eth0 -w /tmp/tls.pcap \
  "tcp port 443 and (tcp[((tcp[12:1] & 0xf0) >> 2)] = 0x16)"

# Mientras captura, hacer conexiones:
curl -v https://tu-servidor.com
openssl s_client -connect tu-servidor.com:443

# ANALIZAR CON TSHARK
# Versiones en Client Hello:
tshark -r /tmp/tls.pcap -Y "tls.handshake.type == 1" \
  -T fields -e ip.src -e tls.handshake.version \
  2>/dev/null

# Detectar TLS 1.0 (0x0301) o TLS 1.1 (0x0302):
tshark -r /tmp/tls.pcap \
  -Y "tls.handshake.version == 0x0301 or tls.handshake.version == 0x0302" \
  -T fields -e ip.src -e tls.handshake.version 2>/dev/null

# SCRIPT AUDITORÍA TLS COMPLETO
cat > /tmp/audit_tls.sh << 'SCRIPT'
#!/bin/bash
TARGET=$1
echo "=== Auditoría TLS: $TARGET ==="
echo ""
echo "-- Versiones soportadas --"
for VER in -tls1 -tls1_1 -tls1_2 -tls1_3; do
    RESULT=$(echo | openssl s_client -connect $TARGET:443 $VER 2>&1 | grep -E "Protocol|handshake failure")
    echo "  $VER: $RESULT"
done
echo ""
echo "-- Cipher suite negociado --"
echo | openssl s_client -connect $TARGET:443 2>/dev/null | grep "Cipher is"
echo ""
echo "-- Cipher suites débiles (RC4, NULL, EXPORT) --"
echo | openssl s_client -connect $TARGET:443 -cipher "RC4:aNULL:eNULL:EXPORT" 2>&1 | \
  grep -E "Cipher is|handshake failure"
echo ""
echo "-- Certificado --"
echo | openssl s_client -connect $TARGET:443 2>/dev/null | \
  openssl x509 -noout -dates -subject 2>/dev/null
SCRIPT
chmod +x /tmp/audit_tls.sh
/tmp/audit_tls.sh cyberflows.uk

# DETECTAR SYN SCANS EN TIEMPO REAL
sudo tcpdump -i eth0 -nn "tcp[tcpflags] == tcp-syn" -l 2>/dev/null | \
  awk '{split($3,ip,"."); src=ip[1]"."ip[2]"."ip[3]"."ip[4];
    count[src]++;
    if(count[src]==20) print "[ALERTA] Posible scan desde:", src;
    if(count[src]%100==0) print "[SCAN ACTIVO]", src, count[src], "SYNs";}'

# DETECTAR OTROS TIPOS
sudo tcpdump -i eth0 -nn "tcp[tcpflags] == tcp-fin" -c 10   # FIN scan
sudo tcpdump -i eth0 -nn "tcp[tcpflags] == 0" -c 10          # NULL scan
sudo tcpdump -i eth0 -nn "tcp[tcpflags] == (tcp-fin|tcp-push|tcp-urg)" -c 10  # XMAS

# SCRIPT BLOQUEO AUTOMÁTICO
cat > /usr/local/bin/scan_blocker.sh << 'SCRIPT'
#!/bin/bash
THRESHOLD=50
sudo tcpdump -i eth0 -nn "tcp[tcpflags] == tcp-syn" -l 2>/dev/null | \
while read line; do
    SRC=$(echo $line | awk '{print $3}' | rev | cut -d. -f2- | rev)
    [ -z "$SRC" ] && continue
    COUNT_F="/tmp/sc_$SRC"
    COUNT=$(cat $COUNT_F 2>/dev/null || echo 0)
    echo $((COUNT + 1)) > $COUNT_F
    find /tmp -name "sc_*" -mmin +1 -delete 2>/dev/null
    if [ $((COUNT + 1)) -eq $THRESHOLD ]; then
        echo "$(date): BLOQUEANDO $SRC ($THRESHOLD SYNs)" | tee -a /var/log/scan_blocker.log
        iptables -I INPUT -s $SRC -j DROP
    fi
done
SCRIPT
chmod +x /usr/local/bin/scan_blocker.sh
sudo /usr/local/bin/scan_blocker.sh &

# ANÁLISIS INICIAL DEL PCAP
sudo tcpdump -i eth0 -w /tmp/incidente.pcap  # Capturar primero

# Top destinos por volumen:
tshark -r /tmp/incidente.pcap -T fields -e ip.dst -e frame.len 2>/dev/null | \
  grep -v "^192.168." | \
  awk '{sum[$1]+=$2} END {for(ip in sum) printf "%-20s %.2f MB
", ip, sum[ip]/1048576}' | \
  sort -rn -k2 | head -10

# Reconstruir stream sospechoso:
SUSPICIOUS="93.184.216.34"
STREAM=$(tshark -r /tmp/incidente.pcap -Y "ip.dst == $SUSPICIOUS" \
  -T fields -e tcp.stream 2>/dev/null | sort | uniq -c | sort -rn | head -1 | awk '{print $2}')
tshark -r /tmp/incidente.pcap -q -z "follow,tcp,ascii,$STREAM" 2>/dev/null | head -80

# Detectar DNS tunneling (subdominios largos):
tshark -r /tmp/incidente.pcap -Y dns -T fields -e ip.src -e dns.qry.name 2>/dev/null | \
  awk 'length($2) > 50 {print "[DNS TUNNEL?]", $1, $2}' | head -20

# Timeline del ataque:
tshark -r /tmp/incidente.pcap -Y "ip.dst == $SUSPICIOUS" \
  -T fields -e frame.time -e frame.len 2>/dev/null | \
  awk '{total+=$2; if(NR==1) first=$1; last=$1}
       END {printf "Inicio: %s
Fin: %s
Total: %.2f MB
", first, last, total/1048576}'

# Reporte forense:
cat > /tmp/reporte.txt << EOF
REPORTE FORENSE - $(date)
IP Sospechosa: $SUSPICIOUS
Stream TCP: $STREAM
RECOMENDACIÓN: Bloquear IP en firewall, revisar logs de auth.log
EOF

cat > /usr/local/bin/net_dashboard.py << 'PYEOF'
#!/usr/bin/env python3
import subprocess, sys, os, time, re
from collections import defaultdict
from datetime import datetime

INTERFACE = sys.argv[1] if len(sys.argv) > 1 else "eth0"
REFRESH = 5

ip_counter = defaultdict(int)
proto_counter = defaultdict(int)
total = 0
start = time.time()
last_ips = set()
last_refresh = time.time()

proc = subprocess.Popen(
    ['sudo', 'tcpdump', '-i', INTERFACE, '-nn', '-l', '-q'],
    stdout=subprocess.PIPE, stderr=subprocess.DEVNULL,
    universal_newlines=True, bufsize=1
)

try:
    for line in proc.stdout:
        total += 1
        # Extraer IP origen
        m = re.search(r'(d+.d+.d+.d+).d+s*>', line)
        if m: ip_counter[m.group(1)] += 1
        # Protocolo
        for p in ['tcp','udp','icmp','arp']:
            if p in line.lower(): proto_counter[p] += 1; break

        if time.time() - last_refresh >= REFRESH:
            os.system('clear')
            elapsed = int(time.time() - start)
            print(f"{'='*60}")
            print(f"  NET MONITOR — {INTERFACE} — {datetime.now().strftime('%H:%M:%S')}")
            print(f"{'='*60}")
            print(f"  Paquetes: {total:,} | PPS: {total/max(elapsed,1):.1f}/s
")
            
            print("  TOP 10 IPs")
            for ip, c in sorted(ip_counter.items(), key=lambda x:-x[1])[:10]:
                pct = c/max(total,1)*100
                bar = '█'*int(pct/3)
                print(f"  {ip:<18} {c:>8,} {pct:>6.1f}% {bar}")
            
            print("
  PROTOCOLOS")
            for p, c in sorted(proto_counter.items(), key=lambda x:-x[1]):
                pct = c/max(total,1)*100
                print(f"  {p:<8} {c:>8,} {pct:>6.1f}%")
            
            new_ips = set(ip_counter) - last_ips
            if new_ips: print(f"
  ⚠ NUEVAS: {', '.join(list(new_ips)[:5])}")
            last_ips = set(ip_counter)
            last_refresh = time.time()
except KeyboardInterrupt:
    proc.terminate()
    print("
Detenido.")
PYEOF
chmod +x /usr/local/bin/net_dashboard.py
sudo python3 /usr/local/bin/net_dashboard.py eth0