title: Python : making an intrusion detection system
body: <p>I am trying to make a network ids.   </p>
  
  <pre><code>from scapy.all import *
  from datetime import datetime
  
  class ids:
      __flagsTCP = {
          'F': 'FIN',
          'S': 'SYN',
          'R': 'RST',
          'P': 'PSH',
          'A': 'ACK',
          'U': 'URG',
          'E': 'ECE',
          'C': 'CWR',
          }
  
      __ip_cnt_TCP = {}               #ip address requests counter
  
      __THRESH=1000               
  
      def sniffPackets(self,packet):
          if packet.haslayer(IP):
              pckt_src=packet[IP].src
              pckt_dst=packet[IP].dst
              print("IP Packet: %s  ==&gt;  %s  , %s"%(pckt_src,pckt_dst,str(datetime.now().strftime("%Y-%m-%d %H:%M:%S"))), end=' ')
  
          if packet.haslayer(TCP):
              src_port=packet.sport
              dst_port=packet.dport
              print(", Port: %s --&gt; %s, "%(src_port,dst_port), end='')
              print([type(self).__flagsTCP[x] for x in packet.sprintf('%TCP.flags%')])
              self.detect_TCPflood(packet)
          else:
              print()
  
  
      def detect_TCPflood(self,packet):
          if packet.haslayer(TCP):
              pckt_src=packet[IP].src
              pckt_dst=packet[IP].dst
              stream = pckt_src + ':' + pckt_dst
  
              if stream in type(self).__ip_cnt_TCP:
                  type(self).__ip_cnt_TCP[stream] += 1
              else:
                  type(self).__ip_cnt_TCP[stream] = 1
  
              for stream in type(self).__ip_cnt_TCP:
                  pckts_sent = type(self).__ip_cnt_TCP[stream]
                  if pckts_sent &gt; type(self).__THRESH:
                      src = stream.split(':')[0]
                      dst = stream.split(':')[1]
                      print("Possible Flooding Attack from %s --&gt; %s"%(src,dst))
  
  
  if __name__ == '__main__':
      print("custom packet sniffer ")
      sniff(filter="ip",iface="enp0s3",prn=ids().sniffPackets)
  </code></pre>
  
  <p>Output:</p>
  
  <pre><code>IP Packet: 192.168.1.10  ==&gt;  192.168.1.5  , 2017-10-18 13:50:49 , Port: 10920 --&gt; 0, ['SYN']
  Possible Flooding Attack from 192.168.1.10 --&gt; 192.168.1.5
  Possible Flooding Attack from 192.168.1.5 --&gt; 192.168.1.10
  IP Packet: 192.168.1.10  ==&gt;  192.168.1.5  , 2017-10-18 13:50:49 , Port: 11079 --&gt; 0, ['SYN']
  Possible Flooding Attack from 192.168.1.10 --&gt; 192.168.1.5
  Possible Flooding Attack from 192.168.1.5 --&gt; 192.168.1.10
  IP Packet: 192.168.1.5  ==&gt;  192.168.1.10  , 2017-10-18 13:50:49 , Port: 0 --&gt; 11744, ['RST', 'ACK']
  </code></pre>
  
  <p>Using:</p>
  
  <pre><code>hping3 -S --flood -V 192.168.1.5
  </code></pre>
  
  <p>The problem is the output, that is very ambiguous as which one is attacking to whom.
  This is because the no. of request is getting past that threshold(1000) after some seconds after executing the program.
  If I focus based on flags like 'SYN' but the hping3 tool is able to flood with any flags. Please help, any ideas would be greatfull..</p>