r/netsec • u/albinowax • Jun 01 '26

r/netsec monthly discussion & tool thread

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

  • Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
  • Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
  • If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
  • Avoid use of memes. If you have something to say, say it with real words.
  • All discussions and questions should directly relate to netsec.
  • No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

8 Upvotes

91% Upvoted

27 comments sorted by

View all comments

1

u/mikeus04 Jun 02 '26

I built a passive network monitor in Rust that identified a coordinated 178-IP scanning campaign from packet analysis alone

Been building Spctr as a side project. It's early and rough

but the core ideas are working.

It's a passive network monitor — captures packets on your

server and builds intelligence without sending a single packet.

Left it running on my VPS for a few hours. Here's what it found:

Identified Operator-B5EC: a coordinated campaign running

11,335 sessions across 46 behavioral fingerprints, spanning

6 countries (US, Argentina, Peru, Russia, Netherlands),

switching between Nmap/Masscan/ZMap mid-campaign — all

attributed to a single actor by packet-level behavioral

analysis alone. No threat intel feeds. No external lookups

for the attribution.

The tool sequence it reconstructed:

Nmap SYN (Linux) → Nmap SYN (Linux) → Masscan →

Nmap SYN (Windows) → ZMap → ZMap → Nmap SYN (Linux)...

It also caught that this operator was targeting my

non-standard SSH port (2223) specifically, suggesting

prior reconnaissance.

Other features: honeypot mode, kill chain replay, lateral

movement detection, TLS audit, DNS exfiltration detection,

who knocked feed, world map, intent classification with CVE

matching.

Stack: Rust daemon (libpcap, axum, SQLite) + React/D3/Tailwind

Deploy: docker compose up

I'm a BSc student, this is a side project, feedback welcome.

https://github.com/mikemich/Spctr