Network Intrusion Detection System (NIDS)

A real-time Network Intrusion Detection System built with Python, MySQL, and Grafana. Monitors live network traffic and detects suspicious activities such as port scans, brute force attempts, and unknown IP addresses.

---

Features

• Live packet capture using Scapy
• Detection of Port Scan, Brute Force, and Unknown IP attacks
• Real-time alerts via console and email
• MySQL database logging for all packets and alerts
• Grafana dashboard for visualization

Project Structure

NIDS-Project/
├── alerts/
│   └── alert_manager.py        # Email and file logging
├── capture/
│   └── packet_capture.py       # Scapy packet capture
├── database/
│   └── db_handler.py           # MySQL connection and queries
├── detection/
│   └── rules.py                # Detection rules
├── tests/
│   └── simulate_attacks.py     # Attack simulation scripts
├── visualization/
│   └── dashboard.json          # Grafana dashboard import
├── logs/                       # Alert logs (auto-generated and gitignored)
├── config.py                   # Local config (gitignored)
├── config.example.py           # Config template
├── schema.sql                  # Database schema
├── main.py                     # Entry point
└── requirements.txt            # Python dependencies

Requirements

• Python 3.10+
• MySQL 8.0+
• Grafana OSS
• Npcap (for packet capture on Windows)
• Wireshark (optional, for debugging)

---

Setup Instructions

1. Clone the repository

git clone https://github.com/hasnain-098/NIDS-Project.git
cd NIDS-Project

2. Install Python dependencies

pip install -r requirements.txt

3. Set up MySQL database

Open MySQL Workbench and run:

schema.sql

4. Configure the project

copy config.example.py config.py

Edit config.py and fill in:

• MySQL password
• Your network IPs for whitelist
• Gmail app password for email alerts

5. Import Grafana dashboard

1. Open Grafana at http://localhost:3000
2. Go to Dashboards → Import
3. Upload visualization/dashboard.json
4. Select MySQL as data source

6. Run the system

python main.py

---

Testing

Make sure main.py is running, then in a separate terminal:

python tests/simulate_attacks.py

Or use nmap for port scan simulation:

nmap -Pn -sS -T4 --top-ports 5000 <target-ip>

---

Detection Rules

Attack Type	Rule	Severity
Port Scan	More than 10 unique ports within 120 seconds	HIGH
Brute Force	More than 5 attempts on sensitive ports within 2 minutes	CRITICAL
Unknown IP	Traffic from IP not in whitelist	LOW

---

Tools & Technologies

Category	Tool
Language	Python 3.10+
Packet Capture	Scapy, Npcap
Database	MySQL 8.0
Visualization	Grafana OSS
Debugging	Wireshark
Version Control	Git, GitHub

---

Course

Data Communication and Computer Networks (DCCN)
DHA Suffa University — Spring 2026

---

Group Members

• Hasnain Memon — CS231007
• Pirthum Kumar — CS231127
• Sahil Kumar — CS231135
• Sangeet Kumar — CS231109