DEV Community

Cover image for Discover The Network Packet Threat Analyzer API
Dakidarts profile image Etuge Anselm
Etuge Anselm for Dakidarts

Posted on

Discover The Network Packet Threat Analyzer API

#api #rapidapi #dakidarts #cybersecurity

Detect malicious or suspicious network traffic from PCAP or raw packet data.
Supports detection of:

  • Malicious / Suspicious traffic
  • Protocol anomalies
  • C2 beacon detection
  • Entropy-based payload analysis
  • Suspicious port usage

Useful for SOC automation, enterprise monitoring, and forensic investigations.

Network Packet Threat Analyzer API

Base URL 

https://network-packet-threat-analyzer-api.p.rapidapi.com
Enter fullscreen mode Exit fullscreen mode

Endpoints

🔍 /analyze

Analyze PCAP or raw packet data.

Method

  • POST

🛠️ Request Parameters

POST

Supports three content types:

  1. Multipart Form-Data
  • pcap (file, required): PCAP file to analyze.
  1. JSON Body 
   {
     "pcap_b64": "<base64 encoded PCAP>"
   }
Enter fullscreen mode Exit fullscreen mode
  1. Raw Bytes
  • Content-Type: application/octet-stream
  • Body: raw PCAP file bytes

✅ Response Format 

{
  "status": "ok",
  "summary": {
    "packets_analyzed": 142,
    "unique_src_count": 3,
    "unique_dst_count": 5,
    "duration_seconds": 12.4,
    "threat_level": "medium"
  },
  "detections": [
    {
      "type": "suspicious_port",
      "port": 4444,
      "count": 8,
      "reason": "suspicious/listed port observed"
    },
    {
      "type": "beacon_behavior",
      "beacons": [
        {
          "endpoints": ["192.168.1.10", "203.0.113.45"],
          "samples": 12,
          "avg_interval_seconds": 10.2,
          "variance": 0.3
        }
      ],
      "reason": "regular periodic connections detected"
    }
  ],
  "metrics": {
    "file_size_bytes": 25874,
    "packets": 142,
    "unique_src_ips": 3,
    "unique_dst_ips": 5,
    "duration_seconds": 12.4,
    "top_protocols": [["tcp", 85], ["udp", 57]],
    "top_ports": [[80, 50], [4444, 8]],
    "average_payload_entropy": 6.9,
    "analysis_time_seconds": 0.237
  },
  "threat_score": 55
}
Enter fullscreen mode Exit fullscreen mode

⚠️ Error Responses

Code Message Cause
400 {"error": "invalid base64 in pcap_b64"} Bad base64 input
400 {"error": "No pcap provided"} Missing input file/data
404 {"error": "No sample found on server"} sample=true but no sample configured
413 {"error": "Uploaded file is too large"} PCAP > 25MB
500 {"error": "internal server error"} Unexpected server failure

📂 Example Requests

🔹 Analyze Packets

/analyze

Methods

  • POST → Production use (upload live PCAP / raw traffic).
  • GET → Testing only (loads local test_capture.pcap included with the API).

🔹 Request (POST)

1. Multipart Form Upload

curl -X POST \
  -F "pcap=@/path/to/capture.pcap" \
  -H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
  https://network-packet-threat-analyzer-api.p.rapidapi.com/analyze
Enter fullscreen mode Exit fullscreen mode

2. Raw Bytes Upload

curl -X POST \
  --data-binary @capture.pcap \
  -H "Content-Type: application/octet-stream" \
  -H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
  https://network-packet-threat-analyzer-api.p.rapidapi.com/analyze
Enter fullscreen mode Exit fullscreen mode

3. JSON Base64 Upload

curl -X POST \
  -H "Content-Type: application/json" \
  -H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
  -d '{"pcap_b64": "<base64_string>"}' \
  https://network-packet-threat-analyzer-api.p.rapidapi.com/analyze
Enter fullscreen mode Exit fullscreen mode

🔹 Request (GET — Testing Only)

Runs analysis against the built-in test_capture.pcap in the project folder.

curl -X GET \
  -H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
  https://network-packet-threat-analyzer-api.p.rapidapi.com/analyze
Enter fullscreen mode Exit fullscreen mode

⚡ Key Features

  • Detects malicious or suspicious traffic
  • Identifies protocol anomalies
  • Flags C2 beacon patterns
  • Provides threat score (0–100)
  • Supports multipart upload, raw bytes, JSON base64
  • Built-in GET test mode for analysts

⚠️ Notes

  • GET is for testing only with test_capture.pcap.
  • For production SOC integration, always use POST.
  • Ensure PCAP file size is within RapidAPI limits.

Top comments (0)