DEV Community

RADON GAMING
RADON GAMING

Posted on

Chaining Gemini and Claude for Terminal-Based Network Forensics ⚡

#ai #security #python #opensource

description: How AuraSniff uses a dual-LLM pipeline (Gemini + Claude) to parse PCAPs and analyze network packets locally without Wireshark.

Most AI-powered security assistants bolt an LLM on as a basic chatbot. You paste logs in, and it guesses.
The problem with this approach in network forensics is scale: language models cannot read a raw 50MB PCAP file, and sending thousands of raw packets to an API is slow and expensive.
I built AuraSniff to solve this. It is a lightweight, zero-dependency Python CLI tool that parses packet captures locally and uses a Dual-LLM Collaborative pipeline (Gemini + Claude) to pinpoint and analyze threats in seconds.

Here is how the pipeline works under the hood.

🏗️ The Dual-LLM Pipeline Architecture

Instead of relying on a single model, AuraSniff chains Google Gemini and Anthropic Claude to leverage their individual strengths.

┌──────────────────────────────────────────────────────────────────┐
│  User Input: "Is there any suspicious traffic on 10.0.0.15?"     │
└──────────────────┬───────────────────────────────────────────────┘
                   │
        ┌──────────▼────────────┐
        │  Step 1: Gemini       │  Large context scan of the PCAP summary.
        │  (Full Capture Scan)  │  Generates a coarse summary + packet filter.
        └──────────┬────────────┘
                   │  Filter: { "src": "10.0.0.15" }
        ┌──────────▼────────────┐
        │  Local Engine (Scapy) │  Applies filter to the packet database.
        │  (Packet Retrieval)   │  Retrieves exact matching packets + metadata.
        └──────────┬────────────┘
                   │  37 packets matched
        ┌──────────▼────────────┐
        │  Step 2: Claude       │  Deep forensic analysis on matched packets.
        │  (Forensic Analyst)   │  Generates expert Markdown security report.
        └───────────────────────┘
Enter fullscreen mode Exit fullscreen mode

1. Step 1: Gemini as the High-Capacity Filter

Gemini has a massive context window and is incredibly fast. AuraSniff parses the PCAP file locally and extracts a structured, minified metadata summary (top conversations, DNS queries, HTTP headers, TLS SNIs, and security alerts).
This summary is sent to Gemini, which identifies the anomalies and outputs a structured JSON filter:

{
  "filter": {
    "src": "10.0.0.15",
    "proto": "TCP"
  }
}
Enter fullscreen mode Exit fullscreen mode

2. Local Querying (Zero Latency)

AuraSniff intercepts this JSON block and queries its local packet database in Python. It extracts the matching packets along with their decoded layer data and hex dumps. No raw binary payload data is ever uploaded to the cloud.

3. Step 2: Claude as the Expert Forensic Analyst

Claude Sonnet is elite at deep logical reasoning on code and structured data. AuraSniff feeds the matched raw packet summaries directly to Claude, along with Gemini's initial overview.

Claude performs deep packet inspection (DPI) to identify malicious patterns (like SYN sweeps, ARP spoofing, cleartext credential leaks, or C2 DNS tunneling) and renders a professional risk report.

🎨 Interactive CLI & Offline Fallback

AuraSniff isn't just an API wrapper. If you run it without keys, it uses a local rule-based parser to compile:

  • IP ➜ Website Maps: Resolves exactly which servers your devices visited by combining DNS queries, HTTP Host headers, and TLS Server Name Indications (SNI).
  • Credentials Harvester: Captures plaintext login attempts on insecure HTTP-POST, FTP, SMTP, and IMAP ports.
  • Threat Alerts: Flags port scanning, spoofing, and malicious DNS tunneling. When you launch it on a file, it drops you directly into a beautiful interactive console dashboard built with Rich. --- ## 🚀 Getting Started You can install and run AuraSniff on Linux (including Kali), macOS, and Windows: 
# Install base package
pip install aurasniff
# Configure your keys (keys are stored securely in your OS keychain, not plain text!)
aurasniff config set-key <GEMINI_API_KEY>
aurasniff config set-key <CLAUDE_API_KEY> --provider claude
# Analyze a capture file
aurasniff your_capture.pcapng
Enter fullscreen mode Exit fullscreen mode

Check out the repository, submit issues, or contribute:
👉 GitHub: vatsalgargg/aurasniff
👉 PyPI: pypi.org/project/aurasniff
If you find it helpful, please drop a ⭐ on GitHub to help others find it!

Top comments (0)