Ajouter ICS.py

ICS.py

@@ -0,0 +1,32 @@
+from scapy.all import sniff, ICMP, IP, TCP
+
+
+def detect_os(pkt):
+    if pkt.haslayer(ICMP):
+        ip_src = pkt[IP].src
+        icmp_type = pkt[ICMP].type
+
+        if icmp_type == 0:  # Echo Reply
+            user_agent = pkt[IP].options if hasattr(pkt[IP], 'options') else ""
+            if "Microsoft" in str(user_agent):
+                os_type = "Windows"
+            else:
+                os_type = "Linux or Other"
+
+            print(f"Alerte : paquet ICMP reçu de {ip_src} ({os_type})")
+
+def detect_ftp(pkt):
+    if pkt.haslayer(TCP) and pkt[TCP].dport == 21:  # Port FTP
+        payload = str(pkt[TCP].payload)
+        if "USER root" in payload or "PASS root" in payload:
+            ip_src = pkt[IP].src
+            print(f"Alerte : tentative de connexion FTP avec 'root' de {ip_src}")
+
+
+def start_sniffing():
+    print("Démarrage de l'analyse du réseau... Appuyez sur Ctrl+C pour arrêter.")
+    sniff(filter="icmp or tcp port 21", prn=lambda x: (detect_icmp(x), detect_ftp(x)), store=0)
+
+
+if __name__ == "__main__":
+    start_sniffing()