from scapy.all import sniff, ICMP, IP, TCP


def detect_os(pkt):
    if pkt.haslayer(ICMP):
        ip_src = pkt[IP].src
        icmp_type = pkt[ICMP].type

        if icmp_type == 0:  # Echo Reply
            user_agent = pkt[IP].options if hasattr(pkt[IP], 'options') else ""
            if "Microsoft" in str(user_agent):
                os_type = "Windows"
            else:
                os_type = "Linux or Other"

            print(f"Alerte : paquet ICMP reçu de {ip_src} ({os_type})")

def detect_ftp(pkt):
    if pkt.haslayer(TCP) and pkt[TCP].dport == 21:  # Port FTP
        payload = str(pkt[TCP].payload)
        if "USER root" in payload or "PASS root" in payload:
            ip_src = pkt[IP].src
            print(f"Alerte : tentative de connexion FTP avec 'root' de {ip_src}")


def start_sniffing():
    print("Démarrage de l'analyse du réseau... Appuyez sur Ctrl+C pour arrêter.")
    sniff(filter="icmp or tcp port 21", prn=lambda x: (detect_icmp(x), detect_ftp(x)), store=0)


if __name__ == "__main__":
    start_sniffing()