Network DLP

A network-level Data Loss Prevention (DLP) proof-of-concept that captures and inspects network traffic to detect sensitive data leakage.

Overview

Network DLP operates at OSI layers 1-7 to monitor traffic flowing through a network interface. This POC is designed for deployment on VPS instances hosting AI agents or other services.

Architecture

└─────────────────────────────────────────────────────────────┘

What's Built

Layer	Component	Status
L1-L3	Packet capture	✅
L4-L7	Protocol parsing	✅
App	Content inspection (20+ patterns)	✅
Policy	Alerting engine	✅
DNS	Network + dnsmasq logging	✅
Agent	HTTP interceptor (pre-encryption)	✅

Installation

Prerequisites

# Ubuntu/Debian
sudo apt-get update
sudo apt-get install -y python3-pip python3-scapy libpcap-dev

# CentOS/RHEL
sudo yum install -y python3-pip python3-scapy libpcap-devel

Setup

1. Clone the repository:

git clone https://github.com/deboboy/network-dlp.git
cd network-dlp

2. Install dependencies (if not using system packages):

pip3 install scapy

3. Test the installation:

# Test individual components
python3 content_inspector.py
python3 policy_engine.py

# Test packet capture (requires root)
sudo python3 packet_capture.py --count 10

Usage

Quick Start

Capture 100 packets and analyze:

sudo python3 dlp_service.py --count 100

Run continuously:

sudo python3 dlp_service.py

Command Options

python3 dlp_service.py [OPTIONS]

Options:
  -i, --interface TEXT   Network interface to capture (default: eth0)
  -c, --config TEXT     Configuration directory (default: config)
  -l, --logs TEXT       Log directory (default: logs)
  --count INTEGER       Number of packets to capture (0 = unlimited)
  --timeout INTEGER    Timeout in seconds

Install as System Service

1. Copy the service file:

sudo cp config/network-dlp.service /etc/systemd/system/

2. Edit the service file to match your installation path:

sudo nano /etc/systemd/system/network-dlp.service

3. Enable and start:

sudo systemctl daemon-reload
sudo systemctl enable network-dlp
sudo systemctl start network-dlp

4. Check status:

sudo systemctl status network-dlp

Deployment Modes

Passive Mode (Recommended for POC)

The service runs in passive mode using a network tap or span port. It can only detect and alert - it cannot block traffic.

Internet <---> [eth0] <---> DLP Service <---> Host
                    (mirror port)

Inline Mode (Production)

For blocking capability, deploy in inline mode with iptables integration. This requires additional configuration.

Configuration

Adding Custom Patterns

Edit content_inspector.py and add to the DEFAULT_PATTERNS dictionary:

'custom_pattern': {
    'pattern': r'your-regex-here',
    'description': 'Description of what this detects',
    'severity': 'high',  # critical, high, medium, low, info
    'regex': True
}

Custom Policies

Edit policy_engine.py and add to DEFAULT_POLICIES:

Policy(
    name='your_policy_name',
    conditions=[
        {'field': 'type', 'operator': 'equals', 'value': 'pattern_name'}
    ],
    action=Action.ALERT  # or Action.BLOCK
)

Log Output

Alerts are written to:

• logs/dlp_alerts_YYYYMMDD.jsonl - JSON Lines format
• Console output - human-readable alerts

Alert Format

{
  "id": "alert-1234567890.123",
  "timestamp": "2026-02-17T12:00:00.000000",
  "policy": "api_key_leak",
  "action": "alert",
  "severity": "HIGH",
  "source_ip": "192.168.1.100",
  "dest_ip": "203.0.113.1",
  "source_port": 54321,
  "dest_port": 443,
  "app_protocol": "https",
  "findings": [...],
  "matched_count": 1
}

Limitations

• Encrypted Traffic (TLS/HTTPS): Cannot inspect encrypted traffic without SSL interception
• Performance: Python-based; may not handle 10Gbps+ traffic without optimization
• Passive Only: Cannot block traffic in default configuration
• Root Required: Needs root privileges for packet capture

Testing Results

Verified Detection

The DLP successfully detects sensitive data in unencrypted HTTP traffic:

Findings: 5
  - [critical] ssn: 123-45-6789
  - [high] api_key: sk_live_abc123xyz789
  - [medium] jwt: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
  - [high] bearer_token: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
  - [high] authorization: Authorization: Bearer ...

Policies triggered: 4
  - critical_data_exfiltration
  - api_key_leak
  - auth_token_exposure
  - credential_leak

HTTPS/TLS Limitation

When testing with Slack (which uses HTTPS), the DLP captured metadata:

• Source/destination IPs and ports
• Protocol: TCP
• Packet sizes

However, the message content was encrypted and could not be inspected. This is a fundamental limitation of passive network monitoring.

Protocols That Work

The DLP can inspect plaintext traffic:

• HTTP (port 80)
• SMTP (ports 25, 465, 587)
• FTP (ports 20, 21)
• DNS (port 53)
• Unencrypted connections

Workarounds for Encrypted Traffic

1. SSL Interception: Deploy a MITM proxy to decrypt traffic before inspection
2. Host-based DLP: Install DLP agent on the host to intercept before encryption
3. DNS Inspection: Monitor DNS queries (unencrypted) for data exfiltration

Future Enhancements

• SSL/TLS interception for encrypted traffic inspection
• eBPF-based capture for higher performance
• Integration with SIEM systems (Splunk, ELK, QRadar)
• Real-time blocking via iptables/nftables
• Machine learning-based classification
• File fingerprinting for known sensitive documents

License

MIT License

Author

deboboy