NADS — Complete Manual Testing Guide

Network Anomaly Detection System

Full coverage: every parameter, every detector, every attack class — from a single ping to a full
DDoS simulation.

Table of Contents
1. Prerequisites & Setup
2. Starting the System
3. CLI Parameters Reference
4. Baseline — Normal Traffic First
5. Level 1 — Low Anomaly Tests
6. Level 2 — Medium Anomaly Tests
7. Level 3 — High Anomaly Tests
8. Level 4 — Critical Anomaly Tests
9. Detector-by-Detector Verification
[Link] Dashboard Tests
[Link] Live Feed Tests
[Link] API Endpoint Tests
[Link] File Testing
[Link] Cases & Stress Tests
[Link] Results
[Link] & Reset

1. Prerequisites & Setup

Required tools — install all before testing
# Core packet tools
sudo apt install -y nmap hping3 tcpreplay scapy netcat-openbsd \
iperf3 curl wget dnsutils tcpdump wireshark-common

# Python (for custom Scapy scripts)

sudo apt install -y python3-scapy

# Check everything is available

which nmap hping3 nc iperf3 curl scapy tcpdump
Network interface check
# List your interfaces — pick the right one
ip link show

# Common names: eth0, enp3s0, wlan0, lo (loopback for local tests)

# For loopback testing (no real NIC needed):
ip link show lo

Two-machine setup (recommended for accurate tests)

Machine A (Attacker / Traffic Generator) → Machine B (NADS Running)
[Link] [Link]

For single-machine testing, use loopback (-i lo) and send traffic to [Link].

2. Starting the System

Start the backend
cd nads/build

# Minimum (loopback, defaults)

sudo ./nads -i lo

# Full options example

sudo ./nads -i eth0 -t 0.7 -w 60 -p 8080 -o [Link] -j [Link] -v

# Quiet mode (no terminal dashboard, API only)

sudo ./nads -i eth0 -q -p 8080

Start the frontend

cd webwireshark
npm run dev
# Opens at [Link]

Verify connection
# Must return JSON — confirms C++ backend is serving
curl [Link]
curl [Link]
curl [Link]

Open a live packet watch (separate terminal)

# Watch all NADS output in real time
sudo tcpdump -i lo -n &

# Tail the alert log

tail -f [Link]
3. CLI Parameters Reference
Parameter Default What It Controls How to Test
-i <iface> lo Which NIC to capture Change to eth0, run
on nmap scan, check
packets appear
-t <0.0-1.0> 0.7 Alert threshold — Lower to 0.3 to see
score must exceed this many alerts; raise to
0.95 for critical only
-w <seconds> 60 Flow expiry timeout Set to 5 — flows
expire fast, run a long
flow, check it finalizes
early
-p <port> 8080 HTTP API port Run with -p 9090,
then curl
[Link]
t:9090/health
-f <bpf> none BPF filter (only capture -f "tcp port
matching packets) 80" — run UDP test,
confirm no packets
appear
-o <file> [Link] Text log file path Change path, trigger
alert, verify file created
there
-j <file> [Link] JSON log file path Change path, trigger
alert, open JSON file
and inspect structure
-r off Read-only mode (no Run with -r, trigger
alert writes) attack, confirm no log
files written
-q off Quiet — disables Run with -q, confirm
terminal dashboard no ncurses display, API
still works
-v off Verbose — extra debug Run with -v, see per-
output packet debug lines in
terminal
-c <file> none Load config from file See Section 13
(key=value)

Detector weight parameters (config file only)

Key Default Detector
w_statistical 0.20 Z-score on flow stats (bps, pps,
packet size, duration)
Key Default Detector
w_volume 0.25 Sliding-window flood detection
(SYN rate, pps, new flows/s)
w_protocol 0.20 Rule-based TCP/UDP/ICMP
abuse detection
w_baseline 0.15 Per-host behavioral deviation
from its own history
w_graph 0.10 Host connection degree / fan-
out spike
w_temporal 0.05 Periodic timing / beacon
detection
w_entropy 0.05 Shannon entropy on payload
bytes

Weights must sum to 1.0. The fusion engine multiplies each detector's score by its weight.

4. Baseline — Normal Traffic First

Why: NADS uses Z-score detectors. They need at least 20 flows of normal traffic before statistical
anomalies are meaningful. Do this before any attack tests.
# Generate 5 minutes of normal mixed traffic to loopback
# Terminal 1 — HTTP-like TCP flows
for i in $(seq 1 50); do
nc -z [Link] 80 2>/dev/null || true
sleep 2
done

# Terminal 2 — DNS-like UDP

for i in $(seq 1 30); do
dig @[Link] [Link] 2>/dev/null || true
sleep 3
done

# Terminal 3 — Bulk TCP transfers (iperf3 server first)

iperf3 -s -p 5201 -D # background server
iperf3 -c [Link] -p 5201 -t 10 -b 1M

Check in dashboard: Flows page should show 20+ entries. Stats page should show moderate
pps/bps. No alerts should appear yet.

5. Level 1 — Low Anomaly Tests

These generate score 0.3–0.5. May not trigger alerts at default threshold (0.7), but lower threshold
to 0.3 to observe them.
5.1 Slow Port Probe (Low confidence half-open scan)
# Very slow scan — 1 port per 2 seconds
nmap -sS --scan-delay 2000ms -p 20-30 [Link]

Expected behavior:
• Protocol detector sees SYN_NO_ACK or HALF_OPEN_SCAN flag on some flows

• Score around 0.4–0.6 (below default threshold)

• To trigger alert: run with -t 0.3

What to check:
• Flows page: new flows appear for ports 20-30
• [Link]: if threshold is 0.3, shows "Half-Open Port Scan" entry

5.2 Slightly Irregular Packet Sizes

# Scapy — send packets with unusual size (not typical 64 or 1500)
python3 -c "
from [Link] import *
for size in [37, 93, 411, 750, 1200]:
pkt = IP(dst='[Link]')/TCP(dport=80)/Raw(b'X'*size)
send(pkt, verbose=0)
import time; [Link](0.5)
print('Done')
"

Expected behavior:
• Statistical detector flags unusual mean_pkt_size Z-score

• Score ~0.3 — informational only at default threshold

5.3 Mild ICMP (background ping sweep)

# Ping 10 hosts slowly
for ip in 192.168.1.{1..10}; do
ping -c 1 -W 1 $ip 2>/dev/null
sleep 1
done

Expected behavior:
• Graph detector sees new edges per host
• ICMP flows appear in Flows page
• Below flood threshold — score ~0.2
6. Level 2 — Medium Anomaly Tests
Score range 0.5–0.75. Will trigger alerts at default threshold (0.7) on the high end.

6.1 TCP Half-Open Port Scan (SYN scan)

What it is: Attacker sends SYN, server replies SYN-ACK, attacker sends RST (never completes
handshake). Maps open ports without establishing a connection.
# Standard SYN scan — 100 ports
sudo nmap -sS -p 1-100 [Link]

# With timing to make it more obvious

sudo nmap -sS -T4 -p 1-1000 [Link]

Triggered detectors:
• protocol: HALF_OPEN_SCAN flag (syn > 0, rst > 0, packet_count ≤ 4, no full
handshake)
• graph: DEGREE_SPIKE — one host suddenly fans out to many destinations

Expected alert: "Half-Open Port Scan / Recon" — MEDIUM to HIGH severity

Verify:
# Check alert appeared in log
grep "Port Scan" [Link]

# Check via API

curl [Link] | python3 -m [Link] | grep -A5
"category"

6.2 DNS High Rate Query

What it is: Rapid DNS queries — common in DGA (Domain Generation Algorithm) malware, or
DNS tunneling.
# Rapid DNS queries to local resolver
for i in $(seq 1 200); do
dig @[Link] random$[Link] 2>/dev/null &
done
wait

Triggered detectors:
• protocol: DNS_HIGH_RATE flag (UDP port 53, pps > 100)

• volume: FLOW_BURST if new flows spike

Expected alert: "DNS Anomaly / Amplification" — MEDIUM severity

6.3 Behavioral Deviation on SSH Port

What it is: Small flows to port 22 in rapid succession — looks like a brute-force login attempt.
# Simulate repeated SSH connection attempts
for i in $(seq 1 30); do
nc -z -w 1 [Link] 22 2>/dev/null || true
sleep 0.5
done

Triggered detectors:
• baseline: HOST_BPS_DEVIATION — this host normally has no SSH traffic

• Classifier matches: dst_port 22 + baseline deviation = "Brute-Force Login Attempt"

Expected alert: "Brute-Force Login Attempt" — HIGH severity

6.4 RST Flood

What it is: Sending many TCP RST packets — used to tear down sessions (TCP Reset Attack).
# Scapy RST flood
python3 -c "
from [Link] import *
pkts = [IP(dst='[Link]')/TCP(dport=80, flags='R') for _ in range(100)]
sendp(pkts, verbose=0, iface='lo')
print('RST flood sent')
"

Triggered detectors:
• protocol: RST_FLOOD flag (rst_count > 50)

• Score: 0.7

7. Level 3 — High Anomaly Tests

Score range 0.75–0.9. Always triggers alerts at default threshold.

7.1 TCP NULL Scan (Stealth Scan)

What it is: TCP packet with NO flags set. All normal TCP packets have at least one flag. NULL
packets probe for closed ports — firewalls often let them through. Classic Nmap stealth technique.
# Nmap NULL scan
sudo nmap -sN -p 1-200 [Link]

# Manual with Scapy (more controlled)

python3 -c "
from [Link] import *
for port in range(20, 50):
pkt = IP(dst='[Link]')/TCP(dport=port, flags=0) # flags=0 = NULL
send(pkt, verbose=0)
print('NULL scan complete')
"

Triggered detectors:
• protocol: NULL_SCAN flag → score 0.9 immediately
 • graph: DEGREE_SPIKE (one host → many ports)

Expected alert: "TCP NULL Scan" — HIGH severity, score ~0.9

Verify in dashboard:
1. Open Alerts page — alert should appear within 5 seconds
2. Click the alert — see details: detector = "TCP NULL Scan Guard", srcAddr = your IP
3. Check evidence field shows "null=N xmas=0"

7.2 TCP XMAS Scan (Christmas Tree Scan)

What it is: TCP packet with FIN + PSH + URG flags all set simultaneously — the packet is "lit up
like a Christmas tree." Illegal combination that bypasses some firewalls. Closed ports reply RST;
open ports ignore it.
# Nmap XMAS scan
sudo nmap -sX -p 1-200 [Link]

# Manual with Scapy

python3 -c "
from [Link] import *
for port in range(20, 80):
pkt = IP(dst='[Link]')/TCP(dport=port, flags='FPU') # FIN+PSH+URG
send(pkt, verbose=0)
print('XMAS scan complete')
"

Triggered detectors:
• protocol: XMAS_SCAN flag → score 0.9

• Classifier: "TCP XMAS Scan" — HIGH severity

What to check:
grep "XMAS" [Link]
curl [Link] | python3 -m [Link]

7.3 ICMP Flood

What it is: Flooding a host with ICMP Echo Request packets. Used in Ping-of-Death variants or as
a distraction while another attack runs.
# hping3 ICMP flood (500 packets/sec)
sudo hping3 --icmp --flood --faster -c 2000 [Link]

# Alternatively with ping

ping -f -c 5000 [Link] # flood ping (requires root)

# Scapy version (controllable rate)

python3 -c "
from [Link] import *
pkts = [IP(dst='[Link]')/ICMP() for _ in range(2000)]
send(pkts, verbose=0)
print('ICMP flood done')
"

Volume detector thresholds:

• ICMP pps > 500 → score 0.8 (rule-based, instant)
• No baseline needed — hard threshold fires immediately
Expected alert: "ICMP Flood / Ping Sweep" — HIGH severity
Dashboard check:
• Stats page: pps counter should spike visibly
• StatusBar at bottom: pps display jumps

7.4 Fast Port Scan with High Fan-Out (Graph Detector)

What it is: One host connecting to many different hosts/ports rapidly. The graph detector tracks
how many new unique destinations a single host contacts per minute.
Graph detector thresholds:
• 10 new edges/min → score 0.5

• 20 new edges/min → score 0.8

• 50 new edges/min → score 0.95

# Fast scan to many hosts — simulates lateral movement / worm

sudo nmap -sS -T5 --max-rtt-timeout 50ms [Link]/24 -p 22,80,443,3389

# Just ports (same machine)

sudo nmap -sS -T5 -p 1-500 [Link]

Expected alert: "DEGREE_SPIKE" in graph detector — classified as "Half-Open Port Scan /

Recon" or "Suspected Lateral Movement" depending on score

8. Level 4 — Critical Anomaly Tests

Score ≥ 0.9. These always fire, classified CRITICAL. The hardest-hitting tests.

8.1 SYN Flood DDoS

What it is: The most common DDoS attack. Attacker sends thousands of SYN packets per second
to exhaust server connection state. Server sends SYN-ACK, attacker never replies — each half-
open connection consumes memory until timeout.
Volume detector thresholds:
• syn_pps > 100 → score 0.7
• syn_pps > 500 → score 0.95 (CRITICAL immediately, even without history)
# hping3 SYN flood — 1000 pps for 10 seconds
sudo hping3 -S --flood -p 80 -c 10000 [Link]

# Slower but still above threshold (easier on system)

sudo hping3 -S -p 80 --faster -c 2000 [Link]

# Scapy version (spoofed source IPs — realistic DDoS simulation)

python3 -c "
import random
from [Link] import *
pkts = []
for i in range(3000):
src = f'10.{[Link](0,255)}.{[Link](0,255)}.
{[Link](1,254)}'
[Link](IP(src=src,
dst='[Link]')/TCP(sport=[Link](1024,65535), dport=80, flags='S'))
send(pkts, verbose=0)
print('SYN flood sent')
"

Triggered detectors:
• volume: HIGH_SYN_RATE flag, score 0.95 (hard threshold, no history needed)
• protocol: SYN_NO_ACK — syn_count > 10, ack_count = 0

• Both fire simultaneously → final score ~0.92+

Expected alert: "SYN Flood DDoS" — CRITICAL severity
Verify:
# Alert should appear within 1-2 seconds
tail -f [Link]

# API check
curl -s [Link] | python3 -m [Link] | grep -A3
'"severity"'

# Dashboard: alert badge on Alerts nav item should increment

# Status bar: pps counter should spike

8.2 Lateral Movement Simulation (Fast Peer Expansion)

What it is: A single internal host rapidly contacting many new internal hosts — typical of a worm
spreading or an attacker who has compromised one machine and is pivoting across the network.
Graph detector: > 50 new unique destinations per minute = score 0.95
# Simulate one host scanning entire subnet quickly
sudo nmap -sS -T5 --min-rate 1000 -p 445,22,3389,80,8080 [Link]/24

# On loopback: scan many ports fast to simulate fan-out

sudo nmap -sS -T5 --min-rate 500 -p 1-1000 [Link]

Expected alert: "Suspected Lateral Movement" — CRITICAL severity

8.3 C&C Beacon Pattern
What it is: Malware checks in with its command-and-control server at extremely regular intervals
(e.g., every 30 seconds exactly). The temporal detector scores flows with very low jitter (coefficient
of variation of inter-arrival times < 0.05).
# Simulate beacon: connect to a server every 30 seconds, exactly
# First set up a listener:
nc -l -p 4444 &

# Beacon script (run for 5+ minutes to build enough samples)

python3 -c "
import socket, time
for i in range(15):
try:
s = [Link]()
[Link](('[Link]', 4444))
[Link](b'beacon')
[Link]()
except:
pass
[Link](30) # exactly 30 seconds — very regular
print(f'Beacon {i+1}/15 sent')
"

Triggered detector:
• temporal: BEACON_PATTERN or REGULAR_TIMING flag — inter-arrival jitter
extremely low
• Classifier: "C&C Beacon Pattern" — CRITICAL severity
Note: This test takes 7-8 minutes to complete. The temporal detector needs at least 10 samples to
compute reliable jitter statistics.

8.4 DNS Amplification Attack

What it is: Attacker sends small DNS queries with a spoofed victim IP to open DNS resolvers.
Resolvers send large responses to the victim. Traffic amplification ratio can be 100:1.
Large DNS response characteristics: mean packet size > 800 bytes on port 53.
# Query a record known to have a very large response
dig @[Link] ANY [Link] +bufsize=4096

# Simulate receiving large DNS responses (hping3 on UDP 53)

sudo hping3 -2 -p 53 -d 1000 -c 500 --faster [Link]

# Scapy: send many large UDP packets on port 53

python3 -c "
from [Link] import *
pkts = [IP(dst='[Link]')/UDP(sport=53, dport=12345)/Raw(b'A'*900) for _ in
range(300)]
send(pkts, verbose=0)
print('DNS amp simulation done')
"

Triggered detectors:
 • protocol: DNS_LARGE_RESPONSE flag (mean_pkt_size > 800 on port 53)

• Score: 0.7 → alert fires

Expected alert: "DNS Anomaly / Amplification" — HIGH severity

8.5 Tunneling / Data Exfiltration (Entropy Test)

What it is: Sending encrypted or compressed data over a port that normally carries plaintext (e.g.,
HTTP port 80). High Shannon entropy on an HTTP flow = possible tunneled C2 or exfiltration.
Entropy thresholds:
• Plaintext port (80, 21, 23, 25) with H > 7.0 → score 0.7, flag
UNEXPECTED_HIGH_ENTROPY
# Generate high-entropy data (encrypted/compressed content) sent over port 80
python3 -c "
import os, socket
# Create random high-entropy payload (like encrypted data)
payload = [Link](8000)
s = [Link]()
[Link](('[Link]', 80))
[Link](payload)
[Link]()
print('High entropy payload sent on port 80')
" 2>/dev/null || true

# Alternative: use nc to send random data to port 80

dd if=/dev/urandom bs=1024 count=10 2>/dev/null | nc -q 1 [Link] 80

Expected alert: "Suspected Tunneling / Exfiltration" — HIGH severity

9. Detector-by-Detector Verification
Use this section to confirm each detector is firing independently.

9.1 Statistical Detector

Fires on Z-score deviation in: bytes/s, packets/s, mean packet size, flow duration.
# Trigger high bps deviation: large fast transfer after baseline
iperf3 -s -p 5201 -D
iperf3 -c [Link] -p 5201 -b 100M -t 5 # 100 Mbps burst

Check: curl [Link] — look for

"detector":"statistical" in evidence.

9.2 Volume Detector

Hard thresholds (no history needed):
Condition Threshold Score
SYN packets/sec > 100 0.7
SYN packets/sec > 500 0.95
Total pps > 5000 0.85
New flows/sec > 50 0.7

# Test SYN rate threshold (100 SYN/s)

sudo hping3 -S -p 80 --faster [Link] -c 500

# Test pps threshold (5000 pps)

sudo hping3 --flood -p 80 -c 50000 [Link]

9.3 Protocol Detector

Each flag and its trigger:

Flag Trigger Condition Score

SYN_NO_ACK syn_count > 10 AND 0.85
ack_count = 0
NULL_SCAN TCP flags = 0x00 0.90
XMAS_SCAN TCP flags = FIN+PSH+URG 0.90
HALF_OPEN_SCAN SYN+RST, packet_count ≤ 4, 0.60
no handshake
RST_FLOOD rst_count > 50 0.70
SYN_ACK_RATIO_HIGH syn/ack ratio > 5.0 AND 0.80
syn_count > 20
DNS_LARGE_RESPONSE UDP port 53, mean_pkt_size > 0.70
800
DNS_HIGH_RATE UDP port 53, pps > 100 0.60
ICMP_FLOOD ICMP pps > 500 0.80

# Test each flag explicitly:

# HALF_OPEN_SCAN
sudo nmap -sS -p 22 [Link]

# RST_FLOOD
python3 -c "
from [Link] import *
send([IP(dst='[Link]')/TCP(dport=80,flags='R') for _ in range(100)],
verbose=0)
"

# NULL_SCAN
sudo nmap -sN -p 22 [Link]

# XMAS_SCAN
sudo nmap -sX -p 22 [Link]

9.4 Graph Detector

Tracks unique destinations per source host per 10-minute window.
# Gradually increase fan-out to test score progression
# 10 new edges/min → score 0.5 (below threshold)
sudo nmap -sS -T2 -p 1-10 [Link]

# 20 new edges/min → score 0.8

sudo nmap -sS -T4 -p 1-50 [Link]

# 50+ new edges/min → score 0.95 (CRITICAL)

sudo nmap -sS -T5 --min-rate 500 -p 1-500 [Link]

Verify via API:

# Look for "degree" in evidence fields
curl -s [Link] | python3 -m [Link] | grep -A10
"evidence"

9.5 Baseline Engine

Tracks per-host bps over time. Detects when a host suddenly uses much more/less bandwidth than
its own history.
# Step 1: Build baseline for one IP (5 minutes of 1 Mbps)
iperf3 -s -p 5201 -D
iperf3 -c [Link] -p 5201 -b 1M -t 300 &

# Step 2: After 2 minutes, spike to 50 Mbps suddenly

sleep 120
iperf3 -c [Link] -p 5201 -b 50M -t 30

Expected: Baseline deviation alert fires when traffic suddenly jumps 50x the learned average.

9.6 Temporal Detector (Beacon)

Requires running for at least 10 check-ins. Be patient.
# Set up listener
nc -lk -p 9999 &

# Beacon every 60 seconds for 15 iterations

for i in $(seq 1 15); do
echo "beacon $i" | nc -q 1 [Link] 9999
echo "Beacon $i sent at $(date)"
sleep 60
done

Flags generated: BEACON_PATTERN or REGULAR_TIMING

Alert: "C&C Beacon Pattern" — CRITICAL
9.7 Entropy Detector
# Test 1: High entropy on plaintext port (should alert)
# Port 80 + random binary = UNEXPECTED_HIGH_ENTROPY
dd if=/dev/urandom bs=2048 count=5 2>/dev/null | nc -q 2 [Link] 80

# Test 2: Normal HTTP traffic (should NOT alert)

curl -s [Link] > /dev/null

# Test 3: Low entropy on HTTPS port (should note UNEXPECTED_LOW_ENTROPY)

# Send all-zero bytes to port 443
python3 -c "
import socket
s = [Link]()
try:
[Link](('[Link]', 443))
[Link](b'\x00' * 4000)
[Link]()
except:
pass
"

10. Frontend Dashboard Tests

10.1 Capture Page
Test Steps Expected
Packet list populates Start NADS, run ping Rows appear in packet table
[Link] -c 10
Protocol color coding Run TCP and ICMP traffic TCP in one color, ICMP in
another
Packet detail panel Click any packet row Right panel shows hex + layer
decode
Sort by column Click "Length" column header Rows sort by packet size
Search filter Type ICMP in search box Only ICMP packets shown
Play button → starts capture Click Play Button highlights, packets
stream in
Stop button → halts feed Click Stop Packet stream freezes

10.2 Alerts Page

Test Steps Expected
Alert appears in real time Run sudo nmap -sN Alert row appears within 5s
[Link]
Severity badge color Run NULL scan (HIGH) and Different badge colors
SYN flood (CRITICAL)
Click alert → detail panel Click any alert row Right panel shows MITRE,
evidence, IPs
Test Steps Expected
Acknowledge button Click Acknowledge on an alert Alert fades / marked as
reviewed
Severity filter Click "critical" filter Only critical alerts shown
Category filter Click "Port Scan" filter Only port scan alerts shown

10.3 Flows Page

Test Steps Expected
Flows populate Run iperf3 transfer Flow row appears with
src/dst/bytes
Threat score bar Run XMAS scan during flow Threat score column shows red
score
Status indicator Active connection Green dot; closed = grey
Click flow → detail Click a flow 5-tuple card + stats grid shows
Flow count increases Run many parallel connections Row count increases

10.4 Stats Page

Test Steps Expected
I/O graph updates Run iperf3 at 10 Mbps Chart bar rises
Endpoint table Run transfers from multiple IPs Table shows top talkers
Protocol breakdown Mix TCP + UDP traffic Both appear in protocol bar

10.5 Anomaly Dashboard Page

Test Steps Expected
Alert summary card Trigger 3 alerts alertsToday counter
increments
Active flows card Start 10 parallel connections activeFlows counter
updates
Threat timeline Run attacks over 30 minutes Timeline chart shows severity
bars
Threat map If GeoIP works, run scans from Map dots appear
known IPs

11. WebSocket Live Feed Tests

The WebSocket at [Link] pushes three message types in real time.
Test with wscat
npm install -g wscat
wscat -c [Link]
# Then in a separate terminal run: ping [Link] -c 5
# You should see JSON messages flowing in the wscat terminal

Expected message shapes

Packet message (sent for every 5th captured packet):
{"type":"packet","payload":{"no":42,"time":"2024-01-
15T10:30:00.123Z","src":"[Link]","dst":"[Link]","protocol":"ICMP","length"
:84,"info":"ICMP [Link]:0 -> [Link]:0","rawHex":"...","layers":[...]}}

Stats message (sent every ~1 second):

{"type":"stats","payload":{"pps":1250.5,"bps":8400000,"totalPackets":12345}}

Alert message (sent immediately when detector fires):

{"type":"nads_alert","payload":
{"id":"alert-7","severity":"critical","category":"SYN Flood
DDoS","timestamp":"2024-01-15T10:30:05.000Z",...}}

Test that StatusBar updates (WebSocket → Store)

1. Open browser at [Link]

2. Open DevTools → Network → WS → click the ws connection

3. Run ping -f [Link] -c 1000

4. Watch the Frames tab — you should see stats frames arriving every second

5. Watch the bottom StatusBar — pps counter should update in real time

12. REST API Endpoint Tests

Test every endpoint manually with curl:
BASE="[Link]

# Health check
curl -s $BASE/health
# Expected: {"status":"ok"}

# Summary (live stats)

curl -s $BASE/api/summary | python3 -m [Link]
# Expected: activeFlows, alertsToday, detectionRate, topThreatIp

# Last 500 packets

curl -s $BASE/api/packets | python3 -m [Link] | head -40
# Expected: {"packets":[{...},{...}]}

# All recent alerts (last 50)

curl -s $BASE/api/alerts | python3 -m [Link]
# Expected: array of NadsAlert objects
# All active flows
curl -s $BASE/api/flows | python3 -m [Link]
# Expected: array of NetworkFlow objects

# Real-time stats (pps/bps)

curl -s $BASE/api/stats | python3 -m [Link]
# Expected: {"pps":0,"bps":0,"totalPackets":0,"activeFlows":0,"alertsTotal":0}

# Threat timeline (severity over time buckets)

curl -s $BASE/api/threat-timeline | python3 -m [Link]

# Threat IPs (aggregated by source IP)

curl -s $BASE/api/threat-ips | python3 -m [Link]

# Protocol breakdown
curl -s $BASE/api/protocol-stats | python3 -m [Link]

# Start capture via API

curl -s -X POST $BASE/api/capture/start
# Expected: {"status":"ok","state":"capturing"}

# Stop capture via API

curl -s -X POST $BASE/api/capture/stop
# Expected: {"status":"ok","state":"stopped"}

# CORS headers check

curl -s -I -X OPTIONS $BASE/api/alerts
# Expected headers: Access-Control-Allow-Origin: *

13. Config File Testing

Create a config file to test without retyping CLI flags:
cat > [Link] << 'EOF'
interface=lo
alert_threshold=0.5
flow_timeout_sec=10
output_log=/tmp/nads_test.log
json_output=/tmp/nads_test.json
w_statistical=0.20
w_volume=0.30
w_protocol=0.25
w_baseline=0.10
w_graph=0.10
w_temporal=0.03
w_entropy=0.02
EOF

sudo ./nads -c [Link] -p 8080

Test each config option

Lower threshold (0.5):
More alerts fire. Run nmap -sS -p 1-10 [Link] — should now see alerts that were
previously below threshold.
Short flow timeout (10 seconds):
Start a long iperf3 transfer, stop it, wait 10 seconds — flow should appear in /api/flows as
"closed" quickly.
Increased volume weight (0.30 → 0.40):
Edit config, restart. Run a mild SYN flood (50 SYN/s). With higher volume weight, the final fused
score is higher — may cross threshold when it previously didn't.

14. Edge Cases & Stress Tests

14.1 Empty interface (no traffic)
sudo ./nads -i lo -q
# Let it sit idle for 60 seconds
curl [Link]
# Expected: all zeros — no crash, no spurious alerts

14.2 BPF filter — test that it works

# Capture only TCP
sudo ./nads -i lo -f "tcp" -q &
NADS_PID=$!

# Send UDP — should NOT appear in /api/packets

echo "test" | nc -u [Link] 9999

# Send TCP — should appear

nc -z [Link] 80

curl -s [Link] | python3 -m [Link] | grep

"protocol"
# Only "TCP" should appear, no "UDP"

kill $NADS_PID

14.3 High-volume stress test

# Flood at maximum rate — test for crashes, memory leaks
sudo hping3 --flood [Link] -p 80 &
HPING=$!
sleep 30
kill $HPING

# NADS should still be running and responsive

curl [Link]

14.4 Multiple simultaneous attacks

# Run all at once — test that alerts are generated for each
sudo nmap -sS -T5 -p 1-200 [Link] &
sudo hping3 -S --faster -p 80 -c 1000 [Link] &
sudo hping3 --icmp --faster -c 1000 [Link] &
wait

# Check that multiple distinct alerts were generated

curl -s [Link] | python3 -m [Link] | grep
'"category"'
# Should see Port Scan, SYN Flood, ICMP Flood as separate entries

14.5 Alert cooldown test

The alert system suppresses repeated alerts for the same (src_ip, attack_type) pair within the
cooldown window:

Attack Type Cooldown

Port Scan 60s
SYN Flood 5s
Brute Force 30s
Beacon 300s
Lateral Movement 60s
Default 30s

# Run NULL scan twice within 60 seconds

sudo nmap -sN -p 1-50 [Link]
sleep 10
sudo nmap -sN -p 1-50 [Link]

# Second run should NOT create a new alert (cooldown active)

curl -s [Link] | python3 -m [Link] | grep '"id"'
# Count should not have doubled

15. Interpreting Results

Score scale
Score Range Meaning Dashboard Color
0.0 – 0.29 Normal / INFO Grey
0.30 – 0.49 Low confidence anomaly Blue
0.50 – 0.74 MEDIUM — worth Yellow
investigating
0.75 – 0.89 HIGH — likely attack Orange
0.90 – 1.00 CRITICAL — active attack Red

Reading the alert log

[CRITICAL] 2024-01-15 10:30:05 | SYN Flood DDoS
Src: [Link]:12345 -> Dst: [Link]:80 (TCP)
Score: 0.94 Confidence: 0.94
Desc: Massive SYN packets with no ACK responses...
Detectors: volume[0.95] protocol[0.85] statistical[0.30]

Fields explained:
 • Score: Final fused score (weighted sum of all detectors)
• Confidence: Same as score — used by classifier to assign severity
• Detectors: Individual detector subscores — tells you which fired

Reading the JSON output ([Link])

# Pretty-print and show last 5 alerts
python3 -c "
import json
with open('[Link]') as f:
data = [Link](f)
for a in data[-5:]:
print(f'{a[\"timestamp\"]} | {a[\"attack_type\"]} | {a[\"severity\"]} |
score={a[\"final_score\"]:.2f}')
"

16. Cleanup & Reset

# Kill all background processes started during testing
sudo pkill hping3 2>/dev/null
sudo pkill nmap 2>/dev/null
pkill iperf3 2>/dev/null
pkill nc 2>/dev/null

# Stop NADS (Ctrl+C or)

sudo pkill nads

# Clear log files for fresh test run

rm -f [Link] [Link]

# Check no orphan listeners remain

ss -tlnp | grep -E "8080|5201|4444|9999"

# Verify interface is clean

sudo tcpdump -i lo -c 5 2>/dev/null

Quick Reference — Test Cheatsheet

# ── LOW severity ──────────────────────────────────────────────
nmap -sS --scan-delay 2000ms -p 20-30 [Link] # Slow scan
ping -c 10 [Link] # Light ICMP

# ── MEDIUM severity ───────────────────────────────────────────

sudo nmap -sS -p 1-100 [Link] # SYN scan
for i in $(seq 200); do dig @[Link] x$[Link] & done # DNS burst
for i in $(seq 30); do nc -z -w1 [Link] 22; sleep 0.5; done # SSH brute

# ── HIGH severity ─────────────────────────────────────────────

sudo nmap -sN -p 1-200 [Link] # NULL scan
sudo nmap -sX -p 1-200 [Link] # XMAS scan
sudo hping3 --icmp --faster -c 2000 [Link] # ICMP flood
dd if=/dev/urandom bs=2k count=5 | nc -q2 [Link] 80 # Tunneling

# ── CRITICAL severity ─────────────────────────────────────────

sudo hping3 -S --flood -p 80 -c 10000 [Link] # SYN flood
sudo nmap -sS -T5 --min-rate 500 -p 1-1000 [Link] # Lateral mvmt
# Beacon script: nc to same port every 30s × 15 times # C&C beacon

# ── API verification ──────────────────────────────────────────

curl [Link] | python3 -m [Link]
curl [Link]
tail -f [Link]