Network Packet Threat Analyzer API

Snapshot from RAPID_README.md for source API version 0.0.2. This is source documentation, not evidence that an upstream is deployed.

GET /status

Health check. No parameters.

curl -X GET \
  -H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
  https://network-packet-threat-analyzer-api.p.rapidapi.com/status

Response:

{
  "status": "ok",
  "version": "0.0.2",
  "auth_enabled": false,
  "max_upload_bytes": 26214400,
  "request_id": "..."
}

Source contract imported from Network Packet Threat Analyzer/app.py. Handler: health. Reference: RAPID_README.md.

Snapshot from docs/rapidapi-endpoints.md for source API version 0.0.2. This is source documentation, not evidence that an upstream is deployed.

2. GET /analyze

Description: Test analysis using a bundled sample capture (5 synthetic TCP packets). No file upload needed — useful for integration testing and demo.

Request Example:

curl --request GET \
  --url 'https://network-packet-threat-analyzer.p.rapidapi.com/analyze?sensitivity=medium' \
  --header 'x-rapidapi-key: YOUR_KEY' \
  --header 'x-rapidapi-host: network-packet-threat-analyzer.p.rapidapi.com'

Response 200:

{
  "status": "ok",
  "summary": {
    "packets_analyzed": 5,
    "unique_src_count": 1,
    "unique_dst_count": 1,
    "duration_seconds": 0.0004951953887939453,
    "threat_level": "medium"
  },
  "detections": [
    {
      "type": "beacon_behavior",
      "beacons": [
        {
          "endpoints": ["192.168.1.100", "192.168.1.1"],
          "samples": 5,
          "avg_interval_seconds": 0.0,
          "variance": 0.0
        }
      ],
      "reason": "regular periodic connections detected"
    }
  ],
  "metrics": {
    "file_size_bytes": 374,
    "packets": 5,
    "unique_src_ips": 1,
    "unique_dst_ips": 1,
    "duration_seconds": 0.0004951953887939453,
    "top_protocols": [["tcp", 5]],
    "top_ports": [[80, 5], [1024, 1], [1025, 1]],
    "average_payload_entropy": 0.0,
    "analysis_time_seconds": 0.0
  },
  "threat_score": 25,
  "score_breakdown": [
    {"rule": "beacon_behavior", "points": 25, "count": 1}
  ],
  "sensitivity": "medium",
  "request_id": "..."
}

Source contract imported from Network Packet Threat Analyzer/app.py. Handler: analyze. Reference: docs/rapidapi-endpoints.md.

Snapshot from docs/rapidapi-endpoints.md for source API version 0.0.2. This is source documentation, not evidence that an upstream is deployed.

2. GET /analyze

Description: Test analysis using a bundled sample capture (5 synthetic TCP packets). No file upload needed — useful for integration testing and demo.

Request Example:

curl --request GET \
  --url 'https://network-packet-threat-analyzer.p.rapidapi.com/analyze?sensitivity=medium' \
  --header 'x-rapidapi-key: YOUR_KEY' \
  --header 'x-rapidapi-host: network-packet-threat-analyzer.p.rapidapi.com'

Response 200:

{
  "status": "ok",
  "summary": {
    "packets_analyzed": 5,
    "unique_src_count": 1,
    "unique_dst_count": 1,
    "duration_seconds": 0.0004951953887939453,
    "threat_level": "medium"
  },
  "detections": [
    {
      "type": "beacon_behavior",
      "beacons": [
        {
          "endpoints": ["192.168.1.100", "192.168.1.1"],
          "samples": 5,
          "avg_interval_seconds": 0.0,
          "variance": 0.0
        }
      ],
      "reason": "regular periodic connections detected"
    }
  ],
  "metrics": {
    "file_size_bytes": 374,
    "packets": 5,
    "unique_src_ips": 1,
    "unique_dst_ips": 1,
    "duration_seconds": 0.0004951953887939453,
    "top_protocols": [["tcp", 5]],
    "top_ports": [[80, 5], [1024, 1], [1025, 1]],
    "average_payload_entropy": 0.0,
    "analysis_time_seconds": 0.0
  },
  "threat_score": 25,
  "score_breakdown": [
    {"rule": "beacon_behavior", "points": 25, "count": 1}
  ],
  "sensitivity": "medium",
  "request_id": "..."
}

Source contract imported from Network Packet Threat Analyzer/app.py. Handler: analyze. Reference: docs/rapidapi-endpoints.md.

Snapshot from docs/rapidapi-endpoints.md for source API version 0.0.2. This is source documentation, not evidence that an upstream is deployed.

4. POST /analyze/batch

Description: Analyze multiple captures in one request. Up to 10 files, 25 MB combined (decoded). Per-capture failures become result entries — never fail the whole batch.

Request Body:

{
  "captures": [
    {"name": "capture1.pcap", "pcap_b64": "aB3Kd..."},
    {"name": "capture2.pcap", "pcap_b64": "xY7Zt..."}
  ]
}

Request Example:

B64_A=$(base64 -i capture1.pcap | tr -d '\n')
B64_B=$(base64 -i capture2.pcap | tr -d '\n')

curl --request POST \
  --url 'https://network-packet-threat-analyzer.p.rapidapi.com/analyze/batch' \
  --header 'x-rapidapi-key: YOUR_KEY' \
  --header 'x-rapidapi-host: network-packet-threat-analyzer.p.rapidapi.com' \
  --header 'content-type: application/json' \
  --data "{\"captures\": [{\"name\": \"a.pcap\", \"pcap_b64\": \"$B64_A\"}, {\"name\": \"b.pcap\", \"pcap_b64\": \"$B64_B\"}]}"

Response 200:

{
  "status": "ok",
  "results": [
    {
      "name": "a.pcap",
      "summary": {"packets_analyzed": 142, "threat_level": "high"},
      "threat_score": 75,
      "score_breakdown": [{"rule": "c2_signature", "points": 40, "count": 1}]
    },
    {
      "name": "b.pcap",
      "summary": {"packets_analyzed": 5, "threat_level": "low"},
      "threat_score": 0,
      "score_breakdown": []
    },
    {
      "name": "bad.pcap",
      "error": "invalid base64",
      "code": "INVALID_BASE64"
    }
  ],
  "batch_threat_score": 75,
  "sensitivity": "medium",
  "request_id": "..."
}

Source contract imported from Network Packet Threat Analyzer/app.py. Handler: analyze_batch. Reference: docs/rapidapi-endpoints.md.

Snapshot from docs/endpoints/v2.md for source API version 0.0.2. This is source documentation, not evidence that an upstream is deployed.

POST /flows — Network Flows

Extracts per-conversation flow records with a per-flow score.

Query params: top_n (default 50), min_packets (default 1), sensitivity (default medium).

200 OK:

{
  "status": "ok",
  "flows": [
    {
      "src_ip": "10.0.0.5",
      "dst_ip": "45.77.12.9",
      "src_port": 49152,
      "dst_port": 4444,
      "protocol": "tcp",
      "packets": 10,
      "bytes": 1420,
      "duration_seconds": 9.0,
      "avg_interval_seconds": 1.0,
      "avg_payload_entropy": 2.8274,
      "flow_score": 70
    }
  ],
  "total_flows": 10,
  "total_bytes": 1420,
  "sensitivity": "medium"
}

flow_score components: suspicious port +40 · mean entropy above threshold +30 · beacon-like regularity +30 · high packet count / small packets +10 (capped at 100).

Source contract imported from Network Packet Threat Analyzer/app.py. Handler: flows. Reference: docs/endpoints/v2.md.

Snapshot from docs/endpoints/v2.md for source API version 0.0.2. This is source documentation, not evidence that an upstream is deployed.

POST /iocs — Indicator Extraction

Extracts IPs, domains, URLs, and payload hashes (MD5/SHA1/SHA256) from IP headers, DNS queries, and payload strings.

200 OK:

{
  "status": "ok",
  "iocs": {
    "ips": ["10.0.0.5", "45.77.12.9"],
    "domains": ["c2.evil.tk"],
    "urls": ["http://c2.evil.tk/beacon"],
    "hashes": { "md5": [], "sha1": [], "sha256": [] }
  },
  "enrichment": {
    "malicious_domains": ["c2.evil.tk"],
    "malicious_ips": ["45.77.12.9"],
    "source": "local heuristics (no external feeds)"
  }
}

Source contract imported from Network Packet Threat Analyzer/app.py. Handler: iocs. Reference: docs/endpoints/v2.md.

Snapshot from docs/endpoints/v2.md for source API version 0.0.2. This is source documentation, not evidence that an upstream is deployed.

POST /dns — DNS Analysis

Query params: top_n (default 50), flag_tunneling (true/false, default true), sensitivity.

200 OK:

{
  "status": "ok",
  "queries_total": 3,
  "unique_domains": 4,
  "nxdomain_rate": 1.0,
  "suspicious_domains": [
    {
      "domain": "a1b2c3d4e5f6.verylongsubdomain.tk",
      "query_count": 1,
      "subdomain_entropy": 4.6202,
      "flag": "suspicious_tld"
    }
  ],
  "top_domains": [["mail.evil.tk", 1]],
  "detections": [
    {
      "type": "nxdomain_spike",
      "nxdomain_rate": 1.0,
      "reason": "elevated NXDOMAIN rate - possible domain generation algorithm (DGA) activity"
    }
  ],
  "dns_threat_score": 25
}

Detection rules: dns_tunneling (subdomain entropy > 6.5, +40) · nxdomain_spike (NXDOMAIN rate > 0.5, +15) · suspicious TLD (+10). Domain flags: high_entropy, elevated_entropy, suspicious_tld.

Source contract imported from Network Packet Threat Analyzer/app.py. Handler: dns. Reference: docs/endpoints/v2.md.

Snapshot from docs/endpoints/v2.md for source API version 0.0.2. This is source documentation, not evidence that an upstream is deployed.

POST /hex — Single-Packet Analysis

Decodes a hex-encoded packet (e.g., from hexdump or an IDS alert) and returns a verdict. JSON only:

{ "hex": "00112233445566778899aabb08004500002c..." }

200 OK:

{
  "status": "ok",
  "decoded": {
    "eth_dst": "66:77:88:99:aa:bb",
    "eth_src": "00:11:22:33:44:55",
    "ip_src": "10.0.0.1",
    "ip_dst": "45.77.12.9",
    "ip_ttl": 64,
    "ip_proto": 6,
    "protocol": "tcp",
    "src_port": 12345,
    "dst_port": 4444,
    "flags": ["SYN"]
  },
  "verdict": "malicious",
  "flags_list": [
    { "type": "suspicious_port", "detail": "destination port 4444 is on the suspicious ports list" },
    { "type": "c2_signature", "detail": "payload matched: beacon" }
  ],
  "payload_entropy": 2.585
}

Verdicts: benign · suspicious (entropy above threshold) · malicious (C2 signature or suspicious port). Errors: 400 INVALID_HEX (non-hex, odd length, < 14 bytes, undissectable).

Source contract imported from Network Packet Threat Analyzer/app.py. Handler: hex_analyze. Reference: docs/endpoints/v2.md.

Snapshot from docs/endpoints/v2.md for source API version 0.0.2. This is source documentation, not evidence that an upstream is deployed.

GET /rules — Rule Catalog

Returns the active rule set, limits, and tunables.

200 OK:

{
  "status": "ok",
  "rules": [
    {
      "id": "c2_signature",
      "name": "C2 Signature Match",
      "weight": 40,
      "severity": "critical",
      "description": "Matches known command-and-control patterns (.onion, .tk, c2., beacon) inside payloads",
      "threshold": "any match in any TCP/UDP payload",
      "tunables": ["KNOWN_C2_PATTERNS"]
    }
  ],
  "limits": {
    "max_upload_bytes": 26214400,
    "max_batch_captures": 10,
    "max_batch_total_bytes": 26214400,
    "supported_formats": ["pcap", "pcapng"],
    "sensitivity_levels": ["low", "medium", "high"],
    "cache_ttl_seconds": 60
  },
  "version": "0.0.2"
}

Source contract imported from Network Packet Threat Analyzer/app.py. Handler: rules. Reference: docs/endpoints/v2.md.

Snapshot from docs/endpoints/v2.md for source API version 0.0.2. This is source documentation, not evidence that an upstream is deployed.

POST /compare — Capture Diffing

Multipart only: fields pcap_a and pcap_b. Query param sensitivity.

200 OK:

{
  "status": "ok",
  "packet_delta": 4,
  "new_endpoints": [["10.0.0.5", "45.77.12.9", 49152, 4444, "tcp"]],
  "removed_endpoints": [["10.0.0.20", "93.184.216.34", 50000, 80, "tcp"]],
  "protocol_drift": { "added": [], "removed": ["icmp"] },
  "threat_score_before": 25,
  "threat_score_after": 100,
  "score_delta": 75,
  "detections_added": ["c2_signature", "suspicious_port"],
  "detections_removed": [],
  "sensitivity": "medium"
}

Endpoint tuples are [src_ip, dst_ip, src_port, dst_port, protocol].

Source contract imported from Network Packet Threat Analyzer/app.py. Handler: compare. Reference: docs/endpoints/v2.md.

Snapshot from docs/rapidapi-endpoints.md for source API version 0.0.2. This is source documentation, not evidence that an upstream is deployed.

11. POST /report

Description: Executive report with human-readable verdict, severity-ranked findings, and actionable remediation guidance for each detection type.

Request Example 1 (multipart file):

curl --request POST \
  --url 'https://network-packet-threat-analyzer.p.rapidapi.com/report' \
  --header 'x-rapidapi-key: YOUR_KEY' \
  --header 'x-rapidapi-host: network-packet-threat-analyzer.p.rapidapi.com' \
  --form '[email protected]'

Request Example 2 (JSON with base64):

B64=$(base64 -i capture.pcap | tr -d '\n')

curl --request POST \
  --url 'https://network-packet-threat-analyzer.p.rapidapi.com/report' \
  --header 'x-rapidapi-key: YOUR_KEY' \
  --header 'x-rapidapi-host: network-packet-threat-analyzer.p.rapidapi.com' \
  --header 'content-type: application/json' \
  --data "{\"pcap_b64\": \"$B64\"}"

Request Body (JSON):

{
  "pcap_b64": "<base64-encoded PCAP data>"
}

Response 200:

{
  "status": "ok",
  "summary": {"packets_analyzed": 142, "threat_level": "high"},
  "threat_score": 75,
  "score_breakdown": [{"rule": "c2_signature", "points": 40, "count": 1}],
  "sensitivity": "medium",
  "verdict": "HIGH RISK",
  "headline": "2 high-risk indicator(s): C2 Signature Match, Beacon Behavior",
  "findings": [
    {
      "severity": "critical",
      "title": "C2 Signature Match",
      "detail": "Matches known command-and-control patterns... (packet #12, patterns [beacon])",
      "remediation": "Block the C2 destination IPs at the firewall and isolate affected hosts; collect memory and disk forensics."
    },
    {
      "severity": "high",
      "title": "Beacon Behavior",
      "detail": "regular periodic connections detected",
      "remediation": "Isolate beaconing hosts and investigate the destination endpoints; check for scheduled tasks and persistence."
    }
  ],
  "remediation_summary": "Block or restrict the flagged ports at the perimeter; Block the C2 destination IPs at the firewall and isolate affected hosts; collect memory and disk forensics.",
  "request_id": "..."
}

Source contract imported from Network Packet Threat Analyzer/app.py. Handler: report. Reference: docs/rapidapi-endpoints.md.

Snapshot from docs/endpoints/v2.md for source API version 0.0.2. This is source documentation, not evidence that an upstream is deployed.

POST /strings — Payload String Extraction

Query params: min_len (default 6, max 1024), top_n (default 100, max 1000).

200 OK:

{
  "status": "ok",
  "strings": [
    { "value": "GET /beacon HTTP/1.1", "packet_index": 1, "entropy": 3.7842 }
  ],
  "total_strings": 30
}

Sorted by entropy (descending) — most random-looking strings first.

Source contract imported from Network Packet Threat Analyzer/app.py. Handler: strings. Reference: docs/endpoints/v2.md.

Snapshot from docs/rapidapi-endpoints.md for source API version 0.0.2. This is source documentation, not evidence that an upstream is deployed.

13. POST /jobs

Description: Submit an async analysis job for large captures without blocking the HTTP request. Returns a job ID to poll with GET /jobs/{id}.

Request Example 1 (multipart file):

curl --request POST \
  --url 'https://network-packet-threat-analyzer.p.rapidapi.com/jobs' \
  --header 'x-rapidapi-key: YOUR_KEY' \
  --header 'x-rapidapi-host: network-packet-threat-analyzer.p.rapidapi.com' \
  --form '[email protected]'

Request Example 2 (JSON with base64):

B64=$(base64 -i capture.pcap | tr -d '\n')

curl --request POST \
  --url 'https://network-packet-threat-analyzer.p.rapidapi.com/jobs' \
  --header 'x-rapidapi-key: YOUR_KEY' \
  --header 'x-rapidapi-host: network-packet-threat-analyzer.p.rapidapi.com' \
  --header 'content-type: application/json' \
  --data "{\"pcap_b64\": \"$B64\"}"

Request Body (JSON):

{
  "pcap_b64": "<base64-encoded PCAP data>"
}

Response 202:

{
  "status": "accepted",
  "job_id": "a8838851f49f471d8356977b93aa6b78",
  "job_status": "queued",
  "poll": "/jobs/a8838851f49f471d8356977b93aa6b78",
  "request_id": "..."
}

Source contract imported from Network Packet Threat Analyzer/app.py. Handler: create_job. Reference: docs/rapidapi-endpoints.md.

Snapshot from RAPID_README.md for source API version 0.0.2. This is source documentation, not evidence that an upstream is deployed.

GET /jobs/{job_id}

Poll an async analysis job for status and results.

Path Parameters:

curl -X GET \
  -H "x-rapidapi-key: YOUR_RAPIDAPI_KEY" \
  "https://network-packet-threat-analyzer-api.p.rapidapi.com/jobs/a8838851f49f471d8356977b93aa6b78"

Job states: queued → running → done | failed

Response (done):

{
  "status": "ok",
  "job_id": "a8838851f49f471d8356977b93aa6b78",
  "job_status": "done",
  "summary": {"packets_analyzed": 142, "threat_level": "high"},
  "detections": [{"type": "beacon_behavior", "reason": "regular periodic connections detected"}],
  "metrics": {"packets": 142, "file_size_bytes": 22140},
  "threat_score": 75,
  "score_breakdown": [{"rule": "beacon_behavior", "points": 25, "count": 1}],
  "sensitivity": "medium",
  "request_id": "..."
}

Source contract imported from Network Packet Threat Analyzer/app.py. Handler: get_job. Reference: RAPID_README.md.