SYNFloodAlert_Windows.cs

// $t@$h
// Go through script and configure to your net.
// Go through script and configure to your SMTP.
// Tailor how often to poll.
// This script DOES NOT modify your system.
// From GCore learned to add additional check for PSH
using System;
using System.Net;
using System.Net.Sockets;
using System.Net.Mail;
using System.Collections.Generic;
using System.Threading;
using System.Linq;

class Program
{
    static void Main(string[] args)
    {
        SynFloodDetector detector = new SynFloodDetector();
        detector.StartListening();
    }
}

class SynFloodDetector
{
    private Socket rawSocket;
    private const int SYN_THRESHOLD = 100; // Packet limit
    private Dictionary<string, int> synCountPerIP = new Dictionary<string, int>();

    public SynFloodDetector()
    {
        rawSocket = new Socket(AddressFamily.InterNetwork, SocketType.Raw, ProtocolType.IP);
        string localIP = GetLocalIPAddress();
        rawSocket.Bind(new IPEndPoint(IPAddress.Parse(localIP), 0));
        // rawSocket.Bind(new IPEndPoint(IPAddress.Parse("A_Different_IP_Address"), 0));
        rawSocket.IOControl(IOControlCode.ReceiveAll, new byte[] { 1, 0, 0, 0 }, null);
    }

    private string GetLocalIPAddress()
    {
        var host = Dns.GetHostEntry(Dns.GetHostName());
        return host.AddressList.FirstOrDefault(ip => ip.AddressFamily == AddressFamily.InterNetwork)?.ToString() ?? "127.0.0.1";
    }
    private bool IsPshPacket(byte[] buffer, int bytesRead)
    {
        if (bytesRead > 20) // Min length of IP header
        {
            int ipHeaderLength = (buffer[0] & 0x0F) * 4;
            if (bytesRead > ipHeaderLength + 20) // Min length of TCP header
            {
                byte tcpFlags = buffer[ipHeaderLength + 13];
                bool pshFlag = (tcpFlags & 0x08) != 0; // PSH flag is third bit from the right

                return pshFlag;
            }
        }
        return false;
    }
    private bool IsSynPacket(byte[] buffer, int bytesRead)
    {
        // Simplified check for SYN packet
        if (bytesRead > 20) // Min length IP header
        {
            int ipHeaderLength = (buffer[0] & 0x0F) * 4;
            if (bytesRead > ipHeaderLength + 20) // Min length TCP header
            {
                byte tcpFlags = buffer[ipHeaderLength + 13];
                bool synFlag = (tcpFlags & 0x02) != 0;
                bool ackFlag = (tcpFlags & 0x10) != 0;

                return synFlag && !ackFlag;
            }
        }
        return false;
    }

    public void StartListening()
    {
        byte[] buffer = new byte[4096];
        Console.WriteLine("Listening for SYN packets...");

        while (true)
        {
            int bytesRead = rawSocket.Receive(buffer);
            var sourceIp = GetSourceIP(buffer, bytesRead);
            if (IsSynPacket(buffer, bytesRead)) // SYN flood detect
            {
                if (!synCountPerIP.ContainsKey(sourceIp))
                    synCountPerIP[sourceIp] = 1;
                else
                    synCountPerIP[sourceIp]++;

                if (synCountPerIP[sourceIp] > SYN_THRESHOLD)
                {
                    SendEmailNotification("SYN Flood Detected", $"!!!Potential SYN flood detected from: {sourceIp}.");
                    synCountPerIP[sourceIp] = 0; // Reset
                }
            }
            else if (IsPshPacket(buffer, bytesRead)) // PSH Detect
            {
                SendEmailNotification("PSH Flag Detected", $"!!!SYN-PSH flag has been detected from: {sourceIp}.");
            }

            Thread.Sleep(1000); // Check every second. Can tailor this
        }
    }

    private string GetSourceIP(byte[] buffer, int bytesRead)
    {
        if (bytesRead > 20) // Min length IP header
        {
            byte[] ipSrc = new byte[4];
            Array.Copy(buffer, 12, ipSrc, 0, 4);
            return new IPAddress(ipSrc).ToString();
        }
        return "Unknown";
    }

    private void SendEmailNotification(string subject, string body)
    {
        var fromAddress = new MailAddress("your_email@etc.com", "From Name");
        var toAddress = new MailAddress("recipient_email@otheretc.com", "To Name");
        const string fromPassword = "your_email_password"; // Be careful
        var smtp = new SmtpClient
        {
            Host = "smtp.etcetc.com", // SMTP host
            Port = 587,
            EnableSsl = true,
            DeliveryMethod = SmtpDeliveryMethod.Network,
            UseDefaultCredentials = false,
            Credentials = new NetworkCredential(fromAddress.Address, fromPassword)
        };
        using (var message = new MailMessage(fromAddress, toAddress)
        {
            Subject = subject,
            Body = body
        })
        {
            smtp.Send(message);
        }
    }
}