5

Does anyone know of a programme that can take a wireshark (pcap) trace and turn it into a visual network topology?

I have 3 pcap files with "ALOT" of data and I really want to see if I can make sense of some things.

I played with things like network miner but nothing that can give a visual cue to the data. For instance enter image description here

G Gr
  • 6,030
  • 20
  • 91
  • 184
  • 2
    Just wondering if you have found some good solutions to this question of yours? i am also looking for similar stuff.... – pnp Aug 03 '13 at 07:41

1 Answers1

7

You are in fact asking two questions:

  1. How to discover the network topology from network traces
  2. How to visualize the discovered topology

Topology Discovery

This is the hard part. The community has not yet have developed reliable tools, because network traffic exhibits so much hard-to-deal with crud. The most useful tool that comes to mind in this space is Bro, which creatse quality connection logs.

It is straight-forward to extract communication graphs, i.e., graphs that show who communicates with whom. By weighing the edges with some metric (number of packets/bytes/connections), you can get an idea about the relative contribution of a given node.

For more sophisticated analyses, you will have to develop some heuristics. For example, detecting routers may involve looking at packet forwarding behavior or extracting default gateways from DHCP ACK messages. Bro ("the Python for the network") allows you to codify such analysis in a very natural form.

Graph Visualization

The low-key approach involves generating GraphViz output. Afterglow offers some wrapping that makes the output more digestible. For inspiration, checkout out http://secviz.org/ where you find many examples on such graphs. Most of them have been created with afterglow.

There is also Gephi, a more fancy graph visualization engine, which supports a variety of graph input formats. The generated graphs look quite fancy and can also be explored interactively.

Community
  • 1
  • 1
mavam
  • 12,242
  • 10
  • 53
  • 87
  • Nothing else? Was hoping for something abit more savvy. – G Gr Jul 14 '12 at 01:56
  • What do you mean by savvy? Topology discovery or visualization? (I beefed up the answer a bit.) – mavam Jul 14 '12 at 19:11
  • WOW on Gephi! Grade A find, thats even going to help with my data analysis in matlab on network data! Still tho topology discovery is weak, strange why no one has written something decent for it. Would be nice if GNS3 could load pcap files and load a structured topological map. – G Gr Jul 14 '12 at 23:11