Question

Does anyone know of a programme that can take a wireshark (pcap) trace and turn it into a visual network topology?

I have 3 pcap files with “ALOT” of data and I really want to see if I can make sense of some things.

I played with things like network miner but nothing that can give a visual cue to the data. For instance

Answer 1

You are in fact asking two questions:

1. How to discover the network topology from network traces
2. How to visualize the discovered topology

Topology Discovery

This is the hard part. The community has not yet have developed reliable tools, because network traffic exhibits so much hard-to-deal with crud. The most useful tool that comes to mind in this space is Bro, which creatse quality connection logs.

It is straight-forward to extract communication graphs, i.e., graphs that show who communicates with whom. By weighing the edges with some metric (number of packets/bytes/connections), you can get an idea about the relative contribution of a given node.

For more sophisticated analyses, you will have to develop some heuristics. For example, detecting routers may involve looking at packet forwarding behavior or extracting default gateways from DHCP ACK messages. Bro (“the Python for the network”) allows you to codify such analysis in a very natural form.

Graph Visualization

The low-key approach involves generating GraphViz output. Afterglow offers some wrapping that makes the output more digestible. For inspiration, checkout out http://secviz.org/ where you find many examples on such graphs. Most of them have been created with afterglow.

There is also Gephi, a more fancy graph visualization engine, which supports a variety of graph input formats. The generated graphs look quite fancy and can also be explored interactively.