PCAPFunnel: A Tool for Rapid Exploration of Packet Capture Files

Data analysis, Data visualization, Network traffic analysis, Packet captures

Analyzing network traffic is one of the fundamental tasks in both network
operations and security incident analysis. Despite the immense efforts in
workflow automation, an ample portion of the work still relies on manual data
exploration and analytical insights by domain specialists. Current
state-of-the-art network analysis tools provide high flexibility at the expense
of usability and have a steep learning curve. Recent - often web-based -
analytical tools emphasize interactive visualizations and provide simple user
interfaces but only limited analytical support. This paper describes the tool
that supports the analytical work of network and security operators. We introduce
typical user tasks and requirements. We also present the filtering funnel
metaphor for exploring packet capture (PCAP) files through visualizations of
linked filter steps. We have created PCAPFunnel, a novel tool that improves the
user experience and speeds up packet capture data analysis. The tool provides an
overview of the communication, intuitive data filtering, and details of
individual network nodes and connections between them. The qualitative usability
study with nine domain experts confirmed the usability and usefulness of our
approach for the initial data exploration in a wide range of tasks and usage
scenarios, from educational purposes to exploratory network data analysis.

• pdf IV_21__PCAPFunnel-4.pdf 2 MB