Visualizes network topologies and communication flows from pcap files across device, IP, and TCP/UDP layers.
PcapViz is a Python-based tool that visualizes network topologies and communication flows from pcap files. It separates packet data into device, IP, and TCP/UDP layers to generate clear graphs, helping users analyze network traffic and identify patterns like data exfiltration attempts.
Network administrators, cybersecurity analysts, and developers working with packet capture data who need to visualize and analyze network traffic patterns.
It offers layered visualization that avoids mixing different communication levels, provides detailed node information with geo-IP data, and integrates with Graphviz for customizable graph layouts, making it more structured than generic packet analyzers.
Visualize network topologies and collect graph statistics based on pcap files
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Separates device, IP, and TCP/UDP layers to avoid clutter, making it easier to analyze specific communication levels as highlighted in the README's philosophy.
Displays country data, connection statistics, and reverse DNS hostnames on nodes, enhancing analysis with geo-context and domain insights.
Supports multiple Graphviz engines like dot and sfdp, allowing flexible rendering with different node shapes and layouts per user preference.
Lists most contacted and sending machines from pcap files, aiding in spotting patterns like data exfiltration as shown in the examples.
Requires specific steps for OSX and dependencies like Graphviz and Scapy, which can be error-prone and platform-dependent.
Relies on Maxmind geoIP data for country labels; without it, features are limited and tests may fail, as noted in the README.
Generates only static images via Graphviz, lacking interactive features or support for real-time updates beyond pcap files.