FlowPCAP — Intelligent PCAP Analysis & Visualization Tool

📌 Overview

FlowPCAP is a lightweight tool to analyze PCAP files and visualize network topologies interactively.
It is designed for educational use — to help students and beginners understand how captured packets can be parsed, enriched, and converted into useful network diagrams.

✨ Features:

• Parse PCAP files into structured JSON
• Enrich nodes with MAC vendor metadata
• Compute simple suspiciousness scores
• Suggest one-line ACL actions for quick insights
• Interactive HTML topology viewer (manual + pyvis)

---

🚀 Quick Start

🔹 Using GitHub Codespaces (recommended)

1. Open this repository in GitHub Codespaces.
   Dependencies will be installed automatically via the devcontainer.
2. In the terminal, run:

bash

1. Generate a sample PCAP (optional)

python src/generate_pcap.py

2. Parse and enrich into JSON

python src/parse_pcap_enhanced.py data/sample.pcap output/topo_enh.json

3. Try pyvis HTML (may fail in some environments)

python src/visualize_enhanced.py output/topo_enh.json output/topology_enh.html

4. Robust manual viewer (always works)

python -m http.server 8000

then open in browser:

https://-8000.app.github.dev/output/topology_manual.html

🔹 Running Locally (Linux / macOS)

Install system packages:

sudo apt update && sudo apt install -y graphviz libpcap-dev

(or brew install graphviz on macOS)

Install Python dependencies:

python -m pip install -r requirements.txt

Run the same 3 commands as above (generate → parse → visualize).

📂 Repository Structure

FlowPCAP/

│

├── data/ # sample PCAPs

│ └── sample.pcap

│

├── output/ # generated JSON + HTML outputs

│ ├── topo_enh.json

│ └── topology_manual.html

│

├── src/ # core scripts

│ ├── generate_pcap.py

│ ├── parse_pcap_enhanced.py

│ └── visualize_enhanced.py

│

├── requirements.txt # dependencies

├── README.md # documentation

├── LICENSE # MIT license

└── .devcontainer/ # Codespaces setup

📊 Example Output

output/topo_enh.json → parsed and enriched network data

output/topology_manual.html → interactive topology viewer

💡 Open output/topology_manual.html in a browser — click nodes to view IP, MAC, vendor, suspicious score, and suggested ACL.

👨‍💻 Author

Omkar Bhagat

B.Tech (Computer Science & Engineering – Cybersecurity)

G. H. Raisoni International Skill Tech University, Pune