Icon

01_​Network_​Traffic_​Reporting

Network Traffic (PCAP) Reporting

This workflow calculates and visualizes connection statistics of IP addresses in a computer network. The package data of a small network was captured using Wireshark and exported as csv. The IP addresses were anonymized and enriched by assigning geo location data, such as latitude, longitude, city, country, and country flags to the IP addresses. This can be done using free, public services, such as freegeoip.net. The workflow calculates and visualizes the top N most frequent destination ports, IPs, and assigned countries for each IP address. Additionally, the geo locations of the destination IPs will be marked in an open street map visualization. The IP addresses to include in the analysis as well as the number N can be selected in the configuration dialog of the "Source IP Selection" component. The results of the analysis are shown in a report.

This workflow calculates, visualizes, and generates a report of connection statistics of IPadresses in a computer network. Selecting Source IP Creating Images for a Report Reading Data For each source IPConnectiondataSelection of interestingsource IPs for which the report is generatedConvert to table cellNetwork imageCreation of all chartsand images for reportList images in drop directoryCalculate domainsfor all columnsRead Wireshark dataenriched with geo data Group Loop Start Loop End Data to Report Source IP Selection Read Images Table To Image Image to Report Image Creation List Files Domain Calculator Table Reader This workflow calculates, visualizes, and generates a report of connection statistics of IPadresses in a computer network. Selecting Source IP Creating Images for a Report Reading Data For each source IPConnectiondataSelection of interestingsource IPs for which the report is generatedConvert to table cellNetwork imageCreation of all chartsand images for reportList images in drop directoryCalculate domainsfor all columnsRead Wireshark dataenriched with geo dataGroup Loop Start Loop End Data to Report Source IP Selection Read Images Table To Image Image to Report Image Creation List Files Domain Calculator Table Reader

Nodes

Extensions

Links

Download

To use this workflow in KNIME, download it from the below URL and open it in KNIME:

Download Workflow
Created by: Kilian
Created at: 2014-09-09
On NodePit since: 2019-07-12
Last update: 2024-04-24
Created with KNIME version: v4.1.0
Tags: reportingIPIP addresscyber security

Deploy, schedule, execute, and monitor your KNIME workflows locally, in the cloud or on-premises – with our brand new NodePit Runner.

Try NodePit Runner!