Security Tools · Network triage

Network Traffic Triage Tool

Upload a packet list exported from Wireshark and get a plain-English triage report: who talked the most, to whom, over which protocols — and which patterns a SOC analyst would want to look at more closely, with the reasons why.

Your packet capture data is analysed locally in your browser and is not uploaded anywhere. No server, no AI service, no analytics, no cookies. The page is locked so it cannot make network requests.

Educational network triage tool. Alerts indicate activity worth investigating and do not prove malicious behaviour.
Only analyse traffic from systems and networks you own or are authorised to monitor.

Jump to: Analyse a capture · How to think like an analyst · Export from Wireshark · Limitations

1. Load a capture

Export from Wireshark with File → Export Packet Dissections → As CSV… Version 1 reads CSV exports only — not .pcap or .pcapng files.

Demo data

Fictional captures using private and documentation IP addresses. Use them to try the tool or record a demo.

Or download them to try the upload: normal · high-volume · mixed SOC lab

Suggested demo walkthrough
  1. Normal traffic: load it and show there are no alerts — and that the Rule Coverage table shows how close each host came to a threshold.
  2. Suspicious sample: one host sends more than 50 packets → High Activity Host alert.
  3. Mixed SOC lab: one host contacts 40 systems → Possible Network Scanning, plus ICMP, DNS, port and SYN alerts.
  4. The lesson: open any alert and read Possible benign explanations. The “suspicious” host in sample 2 could simply be a backup. Detection tells an analyst where to look. Investigation determines what actually happened.

2. Detection thresholds

These numbers are educational defaults, not universal security thresholds. Thresholds should be adjusted based on the environment. A busy server may legitimately generate thousands of packets, while the same activity from another endpoint might deserve investigation. Changes apply immediately.

Rule 1 · High Packet Volume
Rule 2 · Possible Host Scanning
Rule 3 · Possible Port Scanning
Rule 4 · High ICMP Activity
Rule 5 · High DNS Query Activity
Rule 6 · Repeated Communication
Rule 7 · TCP SYN-Heavy Activity

An alert fires when a count is greater than its threshold.

How to Think Like an Analyst

An anomaly is a starting point for investigation, not proof of compromise.

  1. Observe unusual behaviour. Something stands out: more packets, more destinations, an odd protocol.
  2. Identify the source and destination. What devices are these? Who owns them? What is their job?
  3. Determine which protocol is involved. DNS, ICMP, TLS and SMB all tell different stories.
  4. Establish whether the activity is expected. A backup server moving gigabytes at 2 am is normal; a reception PC doing it is not.
  5. Look for supporting indicators. Failed connections, random-looking domain names, regular timing, unusual ports.
  6. Correlate with other security telemetry. Endpoint logs, firewall logs, authentication logs, threat intelligence.
  7. Decide whether further investigation is required. Close it as benign (and maybe tune the threshold), or escalate with your evidence.

Every alert in this tool lists possible benign explanations on purpose. Real SOC work is mostly ruling things out. A good analyst can explain both why something might be bad and why it might be fine.

Getting a CSV out of Wireshark

  1. Open Wireshark.
  2. Capture traffic in an authorised environment — your own devices, a home lab, or a network you have written permission to monitor.
  3. Stop the capture.
  4. Choose File → Export Packet Dissections → As CSV… Keep “Summary line” and “Include column headings” ticked.
  5. Upload the CSV here.

Tips: the default columns (No., Time, Source, Destination, Protocol, Length, Info) are all this tool needs. Turning off name resolution keeps addresses as IPs. Capturing traffic on networks you are not authorised to monitor may be illegal.

Limitations

Educational network triage tool. Alerts indicate activity worth investigating and do not prove malicious behaviour. Only analyse traffic from systems and networks you own or are authorised to monitor.