Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Galaxy Tracer: A Topology-First 3D Interface for Interactive PCAP Exploration

Ryan Younger

Abstract

Packet analysis tools conventionally present capture data through tabular packet lists, constraining the analyst to a sequential view that obscures the relational structure of network communication. This paper presents Galaxy Tracer, a browser-native packet capture exploration system in which the default interface is an interactive three-dimensional network topology rather than a packet list. Hosts appear as spatially positioned nodes, conversations as edges, and protocol groupings as visually distinct clusters. A synchronized packet list remains available as a secondary view, sharing filter state with the topology so that structural and tabular inspection function as one continuous workflow. The system parses PCAP and PCAPNG formats, dissects over 90 protocols, and renders the topology through Three.js. The paper argues that the third spatial dimension is not merely aesthetic but analytically meaningful: it reveals density, clustering, host centrality, and communication scale that are difficult to perceive in list-only tools.

Galaxy Tracer: A Topology-First 3D Interface for Interactive PCAP Exploration

Abstract

Packet analysis tools conventionally present capture data through tabular packet lists, constraining the analyst to a sequential view that obscures the relational structure of network communication. This paper presents Galaxy Tracer, a browser-native packet capture exploration system in which the default interface is an interactive three-dimensional network topology rather than a packet list. Hosts appear as spatially positioned nodes, conversations as edges, and protocol groupings as visually distinct clusters. A synchronized packet list remains available as a secondary view, sharing filter state with the topology so that structural and tabular inspection function as one continuous workflow. The system parses PCAP and PCAPNG formats, dissects over 90 protocols, and renders the topology through Three.js. The paper argues that the third spatial dimension is not merely aesthetic but analytically meaningful: it reveals density, clustering, host centrality, and communication scale that are difficult to perceive in list-only tools.
Paper Structure (33 sections, 2 figures, 1 table)

This paper contains 33 sections, 2 figures, 1 table.

Table of Contents

  1. Introduction
  2. Problem Statement
  3. Related Work
  4. Design Goals
  5. Topology First
  6. Shared Analytic State
  7. Immediate Scale Perception
  8. Exploratory Interaction
  9. Browser-Native Delivery
  10. System Architecture
  11. Capture Ingestion
  12. Parsing and Normalization
  13. Graph Construction
  14. View Rendering
  15. Interaction Model
  16. ...and 18 more sections

Figures (2)

  • Figure 1: Galaxy Tracer in its default topology-first mode showing the built-in demo network: 20 hosts, 24 conversations, and 10 distinct protocols.
  • Figure 2: DNS filter applied with node 10.0.1.200 expanded, revealing its role as internal DNS server: three workstation clients (10.0.1.50, 10.0.1.51, 10.0.1.52) and two upstream resolvers (8.8.8.8 and 1.1.1.1) are visible simultaneously. The conversation panel confirms 153 DNS packets across 5 conversations.