Galaxy Tracer: A Topology-First 3D Interface for Interactive PCAP Exploration

TL;DR

Galaxy Tracer introduces a 3D network topology interface for PCAP exploration, enhancing analysts' ability to perceive relational structures and communication patterns beyond traditional list-based tools.

Contribution

The paper presents a novel 3D visualization system for PCAP analysis that integrates topology and packet list views, improving structural understanding and workflow efficiency.

Findings

Reveals network density and clustering more effectively.

Supports over 90 protocols with real-time filtering.

Enhances analytical insights through spatial visualization.

Abstract

Packet analysis tools conventionally present capture data through tabular packet lists, constraining the analyst to a sequential view that obscures the relational structure of network communication. This paper presents Galaxy Tracer, a browser-native packet capture exploration system in which the default interface is an interactive three-dimensional network topology rather than a packet list. Hosts appear as spatially positioned nodes, conversations as edges, and protocol groupings as visually distinct clusters. A synchronized packet list remains available as a secondary view, sharing filter state with the topology so that structural and tabular inspection function as one continuous workflow. The system parses PCAP and PCAPNG formats, dissects over 90 protocols, and renders the topology through Three.js. The paper argues that the third spatial dimension is not merely aesthetic but analytically meaningful: it reveals density, clustering, host centrality, and communication scale that are difficult to perceive in list-only tools.