Packet analysis tools present traffic as linear sequences, requiring analysts to reconstruct relationships mentally. This session introduces a topology-based approach that visualises PCAP data as a graph of hosts and interactions, enabling immediate structural understanding.

Using real examples, including DNS failure caused by misconfigured routing, we compare traditional packet list workflows with topology-driven analysis. The approach reduces cognitive load, accelerates diagnosis, and highlights patterns that are difficult to see in sequential views.

The session also demonstrates a Wireshark-integrated workflow using PDML export, allowing packet captures to be transferred directly into GalaxyTracer for interactive topology visualisation and anomaly analysis.