Packet analysis tools present traffic as linear sequences, requiring analysts to reconstruct relationships mentally. This session introduces a topology-based approach that visualises PCAP data as a graph of hosts and interactions, enabling immediate structural understanding.

Using a real NetSupport RAT infection from a published malware-traffic-analysis.net exercise, we compare traditional packet list workflows with topology-driven analysis. The approach reduces cognitive load, accelerates diagnosis, and highlights patterns that are difficult to see in sequential views.

The session also demonstrates a Wireshark-integrated workflow using PDML export, and an AI analysis engine that runs entirely in the browser: an evidence-grounded triage layer that identifies the infected host, its C2 beacon, and the protocol disguise in seconds, without packet data ever leaving the machine.