Traditional packet analysis relies on sequential inspection of frames, which obscures higher-level structure and slows diagnosis, particularly for less experienced analysts. Network behaviour is inherently relational, involving hosts, conversations, and protocol groupings.

This session presents a practical approach to PCAP analysis using real-time topology visualisation. Traffic is represented as a graph of nodes (hosts) and edges (conversations), letting analysts immediately identify communication patterns, dependencies, and anomalies.

A single case study anchors the session: a threat hunt through a real 15,000-packet NetSupport RAT capture from a published malware-traffic-analysis.net exercise. In a packet list the C2 channel hides in plain sight: one conversation among nearly a hundred external hosts, on port 443, dressed as TLS. In the topology it surfaces as a persistent edge that never goes quiet. The built-in AI analysis then completes the picture: a deterministic, evidence-first engine flags 273 requests on a fixed 60-second timer inside a single long-lived connection, plus cleartext HTTP on a TLS port whose User-Agent names the tooling itself. The analysis runs on-device in the browser, every claim is grounded in the capture, and the suggested display filters pivot straight back into packet-level verification, completing the incident report from verdict to infected host, hostname, and user.

The session will show how topology-based analysis:

Reduces cognitive load by externalising relationships
Accelerates identification of attack and failure patterns
Supports both novice learning and expert triage workflows
Extends structural reasoning with grounded, on-device AI triage
Complements, rather than replaces, traditional packet inspection

Attendees will leave with a new mental model for analysing network traffic, and practical techniques for integrating structural reasoning and AI-assisted triage into their existing workflows.