Skip to content

Scaut - Framework for Real-time Network Data Visualization

Scaut visualizes real-time network data for quick identification of certain patterns in network traffic.

It uses pyshark to capture real-time network traffic, which is sent to Touchdesigner as raw bytes. Touchdesigner then visualizes the data in 3D space. Each particle's XYZ position is defined by sliding a 3-byte window over the raw network data, offsetting one byte at a time; the first byte is the X position, second byte is Y, and third is Z.

The work Christopher Domas has done on binary file visualization has always been fascinating to me. His Cantor Dust project heavily inspired Scaut. I wanted to see what insight could be obtained by empowering human pattern recognition capabilities to identify network data patterns, the same way Domas applies our innate abilities to binary file analysis.

The most recognizable pattern is encrypted vs. unencrypted data; high-entropy (encrypted) network data. Encrypted network data looks like an evenly distributed point cloud through the cube, whereas unencrypted or plaintext network data has obvious structure. ASCII text is very noticeable in a bright smaller cube. Unencrypted counters (incrementing bytes) appear as "snakes" that move in a single dimension across the cube. If Unicode text is sent or received unencrypted, larger glowing cubes appear in the Unicode byte range.

unicode vis Visiting an unencrypted website with Chinese characters show up as unique blocks of particles that represent unencrypted Unicode

In addition to visualizing the raw bytes, printable network data is rendered on the cube in red text.

Geographic information for each IP addresses is queried and displayed on a globe in the bottom left. In a later version of Scaut, an option to see a separate cube visualizing network data for each IP address will be added, giving more granular insight into which services are transmitting what kind of data.

image Visiting an unencrypted website with many printable ASCII characters show up as a prominent small cube

References: