A web based pcap analyzer will be created. The analyzer will extract application level information from pcap files, visualize them and display them at the web interface. After uploading the files, packet protocols will be detected, analyzed and the information is saved. Time Line visualiation[1] will display the protocols in the pcap file. When the protocol is clicked, a new page will display more information related with the protocol. For an application level protocol like HTTP, this information will be attached files, whether there have malicious codes or not, if the return answer is an html file then the response headers and the body, etc. At this page, treemaps[2] and parallel coordinates[3] will be used to give detail information about packet bytes and port numbers. 

A general scatter plot visualization[4] will be used the to display the distribution of the protocols uploaded till that time.

Yara will be used to analyze binary files. Some external js analyzers[5] will be used to analyze the files at the html files.

The site will have modular approach so that other analyzer will be be able to be plugged in in the following days. Same is valid also for protocol detection. At the beginning, it is planned to use the Bro as protocol detection. For the unknown or undetected protocols, detectors will be written to Bro or one may write its own protocol detection.

The site will have a CLI also, but at the first site it will be a Django based application. Anyone will be able to download and run at the local machine.

[1] http://timeglider.com/jquery/, http://www.simile-widgets.org/timeline/

[2] http://mbostock.github.com/d3/ex/treemap.html/

[3] http://exposedata.com/parallel/veggie/, http://bl.ocks.org/1341281/

[4] http://mbostock.github.com/protovis/ex/dot.html/

[5] http://jsunpack.jeek.org/,http://wepawet.iseclab.org/