This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Network Topology Graph

0

Is there any wireshark plugin to get network topology graph ????????????

asked 29 Aug '13, 05:43

wiresharkbeginner's gravatar image

wiresharkbeg...
11112
accept rate: 0%

converted to question 29 Aug '13, 06:13

grahamb's gravatar image

grahamb ♦
19.8k330206

Your "answer" has been converted to a comment as that's how this site works. Please read the FAQ for more information.

(29 Aug '13, 06:14) grahamb ♦

2 Answers:

1

There is no feature in Wireshark to create a network topology graph.

The best you can do is to have a look at

Statistics -> Endpoints
Statistics -> Conversations

See also the answers to other, similar questions.

http://ask.wireshark.org/questions/20777/how-to-determine-the-network-topology-in-a-capture
http://ask.wireshark.org/questions/249/topology-map-gui-or-otherwise

Furthermore it (usually) does not make much sense to build a topology map from a single capture file, as in the vast majority of cases you will have only traffic of one network segment in a capture file, and with that data the map would be a flat picture of the nodes in that segment and possibly some communication endpoints outside that segment. This is basically what the both Statistics methods return (see above).

To be able to build a 'network topology map' of a larger network, you would need a lot of information (capture data) from every segment.

However, instead of using capture data it is probably much easier to use (commercial) tools that probe the network and try to create a map from that data. Google will list some of those tools: https://www.google.com/?q=automatic+network+topology+mapping+tools

One interesting free tool is nmap with its topology map in the GUI.

http://nmap.org/book/zenmap-topology.html

Regards
Kurt

answered 30 Aug '13, 01:52

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 30 Aug '13, 01:53

0

I run EtherApe at the same time to see the topology, then compare its log to the concurrent wireshark log to see what data was sent. It could be made simpler, but its something. Just a quick thought.

answered 30 Aug '13, 04:30

AdrianThePhotog's gravatar image

AdrianThePhotog
112
accept rate: 0%