4

I have a Wireshark .pcap Capture of around 500k packets and I would like to enumerate a Network Diagram with all the Routers, Switches, PCs etc.

Is Wireshark capable of such procedure or is there any other way that I could use to automatically generate one?

  • 1
    I'm not sure why people are voting to close this as off-topic. I suppose it might find a better audience on NetworkEngineering.StackExchange.com or even ServerFault, but I think it's a fine question for SuperUser as well. – Spiff Mar 24 '15 at 17:38
  • 1
    Heck I posted the exact same question in ServerFault and it got closed for being off-topic. I think it's a perfectly good enough question and relates to Networking as a whole, so why should it be off-topic? /rant @Spiff – Jonathan Davies Mar 24 '15 at 17:42
7

If you have captured the packets from a single point in the network, then the answer is no. You can tell which hosts are on your network, but there is no topology information that would tell you the route from A to B. If you have some prior knowledge of the addressing scheme, you might be able to infer subnets, but even that is doubtful. Switches and other devices that operate at layer 2 would be invisible to you (except for the ones directly connected to you).

Imagine you were at the post office sorting mail. You can tell by looking at the addresses on the envelopes who is talking to whom, but you would have no idea how many hands it passed through to get to you, or how many more until it gets to the destination.

There are systems/applications that map networks, but they do so by probing for devices, examining routing/forwarding tables on them to discover new devices, then repeating that process until it finds (mostly) everything. They don't capture network traffic.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.