WAND Network Research Group University of Waikato Crest Of Arms

WAND Research

Quick Links

Visualisation

The bsod visualisation tool uses the libtrace framework to transform network traffic into a graphical format that can be viewed in real time. Capturing from a live network interface, or from a saved trace file, bsod visualises the flow of network data between hosts, providing (at a glance) information about network usage.

Changes!

May 27 2009:

The client now works on windows 7! This version fixes a few problems (esp with textures being upside down). No changes were made to the server.

January 27 2009:

This version introduces a complete rewrite of the client by Paul Hunkin. This allows for particles rendering and movement to be offloaded entirely onto the graphics card, has a server browser and several other new features. The server now can push a left and right image, so that images can be selected by source. The server now has configurable maximum sendq sizes.

Febuary 28 2008:

New versions of both the client and the server. This version should perform better under load. Also a fix to the server so it doesn't lockup occasionally.

March 1 2007:

New versions of both the client and the server. The config file format for the client has been changed since the last version. A new version of libtrace will be required. Dependancies that were built as part of the client and the server have been removed from the distribution and will need to be installed seperately.

June 30 2006:

New versions of both the client and the server. The networking protocol has changed since the last version. New features include a menu in the client to change the display, more efficient cpu and memory utilisation in both the client and the server. This version requires libtrace 3.
This new release by default uses a new graphics card feature called "point sprites." Not all graphics cards have this feature. If you don't see any packets, try disabling "billboarding" in the config file.

March 23 2005:

New versions of both the server and client have been released. The packet format has changed since the last release, and so the new versions of client and server are incompatable with the old ones.

  • Vastly better performance when a lot of flows are created and destroyed in a short period of time.
  • Performance improvements across the board.
  • Several new options to play with in the config file (see below).
  • Added help page (press F1 while the client is running).
  • P2P ports have their own colour now (for common ports only).
  • Particles are jittered in low framerate situations making the visualization look more pleasing.
  • New particle alpha map (looks nicer and creates dots, not squares, when particles are piled on top of each other).
  • Added the ability to toggle between all traffic and darknet (traffic going to addresses which have been the source of no traffic)traffic, allowing you to see scans and other "garbage" traffic more easily.
  • The server should now compile fine on FreeBSD

bsod Server

One half of the bsod visualisation is the server. This is responsible for the processing of captured packet headers, extracting the necessary information and packaging it for display by the client(s). The bsod server is known to compile and run in Linux. Source code, along with instructions on how to build/run the server, is available for download:

In addition, you will need to download and install libtrace. For new versions (> 1.6.0) you will also need libconfuse For older versions (< 1.6.0) you will need libconfig instead.



bsod Client

The other half of bsod is the client. Taking the flow, packet and addressing information supplied by the server, it displays data travelling from source to destination. The client is known to compile and run in Linux and Windows. Source is available for download as well as a precompiled Win32 binary.

The old bsod client software was based on the BuNg 3d engine written by Sam Jansen and Jesse Baker. See http://www.wand.net.nz/~stj2/bung/ for more information.