\subsection*{NetCapVis}
NetCapVis \cite{NetCapVis_paper} is a prototype developed with the aim of providing analysis, through a visualization interface, of PCAP data. The main idea behind it is to provide an alternative to Wireshark \cite{WireShark_site} for the analysis of this type of data, by supporting the user in finding points of interest more easily and in less time. However, in its current prototype state, the developers consider the tool an interactive visual filter prior to delving into details with Wireshark. The prototype was developed following a client-server infrastructure, thus providing the user with a web service. One of the main features of NetCapVis is the use of progressive data processing. Progressive data processing is a technique used in data analysis and visualization that allows the user to interactively refine the results as more data is loaded and processed. For example, instead of waiting for all data to be processed before presenting the results, progressive data processing provides an iterative and incremental approach where partial results are displayed and refined as more data becomes available, allowing a faster data exploration and analysis.

\begin{figure}[h]
    \centering
    \includegraphics[scale=.3]{Figures/chapter4/NetCApVis/intro.png}
    \caption{File page of the application}
    \label{fig:netcapvis_intro}
\end{figure}

\begin{figure}[h]
    \centering
    \includegraphics[scale=.22]{Figures/chapter4/NetCApVis/demo.png}
    \caption{Analysis page of the application with demo dataset}
    \label{fig:netcapvis_demo}
\end{figure}

To showcase its features, an online version of the prototype is available \cite{NetCapVis_site}. On the file page (figure \ref{fig:netcapvis_intro}), users can choose to proceed with the demo dataset or upload their own PCAP file (figure \ref{fig:netcapvis_upload}), which is limited to a size of 1MB. Starting from the example data provided in the demo, the analysis page is obtained (figure \ref{fig:netcapvis_demo}). This page contains several visualizations, divided into different areas of the page. In the upper half of the page there is the timeline visualization which allows to inspect the volume, in bytes, of the packets over time. This visualization is split in two separated parts, the timeline context which provide an overview over the whole time span contained in the PCAP data, and the timeline focus, that shows the zoomed version of the brushed area in the timeline context view. The first one can be used for filtering based on time intervals, and the second one  shows additional details and information about the raw packet. On the left of the page we can find a bar chart representing the protocols stats, where we can choose to switch between the packet's number count and the volume of the packets, divided by the protocol type. This can be used for differentiate between the most know protocols and for filter packets for specific protocols. Right above this representation there a single stacked bar chart, which represents how many connections are incoming and outgoing. Its usefulness lies not only in transmitting the information and the proportion between the two data, but as with all interactive visualizations on the page, it allows you to filter based on what is selected. In the lower central part a graph view of the connections is shown, to allow grasp interesting patterns or connections in the network at a glance. This views also permits to switch between two representations, IP addresses or Ports. The last two representations are also bar charts. They are located in the lower right corner and represents the source and destination visualization. They can be also switched from representing IPs and ports and they can help to identify attacks that focus on opening large numbers of connections to the same IP or identify sources that scan for ports of a specific connection. The last two components that compose the page structure are not actual views but are a simple list of active filters, filters that can also be imported using the Wireshark syntax, using the appropriate button, and lastly a button that shows the raw data contained in the package.

\begin{figure}
     \centering
     \begin{subfigure}[h]{0.3\textwidth}
         \centering
         \includegraphics[scale=.3]{Figures/chapter4/NetCApVis/file_upload.png}
         \caption{File uploaded}
         \label{fig:netcapvis_file_upload}
     \end{subfigure}
     \hfill
     \begin{subfigure}[h]{0.5\textwidth}
         \centering
         \includegraphics[scale=.32]{Figures/chapter4/NetCApVis/file_statistics.png}
         \caption{File uploaded and statistics calculated}
         \label{fig:netcapvis_file_statistics}
     \end{subfigure}
     \hfill
        \caption{Upload options}
        \label{fig:netcapvis_upload}
\end{figure}

As highlighted by the results of the tests conducted by the developers themselves, the prototype should be considered targeted towards experts in this field rather than simple users. As previously mentioned, it should be seen as a support or pre-filter for more specific analyses conducted through more concrete tools. Graphically, the chosen representations may be limited to certain types of analysis, disadvantaging others. For example, by importing a PCAP file \cite{packet_captures_site} containing a TCP reflection attack, it can be noted that not all the produced visualizations are suitable (figure \ref{fig:netcapvis_file}). Regarding PCAP files, it is not always possible to limit the size of the analysis to 1MB of file, which is why it would be necessary to increase the size of the importable files.

\begin{figure}[h]
    \centering
    \includegraphics[scale=.22]{Figures/chapter4/NetCApVis/file_view.png}
    \caption{Analysis page of the application with imported PCAP file}
    \label{fig:netcapvis_file}
\end{figure}

Regarding the development of the prototype, the various phases can be described as follows. Unlike other developments that we have seen previously, the first information provided about it can be attributed to the \emph{Data Preparation} phase. Details about the sources of the data used are not provided, but an important examination is carried out on the various processes that the data undergoes before being visualized. One of these processes is the pre-upload filtering (figure), which allows for a reduction of packets that are not relevant to the analysis even before they are sent to the engine that will render them. Immediately after, for the \emph{Visualization Goals} definition part, the main objectives that the prototype must have are defined through a use-case driven approach. Among the main objectives, we can mention, for example, Find suspicious connections in large packet captures or Determine relevant events to filter for in Wireshark, also highlighting here how, after an in-depth analysis, the initial goal of providing an alternative to Wireshark has evolved into an objective that emphasizes the correlation between the two and the need for the prototype to have a second tool for further analysis. In this case, no information is provided regarding the search and eventual selection corresponding to the \emph{Exploration} and \emph{Visualization} phases. Although for the second phase, there was a brief description in the previous section, for a more in-depth analysis, the related paper is referred to. Finally, regarding the \emph{Feedback and fine-tune} phase, in this case, surveys were conducted, both with non-specialized users without experience in network traffic and with specialized users. From the results obtained from both students and experts, we can note how the prototype has evolved, both in terms of functionality, such as the possibility of seeing the packet list shown before, and in terms of user experience, introducing, for example, the possibility of conducting a tutorial during the use of the tool. Unfortunately, it is not possible to analyze in what ways and at what timing any ``tuning" was made, as no information is available regarding the code or version of the prototype.




