Watch attacks fly across the globe
PACKTEARTH resolves IPs to latitude/longitude via GeoIP and draws ballistic great-circle arcs from city to city. For location data you can use the redistributable DB-IP "IP to City Lite" (CC BY).
▶ Demo video
An open-source tool that visualizes — and sonifies — Internet traffic and cyber attacks as real-time 3D flying objects in your browser. Source, destination, ports and protocol become something you can actually see.
Agents collect traffic, the broker aggregates it, and your browser (Three.js) draws each packet as a flying object. Color encodes the protocol; the trajectory runs source → destination. Attacks and anomalies become obvious at a glance — visualization built for operators.
More than just rendering — collection, monitoring and integrations in one stack.
Packets fly as colored objects from the sender wall to the receiver wall. Multiple agents arrange into a polygon.
Ingest flow exports straight from real routers/switches. Dual-stack IPv4 and IPv6.
Resolve source/destination to latitude/longitude and draw attacks as great-circle arcs over a globe.
Anomaly detection (thmon) with CUSUM + EWMA — catches sudden shifts like SYN/FIN imbalance, untuned.
Ingest Snort / Suricata (EVE) alerts and overlay them on the visualization.
Sound effects, BGM, text-to-speech and on-screen messages — also hear your traffic.
PACKTEARTH resolves IPs to latitude/longitude via GeoIP and draws ballistic great-circle arcs from city to city. For location data you can use the redistributable DB-IP "IP to City Lite" (CC BY).
▶ Demo video
The latest PACKTER 3.0 has three parts: a Rust broker, C agents and a Three.js viewer. The legacy versions are still available.
The modernized release. broker (Rust) + agent (C/autotools) + web viewer. secure-by-default, CUSUM+EWMA, PACKTEARTH, translate mode.
The program and source are BSD 2-Clause. Models, textures, images and sounds are CC BY.