• net3d on SourceForge
• Using net3d

This project is based on an article I scanned, briefly, in CACM, while waiting for an interview. The idea, apparently from Vern Paxson and called the "Cube of Potential Doom", is to graph addresses of the IP packet traversing a network in 3-space. Apparently many forms of attack have obvious signatures in this representation. Further information about the original idea can be found at:

• http://www.nersc.gov/nusers/security/TheSpinningCube.php
• http://www.lbl.gov/ITSD/Security/news/spincube.ppt
• http://portal.acm.org/citation.cfm?id=990680.990699

I've never seen the original program, and do not know how it works (I have seen the single, ubiquitous, screenshot). This is not a re-implementation/reverse-engineering of that program. I plan to take the intrieging kernel idea and follow it wherever it leads,

The project consists of multiple, separate programs, which can be divided into two types, a single viewer and many data "sources". The viewer is the central program and embodies the project's central concept, the graphical representation of sampled network data. It is a standalone application, intended to run on multiple platforms, using no external services and implemented in Java, using Swing and Java3d. The viewer is currently basically functional. Additional features planned for it are:

• Improved, user-friendly configuration - Simplified packaging for common operating systems (including appropriate sources).
• First-person navigation through the graph.
• Graphic object selection: In particular, selection of a packet object to provide extended text description of packet data.
• Location information: when navigating through the graph, a status window provides addresses for current location, as well as, well-known port name, "whois" info, etc.

A "source" provides network data to the viewer. At present only two sources have been implemented. The simpler of the these simulates random packet arrival. It is trivial and is also written in Java. The second source is written in C and runs at a Unix command line. It uses the widely available pcap library to collect packets from a network and, periodically, send summaries off to the viewer. A third source, about which I know only that it is needed, will "replay" network activity from a journal, probably kept in one of the open databases.

One of the main reasons for bringing this project to SourceForge is that I do not know how to develop a "source" for the Windows operating system. I hope, by making the project available here, to solicit help in getting this essential piece built.