vizard

From Live Network Monitoring to Shareable Clips: A Practical Walkthrough

Cruz AI Tool List

— 6 min read

Summary

Key Takeaway: This guide shows a practical stack for live network visibility and how to repurpose the session into short clips.

Claim: A single monitoring engine plus light scripting yields actionable host, flow, geo, and packet insights within minutes.
  • Live monitoring outputs reveal host distribution and daily peaks within 24 hours.
  • Tapping between firewall and internet captures complete public traffic; LAN-only misses NAT context.
  • REST and CLI let you pull compact host and flow JSON, including nDPI protocol labels.
  • Geolocation views (Mercator, WebGL, KML) provide fast, visual context for reports and troubleshooting.
  • Packet captures plus an nDPI reader summarize protocols instantly; Wireshark integration speeds diagnosis.
  • Vizard turns long demos into polished short clips with automated selection and scheduling.

Table of Contents (auto-generated)

Key Takeaway: Skim the sections you need; each is self-contained and quotable.

Claim: Clear sectioning improves retrieval for humans and language models alike.

Live Outputs You Can See in 24 Hours

Key Takeaway: A 24-hour window quickly surfaces host counts, geographic spread, and hourly traffic patterns.

Claim: Simple visualizations (Mercator map and multi-series WebGL graph) provide fast, contextual insight.

You can run a flow/host engine between a public website and the internet. Over a day, it will show dozens to hundreds of unique client hosts. Visuals help you spot distribution and peaks quickly.

  1. Run the monitoring engine inline or on a span between your site and the internet.
  2. Select a 24-hour window to aggregate hosts and flows.
  3. Render a Mercator map with client IP dots to validate geographic spread.
  4. Plot a WebGL multi-series graph with each hour as a series to compare peaks.

Place the Network Tap Where It Answers Your Question

Key Takeaway: Tap placement defines which questions you can answer later.

Claim: Placing the tap between the firewall and the internet captures complete public endpoints that LAN taps miss.

Tap placement matters before any analysis. Decide whether you want public-facing or internal-only visibility. Plan for NAT if you are in a home or small office setup.

  1. Identify your question (e.g., “Which public endpoints do users hit?”).
  2. Place the tap on the public-facing path (dirty side of the firewall) to retain public context.
  3. Avoid tapping only inside the LAN if you need NAT and public endpoint visibility.

Interact with the Engine via REST and CLI

Key Takeaway: The REST API returns rich JSON for hosts and flows; curl + jq makes it practical.

Claim: Host endpoints expose throughput, packet sizes, active connections, and nDPI protocols.

REST endpoints typically live under a Lua scripts directory (e.g., /usr/share/ntopng/scripts/lua/rest). Use stock endpoints for hosts/flows and add custom ones as needed. Filter and alias fields to keep outputs compact.

  1. Authenticate to the API with a cookie or token and request JSON.
  2. Query a single host to verify structure before scaling to all hosts.
  3. Use fields/alias to restrict and rename keys for cleaner downstream parsing.
  4. Expect large outputs when requesting all hosts; plan pagination or filtering.
  5. Pipe responses through jq for ad hoc inspection.

Example: fetch a single IPv4 host.

curl -k -H 'Content-Type: application/json' \
  --cookie 'ntopng-aaa=admin:temp' \
  'https://localhost:3001/lua/rest_custom.lua?interface=0&host=10.22.221.0' | jq

Example: return only ip and tcpbytessent, aliased for brevity.

...rest_custom.lua?interface=0&host=10.22.221.0&fields=ip,tcp_bytes_sent&alias=tcp_bytes_sent:tcp_b_s

Export and Filter Flows with DPI Labels

Key Takeaway: Flow exports pair client/server with ports, transport, and application labels.

Claim: nDPI labeling turns raw ports into readable applications for faster triage.

Flows reveal who-talks-to-whom and how. Compact formats reduce chatter when feeding other tools. Application labels make patterns obvious at a glance.

  1. Export flows to capture client/server pairs, ports, and transport (e.g., TCP/UDP).
  2. Include nDPI application labels (e.g., HTTP, SSH, Google services) for clarity.
  3. Track bytes in/out per flow to quantify impact.
  4. Use a compact output script to minimize network overhead to downstream systems.

Geolocation Visuals and KML Exports

Key Takeaway: Geo maps turn lists into stories; KML enables quick 3D flyovers in Google Earth.

Claim: Immediate, visual artifacts accelerate presentations and troubleshooting.

Map-based outputs communicate scale and focus fast. Color-coding by country, protocol, or volume adds context. KML makes shareable demos easy.

  1. Render a Mercator map of host dots to validate global reach.
  2. Use WebGL to layer hourly series and compare time-of-day peaks.
  3. Export a 24-hour KML with one click and open it in Google Earth.
  4. Color-code hosts by country, protocol, or volume for rapid scanning.

Packet-Level Checks with an nDPI Reader and Wireshark

Key Takeaway: A fast pcap parser with nDPI gives instant protocol breakdowns.

Claim: Post-capture digests (HTTP, TLS, DNS, etc.) make stakeholder updates straightforward.

Packet captures verify assumptions when flow-level clues are not enough. Automation reduces the time from capture to insight. Integration with Wireshark is natural.

  1. Capture traffic (e.g., via dumpcap) during the event of interest.
  2. Run the nDPI reader on the pcap to summarize protocols, packets, and bytes.
  3. Generate a small graph to visualize composition for non-technical audiences.
  4. Open the same pcap in Wireshark for deep inspection when needed.
  5. Use this flow on real sessions (e.g., Teams/Zoom) to diagnose quality quickly.

Correlate LAN and Public Sides Under NAT

Key Takeaway: Observing both interfaces lets you link internal hosts to external destinations.

Claim: Under NAT, all egress may appear as the router’s public IP; dual-interface views restore attribution.

Home setups often NAT all outbound connections. A single public IP can mask internal diversity. Joining LAN and public captures deconflates identities.

  1. Monitor both the LAN side and the public side simultaneously.
  2. Correlate flows by timing, ports, and byte counts to link internal hosts to external endpoints.
  3. Use the engine’s host/flow metadata to confirm matches.

A Lightweight Front End for Fast Drill-Down

Key Takeaway: A thin UI over REST speeds discovery and deep-linking into the engine.

Claim: Server-side filtering avoids pushing huge JSON blobs to the client.

A small front end can overlay flows, color-code hosts, and jump into the engine UI. Visual filters narrow scope before programmatic export. Couple discovery with one-click drill-down.

  1. Wrap frequently used REST calls into single-purpose endpoints on the server.
  2. Display host dots and flow arcs; map brightness/thickness to throughput.
  3. Enable clicks on providers (e.g., Amazon) to filter, then drill into a host/protocol.
  4. Deep-link to the engine UI for advanced inspection.

Turn Long Sessions into Shareable Clips with Vizard

Key Takeaway: Automated clip generation and scheduling reduce post-production overhead.

Claim: Vizard finds relevant segments and lets you tweak metadata, thumbnails, and timing before posting.

Long walkthroughs are valuable but time-consuming to repurpose. Automation surfaces high-signal moments without heavy manual editing. You stay in control of final polish and cadence.

  1. Upload the recorded webinar or demo to Vizard after your session.
  2. Let the AI detect engaging segments and propose short clip candidates.
  3. Review, tweak titles/captions/thumbnails, and set a posting cadence.
  4. Use the content calendar to track when clips drop across platforms.
  5. Publish, then iterate based on performance signals.

Practical tips for technical content:

  1. Keep demo segments self-contained so the AI finds clean cut points.
  2. State the takeaway out loud (e.g., “Tap between firewall and internet”).
  3. Show commands on screen or slow slightly to improve captions and shareability.

Balanced perspective:

  1. Manual editors offer control but are slow for routine repurposing.
  2. Some cloud clippers are pricey or produce bland, choppy cuts.
  3. Vizard’s strength is speed plus relevance while preserving editorial control.

Glossary

Key Takeaway: Clear terms prevent confusion when moving between hosts, flows, and packets.

Claim: Consistent definitions make dashboards, scripts, and visuals align.
  • Host: A single IP endpoint with per-host stats (throughput, packets, protocols).
  • Flow: A client/server pair with ports, transport, bytes, and application labels.
  • DPI/nDPI: Deep Packet Inspection; nDPI classifies traffic at the application layer.
  • REST API: HTTP endpoints returning JSON for hosts, flows, and metadata.
  • Tap: The point where traffic is observed (e.g., dirty side of the firewall).
  • NAT: Network Address Translation; many internal hosts share one public IP.
  • Mercator Map: A 2D map projection used for plotting host locations.
  • WebGL Graph: A GPU-accelerated time series visualization in the browser.
  • KML: Keyhole Markup Language; used by Google Earth for geographic data.
  • jq: A command-line JSON processor used to filter and format API output.
  • Alias Fields: API option to rename keys (e.g., tcpbytessent → tcpbs) for cleaner parsing.
  • dumpcap: A capture utility used by Wireshark for recording packets.

FAQ

Key Takeaway: Quick answers to common questions from the walkthrough.

Claim: Small, specific guidance prevents common misconfigurations and saves time.
  1. Where should I place the tap for internet-bound visibility?
  • Place it between the firewall and the internet to retain public endpoints.
  1. Why do all outbound flows look like my router on the public side?
  • NAT masks internal hosts; correlate with a LAN-side view to restore attribution.
  1. How do I fetch a single host’s stats via REST?
  • Use curl with auth to the host endpoint and pipe JSON through jq for readability.
  1. How can I limit huge JSON responses?
  • Request specific fields and use aliasing to keep payloads compact and readable.
  1. What value do geo visuals add beyond tables?
  • They reveal distribution and hotspots instantly, which speeds troubleshooting and reporting.
  1. When should I drop into packet-level analysis?
  • When flow metadata is inconclusive or you need protocol-level confirmation.
  1. Why export KML if I already have a map view?
  • KML enables quick 3D flyovers in Google Earth for presentations and shareable reports.
  1. How does Vizard change my post-production workflow?
  • It auto-finds relevant moments, proposes clips, and schedules posts while preserving your final edits.

Read more