Force Directed Graph#
The force directed graph (fdg) module is used to generate a directed graph using node pairs and optional grouping. The fdg module accepts source and destination groups as well as a weight value for the resulting edge.
-b: Indicates that edges are bidirectional, meaning that the pair [A, B] is equivalent to [B, A]
-v <enumerated value>: Indicates that edges should be weighted as a sum of the provided enumerated value. The
-vflag is useful in generating directed graphs where edges have weights represented by something other than a raw count.
-sg <enumerated value>: Provides a group to apply to a source value which is used for coloring a graph. For example a source group may be a subnet for an IP which enables a nodes in a graph to be grouped.
-dg <enumerated value>: Same as -sg, but grouping based on destination parameter.
One example where a force directed graph can prove useful is to identify relationships between addresses on a network. Generating a weighted force directed graph of IPV4 traffic while grouping nodes into a class C network can be accomplished with the query:
tag=pcap packet ipv4.SrcIP ipv4.DstIP ipv4.Length | sum Length by SrcIP DstIP | subnet SrcIP /24 as SrcSub | subnet DstIP /24 as DstSub | fdg -v sum -sg SrcSub -dg DstSub SrcIP DstIP
Hovering the mouse over a node shows its label and the labels of its neighbors:
The options menu can enable or disable animation and change between the standard force-directed graph and a circular graph as shown below: