I've been analyzing my network traffic lately with the use of Wireshark, and found it interesting where it all ends up.
The only downside to this is the heaps of ip addresses and meticulous work that I've had to do creating display filter macros, tracing ip addresses and their ranges (eg 1e100.net/Google 126.96.36.199-255).
The question: Out of curiosity, has anyone here used any program that automatically resolves the DNS of a site based on some form of database of who the ip connects to (parent, child in the node) and arranges that data into categories? Like 'CDNs' 'Hosting Sites' 'Private Blogs' 'Streaming' etc. Would be nice to have some form of automation in this, that way I could focus on that one dirty needle in the hay stack abyss.
Maybe something that says 'hey this IP has been blacklisted or reported x amount of times in the last year' etc. IP Geographic data with heatmaps from where the most request are coming from.
Something comprehensive, and robust. Or maybe just something interesting you've used before to analyze network traffic and would like to share.