HOSPITAL: Host and network system profiler and internet traffic analyzer

The ever-increasing complexity and diversity of the Internet pose several challenges to network operators and administrators and, in general, Internet users. More specifically, because of the diversity in applications and usage patterns; the prevalence of dynamic IP addresses and applications that do not conform to standard configuration (e.g. VoIP to bypass firewalls), monitoring and securing networks and end hosts is no longer a trivial task. In this paper, we propose Host and netwOrk System Profiler and Internet Traffic AnaLysis (HOSPITAL): a tool for the summarization, characterization of traffic and the troubleshooting of potential suspicious activities. HOSPITAL provides the network operator as well as the user with knowledge about applications, communicating parties, services required/provided, etc, at different levels of granularity (e.g. individual hosts, /24 blocks, a large enterprise, etc), all presented concisely with an easy to use web interface. Moreover, HOSPITAL is a light-weight self-contained tool that incurs little overhead with configuration and customization capabilities for users and developers.