Package: navv
NAVVTheNAVV(NetworkArchitectureVerification andValidation) tool creates a spreadsheet for network traffic analysis from PCAP data and Zeek logs, automating Zeek analysis of PCAP files and the collation of Zeek logs to create a summary or network traffic in an XLSX-formatted spreadsheet. After manually updating the spreadsheet with names and color codes for network segments (by CIDR-formatted address groups) and hosts (by IP address), running the tool again will integrate these labels and color coding into the spreadsheet to aid in conducting an evaluation of the network traffic.RequirementsInstallationDevelopmentProductionUsageCLIBrowserAnalysisDockerCopyrightContactRequirementsThis project only works on Linux or MacOS environmentsZeek must be installed:Get ZeekPython version 3.10 or laterAs installation of Python varies from platform to platform, please refer to thePython.org Wikito install and configure Python on your system.InstallationDevelopmentIf you intend to develop the NAVV tool:Verify you have the Zeek tool installedInstall ZeekClone this repositorygit clone https://github.com/cisagov/network-architecture-verification-and-validation.gitSetup your local virtual environmentpython3 -m venv .venvActivate your local environmentsource .venv/bin/activateInstall the project and its dependencies to your local virtual environmentpip install -e .ProductionIf you would like to use the NAVV tool, its recommended you install it from PYPIVerify you have the Zeek tool installedInstall ZeekInstall the project usingpipThe recommended method for installing packages withpipis usingUser Installswhich installs to a user-specific location rather than system-wide.install the latest version of NAVVpip install -U navvor install a specific version of NAVVexample:pip install -U navv==3.0.1Verify the NAVV tool has been installed by runningnavvin your console:NAVV:NetworkArchitectureVerificationandValidation3.2.2
Usage:navv[OPTIONS]COMMAND[ARGS]...NetworkArchitectureVerificationandValidation.

Options:--versionShowtheversionandexit.-h,--helpShowthismessageandexit.

Commands:generateGenerateexcelsheet.launchLaunchtheNAVVGUI.UsageCLITo run the NAVV tool in the CLI (Command Line Interface), Run the command:navv generateBelow are the available options and commands fornavv generate:Usage:navvgenerate[OPTIONS]CUSTOMER_NAMEGenerateexcelsheet.

Options:-o,--output-dirTEXTDirectorytoplaceresultantanalysisfilesin.Defaultstocurrentworkingdirectory.-p,--pcapTEXTPathtopcapfile.NAVVrequireszeeklogsorpcap.Ifused,zeekwillrunonpcaptocreatenewlogs.-z,--zeek-logsTEXTPathtostoreorcontainzeeklogfiles.Defaultstocurrentworkingdirectory.-h,--helpShowthismessageandexit.BrowserTo launch the NAVV tool in the browser, simply run:navv launchThis will automatically launch the tool into your default browser.The user will have two options:Generate a New Analysis:Simply upload your PCAP file or a zipped file of your Zeek logsClick Run AnalysisAn excel sheet will be generated and downloaded via your browserUpload an Existing AnalysisModify your generated excel spreadsheet, SeeAnalysisUpload your spreadsheet and your zipped Zeek logs fileAnalysisIdentifying network segments and hostsAdding information about network segments and/or inventory can assist in packet capture analysis. Open the NAVV-generated.xlsxfile and navigate to theSegmentstab. Enter the relevant network segments and choose background colors for the corresponding cells. For example:Save your changes and re-run the NAVV tool with the-zoption on the directory containing the Zeek log files and.xlsxfile. The tool will modify the contents of the spreadsheet, recoloring the contents of theAnalysistab to match the segments specified in theSegmentstab. This simplifies the task of identifying cross-segment traffic.When available, the NAVV tool will use responses for queries found in Zeek'sdns.logfile to populate theSrc_DescandDest_Descfields in theAnalysistab. When DNS information is not available, it is possible to provide this information manually in theInventorytab. Note that color formatting from theInventorytab is appliedafterthat from theSegmentstab. Again, saving changes to the spreadsheet file and re-running the NAVV tool with the-zoption will update the spreadsheet with the new inventory information and color formatting.DockerSeedocker/README.mdfor setup and instructions for running the NAVV tool in Docker.CopyrightNAVVis Copyright 2023 Battelle Energy Alliance, LLC, licensed under the BSD-3 Clause License.SeeLICENSEfor the terms of its release.Developers, by contributing to this software project, you are agreeing to the following terms and conditions for your contributions:You agree your contributions are submitted under the BSD 3-Clause license.You represent you are authorized to make the contributions and grant the license. If your employer has rights to intellectual property that includes your contributions, you represent that you have received permission to make contributions and grant the required license on behalf of that employer.Other softwareIdaho National Laboratory is a cutting edge research facility which is constantly producing high quality research and software. Feel free to take a look at our other software and scientific offerings at:Primary Technology Offerings PageSupported Open Source SoftwareRaw Experiment Open Source SoftwareUnsupported Open Source SoftwareContactContact information of maintainer(s):Seth GroverDonovan Nichols