paper describes NetADHICTfrom the point of view of a network administrator. Specifically, we explainhow NetADHICT's interactive AJAX-based web interface can be used to understandnetwork behavior in a new, and we believe highly useful, way - one that givesinsights into the sub-protocol behavior of networks in a way that preservesuser privacy. Even though NetADHICT is still evolving, it has already provedto be a valuable tool for understanding networks. NetADHICT is made availableunder the GNU GPL license [13]; we hope that this paper will encourage othersto get involved in the evolution of NetADHICT. The rest of this paper proceeds as follows. The next section explainsrelated work in tools and methods for understanding network traffic. We thengive a detailed rationale for the use of hierarchical clustering to analyzenetworks and subsequently describe the ADHIC clustering algorithm. Theinterface and implementation of NetADHICT are described in the next sectionwhich is followed by a narrative on how one uses the tool in conjunction withother tools to allow administrators to better understand their networks. Wethen discuss limitations of NetADHICT and plans for future work beforeconcluding by describing how to obtain our tool and a summary of our work. Related Work Fundamentally, the problem of understanding network behavior is one ofdata reduction: we must transform gigabytes of network traffic into a smallnumber of concepts and details that can be understood and acted upon by humanadministrators. As there are many different ways in which we can choose tounderstand network behavior, there is correspondingly a variety of tools thatare designed to answer different questions. Network and systems administrators have a variety of mature tools toselect from for counting packets and flows. From open source solutions such asMRTG [16] and FlowScan [19] to large commercial offerings such as HP Openview[17] and IBM Tivoli [12], tools are readily available for visualizing thepacket and flow statistics records that can be exported by many routers. Suchsolutions allow an administrator to determine bandwidth consumption on a host,network, or port basis. For well-behaved applications that use standard ports,such views can be useful for identifying deployed applications; as most peer-to-peer protocols and other multimedia protocols do not use standard ports ormasquerade as HTTP (port 80) traffic, more sophisticated tools are needed toidentify the most bandwidth-hungry applications. The most common strategy for monitoring evasive applications at thenetwork layer is to combine flow reconstruction with deep packet inspectionand application-specific identification rules (signatures). Tools such asWireshark (formerly Ethereal) [3] are designed to perform such analysis oncaptured packet traces. Commercial network forensics tools [4] facilitateongoing traffic capture so that recent behavior can be queried on demand toprovide packet, flow, application, and even user-level views of traffic. Incontrast, other commercial products such as those produced by Sandvine [22]can analyze packets at wire speeds, primarily to enable per-applicationtraffic shaping. What these systems have in common is that they rely uponelaborate sets of rules in order to identify, dissect, and even changeapplication behavior. While such rules are generally crafted by hand, therehas been extensive research in identifying applications and usage patternsusing a variety of machine learning techniques [2, 14, 6]. Network administrators, however, are interested in more