to all otherterminal clusters in the tree. The sizes make it easy to see where traffic isdistributed within the tree from a high level, or within a subtree at a lowerlevel. The coloring of each terminal cluster represents the basic packet types ofits traffic and the traffic's labels. Basic packet types include IP, TCP, UDP,and other non-IP traffic. For each cluster, the outer ring's color shows whatpercentage of traffic for that cluster, for the specified time period,consisted of IP packets. For IP traffic, an inner ring shows what percentageof the traffic was TCP, UDP, or other IP packets. In Figure 4, TCP trafficdominated but approximately 6% of the traffic assigned to the cluster was UDPpackets and another 5% was non-IP packets (ARP in this case). Figure4: A single cluster in NetADHICT, containing a large number of traffictypes. Labels are used to name and group the semantic classes of traffic for acluster. NetADHICT provides initial labels and colors with a simple trafficclassification by EtherType, IP protocol, and IP port, but a user-definedlabel can be applied to each classification when a more precise semantic classis determined by the network administrator. The labels for each terminalcluster are represented through the pie charts within the rings. Each colorrepresents a different label and their size represents the percentage oftraffic for that cluster which belonged to the given label. Labels are created, modified, and deleted by the network administratorwithin the NetADHICT interface. By clicking on the "Edit labels" link in thetop right corner, the label editing interface (Figure 5) is displayed. Fromhere the system administrator can create new labels, remove old ones, orchange the names and colors of existing labels.Figure 5: Editing the list of user-defined labels. Detailed information for any node in the tree, internal nodes and terminalclusters alike, can be displayed by hovering the mouse over the node (Figure5). The details include the precise volumes of traffic which the node and allnodes below it represent. They also show what traffic classification or labeleach color in the node's pie chart represents, what percentage of the node'straffic fell into each label, and let you change the labels for the node'straffic. For more detailed analysis, the traffic represented by any cluster can beexported by NetADHICT into packet dump files. These dumps can then be analyzedusing standard network analysis tools such as Wireshark. Any number ofclusters can be selected for a packet capture by shift-clicking on them. Whileselected for capturing, all packets that match the clusters will be capturedto pcap files; these files can be downloaded at any timeduring the capture. The NetADHICT backend packet analyzer and frontend web interface bothrequire access to a MySQL database. The frontend is a Ruby on Railsapplication and so requires a web server configured with support for suchapplications. A web browser is used to view the NetADHICT interface. NetADHICT's trees are rendered using standard SVG and JavaScript; however,because many current browsers have poor support for JavaScript-generated SVG,the quality of NetADHICT's interface varies greatly depending upon the webbrowser used. In fact, at the time of this writing the Firefox 3 alpha release(also known as Gran