System and method for generating a network diagram

A system for generating a network diagram, comprising:

• a first interface for receiving one or more first datasets of network data;
• a processor configured to generate a first network diagram and identify changes in a network represented by the first network diagram by overlaying one or more network diagram layers or a second network diagram on the first network diagram, wherein the one or more network diagram layers correspond to captured packets of the first datasets or captured data packets of second datasets and the second network diagram corresponds to captured packets of the second datasets, the processor is further configured to analyze the network data from the captured packets to identify nodes and/or node connections in the first network diagram, determine a health of at least one of the identified nodes, perform a vulnerability scan which identifies weaknesses in at least the network and at least one of the identified nodes in the network, and generate a representation of each identified node and/or node device connection in the first network diagram;
• and
• a second interface for graphically displaying the first network diagram by highlighting and/or animating one or more nodes and/or node connections based on at least one of the identified changes from the overlay, the health of at least one of the identified nodes, and weaknesses of the network and the at least one identified node in the network.

A method for generating a network diagram, comprising:

• receiving plural datasets of packets captured from a network;
• extracting Internet Protocol (IP) data from the captured packets;
• analyzing the network data extracted from the captured packets to identify nodes and/or node connections in the network and anomalous packets, determine a health of at least one of the identified nodes, and perform a vulnerability scan which identifies weaknesses in at least the network and at least one of the identified nodes in the network;
• enriching the IP data based on data flow between network nodes by analyzing changes in the one or more nodes and/or node connections of the network diagram;
• and
• generating a visualization of the data flow, the visualization including animated properties of one or more nodes and/or node connections based on the enriched IP data, the health of at least one of the identified nodes, and weaknesses of the network and the at least one identified node in the network.