search

CoalfireFederal / NetFrenzy

Import a pcap file into Neo4j and view the network graph. Maintainer: @djent-
GNU Affero General Public License v3.0
17 stars 1 forks source link

Options to reduce data included in CONNECTED relationship #27

Closed Djent- closed 2 years ago

Djent- commented 2 years ago

The atomic operations for updating the data_size, etc. properties which reference the relationship on both sides of the assignment operator cause a significant slowdown and cannot be cached.

Users may find the speedup worth it for large datasets or live capture (#18) if the following properties could be disabled:

If we were also able to follow an entire TCP stream, this could also increase performance as we could then have the CONNECTED relationship include the source port rather than a separate relationship for the returning data. As more websites move to QUIC (as Google has) this may be less meaningful unless there is a similar way to follow the stream

broosa commented 2 years ago

I think following per stream would be beneficial either way. With regards to UDP streams, I think for each bidirectional port/host combo. Following that should add some performance gains.