Improving Packet Capture Trace Import in Trace Compass with a Data Transformation DSL

Overarching and holistic analyses that consider multiple data sources such as logs, traces, or network traffic are important, e.g., in scope of developing and operating network applications or in virtualized environments. The aim of integrated trace and log analysis tools such as Trace Compass is to enable such holistic analyses. While Trace Compass offers sophisticated analysis and visualisation capabilities for various data sources, we found that importing packet capture traces still had considerable limitations. In this paper, we present an DSL-based approach for improving the import of packet capturing data in Trace Compass. Our DSL-based approach allows to specify import definitions of data at run-time, which also enables users to customize the data import. Compared to the current import approach, which requires to develop multiple and change existing classes for each supported protocol, the DSL-based approach is more dynamic, versatile, and extensible. We published our implementations as Open Source Software.