The TCP/UDP/IP/Ethernet protocols are commonly part of computing education, because they are in widespread use; because coverage exposes students to the layered nature of network protocols; and because knowledge of the protocols helps students to better understand related issues in security, operating system implementation, system administration, and network programming. In order to aid in the presentation of this material, we have developed the Visual TCP/UDP Animator (VTA), for depicting protocol operation using packets captured from the network.

A number of packages already exist for viewing network traffic. The primary focus of these tools is to aid in system administration. They are not well suited to the study of underlying network protocols, because they focus on traffic analysis, rather than illustrating protocol operation. The tools commonly depict statistics for all traffic passing through a network interface, rather than providing a connection-oriented view. Further, privileged (root) access is required in order to collect network statistics and view packet contents.

VTA displays packets captured from the network in any of several views that, when used individually or in combination, help to depict operation of the TCP and UDP protocols. The Packet View displays packet content; header information associated with each protocol is distinguished and constituent fields are labeled with associated values given. The Topology View displays an undirected graph in which nodes correspond to machines and edges are created by communication among machines. The Timeline View displays a space-time diagram. The Contents View depicts data exchanged along a TCP connection as a conversation with two participants. The Stream View displays all packets passed along a single TCP connection. Finally, the TCP Status View depicts the current status of a connection within a TCP state diagram.

The tool takes input either from file or from the network. Additionally, traffic captured live can be saved to file for later replay. A user can view (only) traffic traveling through her own sockets, without needing privileged access or making the traffic that travels across other sockets visible.