I'm currently diving into network mapping and thought that in order to do this stealthily why not listen to the existing network traffic; a wireshark dump usually contains a metric ton of information - you have at least info on hosts which are up and some ports where communication is obviously taking place. I would like to extract this information from a wireshark dump and get the info in some tool like zenmap or the Metasploit database (hosts/services)
I googled this with "passive network mapping" and "passive network discovery" together with "wireshark" and "zenmap" but didn't find anything. Is this not a thing or am I searching wrong?
If there's nothing I would start with a Python or Ruby script doing this, but I really thought there might be something existing already.