I'm investigating options for segmenting a less secure business unit behind a Cisco 5505. I want to take this action quietly and transparently for political reasons.
I want to know if it is possible to feed traffic analysis into some kind of engine to parse out a whitelist of applications and ports. E.G. load a few day's worth of pcapng files and get back a list of "IP.src, IP.dst, Port, Application name". Are there any tools for that kind of profiling?