Based on dnstop, webtop reads either a live Ethernet stream or a pre-captured file of packets, and performs aggregations based on standard HTTP headers.
It can operate in an interactive mode, as well as produce reports for inclusion into incident reports, et cetera.
