diff --git a/README.md b/README.md
index c175a3f3..a1aef808 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
-![banner](banner.jpg)
+![banner](figures/banner.jpg)
# A Network Traffic Feature Extraction Tool
-##
Overview
+##
Overview
This tool is engineered for robust and efficient feature extraction, particularly for applications such as network intrusion detection systems, among others. Leveraging Rust language and eBPF, it excels in processing high volumes of network traffic with remarkable speed and throughput. (When your traffic is already captured, don't worry! It also has a build in pcap reader which is also amazingly fast.) With various pre-defined feature sets and the ability to create custom feature sets, RustiFlow offers a versatile solution for network security applications.
@@ -11,9 +11,9 @@ This tool is engineered for robust and efficient feature extraction, particularl
![Ubuntu 24](https://img.shields.io/badge/Tested%20on%20ubuntu-purple?logo=ubuntu)
-![Animated image showing network flows](flows.gif)
+![Animated image showing network flows](figures/flows.gif)
-##
Key Features
+##
Key Features
- **High Throughput:** Utilizes Rust and the [Aya](https://aya-rs.dev/) library for eBPF program compilation and execution, ensuring exceptional performance and resource efficiency.
- **Versatile Feature Sets:** Offers a variety of pre-defined feature sets (flows) and the flexibility to create custom feature sets tailored to specific requirements.
@@ -24,11 +24,15 @@ This tool is engineered for robust and efficient feature extraction, particularl
See the [wiki](https://github.com/idlab-discover/RustiFlow/wiki) for the different feature sets available.
-##
Architecture
+##
Architecture
-![RustiFlow Architecture](RustiFlow.svg)
+### Realtime processing
+![RustiFlow Architecture Realtime](figures/realtime.png)
-##
Using the release binary:
+### Offline PCAP processing
+![RustiFlow Architecture Offline](figures/offline.png)
+
+##
Using the release binary:
Copy the rustiflow binary that you can find in this repo in releases to a location of your choice or to the `/usr/local/bin` folder.
If it does not have the right permissions, you can run the following command:
@@ -45,7 +49,7 @@ You can then run the binary with the following commands displayed on the [help m
If you want a more graphical interface, you can use the tui interface by just running `rustiflow` without any arguments. This will open the following interface:
-![The tui interface](tui_rustiflow.GIF)
+![The tui interface](figures/tui_rustiflow.GIF)
> **NOTE:** When using the save button, the current selection will be saved to the `rustiflow.toml` file. You can reuse this file with following command:
```bash
@@ -90,7 +94,7 @@ header = true
drop_contaminant_features = false
```
-##
Using the Container:
+##
Using the Container:
Make sure that you don't use docker desktop and that you don't have it installed on your machine. If you have this setup, it will not work as intended as the `--network host` will not link the container to the host network, but to the network of a VM that docker desktop uses.
@@ -111,7 +115,7 @@ Make sure that you don't use docker desktop and that you don't have it installed
docker run --privileged --network host -v /home/matisse/Documents:/app rustiflow realtime enp5s0 cic-flow 60 csv /app/output.csv
```
-##
Installation Guide for development
+##
Installation Guide for development
### Prerequisites:
- **libpcap-dev**:
@@ -144,7 +148,7 @@ Make sure that you don't use docker desktop and that you don't have it installed
export PATH=/usr/lib/linux-tools/5.8.0-63-generic:$PATH
```
-##
Building the Project
+##
Building the Project
- **eBPF Programs**:
```bash
@@ -162,7 +166,7 @@ Make sure that you don't use docker desktop and that you don't have it installed
cargo xtask run -- [OPTIONS]
```
-##
Usage Instructions
+##
Usage Instructions
### Command Help:
```bash
diff --git a/RustiFlow.svg b/figures/RustiFlow.svg
similarity index 100%
rename from RustiFlow.svg
rename to figures/RustiFlow.svg
diff --git a/RustiFlow_nobg.png b/figures/RustiFlow_nobg.png
similarity index 100%
rename from RustiFlow_nobg.png
rename to figures/RustiFlow_nobg.png
diff --git a/banner.jpg b/figures/banner.jpg
similarity index 100%
rename from banner.jpg
rename to figures/banner.jpg
diff --git a/flows.gif b/figures/flows.gif
similarity index 100%
rename from flows.gif
rename to figures/flows.gif
diff --git a/figures/offline.png b/figures/offline.png
new file mode 100644
index 00000000..43116473
Binary files /dev/null and b/figures/offline.png differ
diff --git a/figures/realtime.png b/figures/realtime.png
new file mode 100644
index 00000000..dfb0d10b
Binary files /dev/null and b/figures/realtime.png differ
diff --git a/tui_rustiflow.GIF b/figures/tui_rustiflow.GIF
similarity index 100%
rename from tui_rustiflow.GIF
rename to figures/tui_rustiflow.GIF