The time-based network traffic visualizer combines low-level, textual detail with multiple visualizations of the larger context to help users construct a security event's big picture. TNV is a visualization tool grounded in an under standing of the work practices of security analysts. We designed it to support ID analysis by giving analysts a visual display that facilitates pattern and anomaly recognition, particularly overtime. It also offers more focused views on packet-level detail in the context of the surrounding network traffic.