This image is a screenshot of nf3d. This software uses a GANTT like approach to display IP connections as seen by Netfilter. Connections are sorted following their start date and they are drawn from back to front under the form of a cylinder. The small balls are specific packets which are put on the the connection they belong to. Here, the balls represent SYN or FIN packets.
This image displays a ssh scan attack that can be compared with regular traffic displayed at the front (right) of the image.