Skip to main content

All features

Capture​

  • Supported capture:
    • ISO 2 layer : Ethernet, Linux SLL, VXLan.
    • ISO 3 : IPv4.
    • ISO 4 : TCP, UDP.
    • ISO 5 - 7 : TLS, HTTP/1.x, HTTP/2, gRPC, PostgreSQL, Redis, Kafka.
  • Distributed capture of remote hosts.
  • Agents remote configuration from the UI.
  • Agents deployment from the UI
  • ‘Applicative cluster’ mode: capture of many probes on the same system are merged in a single view.
  • Automatic discovery and tracking of hosts DNS names.
  • Packet filtering: PCAP standard filters + regular expressions on hosts FQDN.
  • Circuit breakers in place to limit capture impact on spikes.
  • Continuous monitoring of agents.
  • PCAP and PCAP-NG standard files may be injected directly on the web interface.
  • Limit capture size for big communications download.
  • Use Throughput Limiter to limit data usage or allow partial capture of huge systems
  • Deduplicate packets and communication when capturing both side of the communication.
  • Capture only data packets to lower CPU and network usage
  • Understand and manage duplicated packets arriving late
  • Capture of TLS keys via eBPF — extract secrets from OpenSSL memory and from Go executables using the standard library crypto/tls (goTLS) — to decipher TLS ciphered TCP sessions.
  • On Kubernetes: Continuous capture of the cluster network usage to enable a comprehensive network discovery

Decoding​

  • Real time decoding of communications.
  • Rebuilding of TCP flows.
  • Real time deciphering of TLS encrypted TCP sessions.
  • On the fly payload content rebuilding content and decompressing.
  • High level protocols analysis.
    • HTTP/1.x and HTTP/2, gRPC, PostgreSQL, Redis, and Kafka for now.
    • HTTP/2 needs no configuration and no separate port. The framing is decided per connection from the decrypted bytes, not from the port - TLS 1.3 hides the ALPN negotiation inside EncryptedExtensions, so a port cannot tell you what it carries. One port serving HTTP/1.1 and HTTP/2 at the same time is parsed correctly on both. HPACK header compression, request/response trailers and stream multiplexing are all decoded.
    • Modular architecture to quickly add new protocols (1-2 weeks).
  • Binary payload transcoding - decode Protobuf and MessagePack HTTP bodies, Redis values, gRPC messages and Kafka records to searchable JSON by binding uploaded schemas. Tags and templates then extract from the JSON form of binary payloads.
  • Whisperer config Playground to test Tags and Templates rules against the actual parsing engine before applying them.
  • Clients identification and customizable tagging for specific filtering.
  • Filtering and removal of sensitive data by defining rules in configuration.

Analysis and reporting​

User management​

System management​

Setup​

Integration​

  • Open API with complete OpenAPI v3 documentation for integration and extensions.
  • Service Accounts with OAuth2 authentication, specifically designed for third parties integration with the API.
  • Command-line interface (spider): standalone binary to query captured traffic and management resources from scripts and terminals.
  • AI-agent plugins for Claude Code — agent-driven traffic analysis and self-monitoring from natural-language prompts.
  • Documented plugin mechanism to extend Spider feature and allow business integration with the systems under analysis.
  • Central Plugin Store to install and share plugins
  • Existing plugins (samples):
    • PostgreSQL plugins:
      • Tags enrichment.
    • HTTP plugins:
      • HTTP headers decoding: certificates, security token, cookies…
      • Tags enrichment.
      • Client identification enrichment.
    • TCP plugins:
      • MQTT decoding.
      • HTTP decoding.
      • Redis protocol decoding.

Security​

High Availability and Performance​

  • Low agent footprint thanks to Go: < 50MB of RAM, low CPU usage, highly scalable.
  • Go + Protobuf + gRPC parsing pipeline: the hot data-path services are written in Go, exchange Protobuf over gRPC, and consume far less CPU and memory than the previous Node.js + JSON + REST stack (e.g. the read service: ~10x lower memory, ~10x faster startup).
  • Merged poller: several data-type pollings run inside a single process instead of one pod per data type — same independent polling, a fraction of the CPU and memory.
  • Stateless REST microservices.
  • High availability by Kubernetes clustering.
  • Resilient architecture with automatic remediation of most errors.
  • Optimised resources usage on Kubernetes.
  • Optimised Docker images.
  • Tuning options on the setup + comprehensive documentation.
  • Auto-scaling solution, battle tested at more than:
    • 2 GB of packets parsed /min
    • 200 000 HTTP communications/min for days
    • Capturing and analysing 2 TB of data per day.

Learning​

Support​

License​