SPECTR · live capture · en0
REC
1,770 pkts · 38 alerts
{t.sub}
The product, today. Live packet capture with the AI Analyst surfacing lateral movement, custom rules, and threats — in plain English, with the packets to back it up.
Three commands. No agents. No cloud. Yours, end to end.
Reads live from tshark on macOS and Windows, or opens any PCAP/PCAPNG. Drag-and-drop supported. First-run setup checks dependencies and exits with a specific error if something's missing.
Deep-parses 30+ protocols and evaluates a rule set across IT, IoT, and OT — unauthorized writes, lateral movement, DNS tunneling, SMBv1 negotiation, cross-domain flows, and more.
Ask the analyst why is this PLC getting writes from an unknown IP? — get a specific answer referencing packet IDs, IPs, function codes, and a recommended action. Runs against Claude or a local Ollama model.
Designed for environments that never sit still. IT, IoT, OT, and Wi-Fi — parsed in a single stream. The traffic that crosses domains is usually the traffic worth watching.
{d.desc}
Crafted to cite the packet, the rule, the evidence. Every detection is inspectable. Every threshold is yours to tune.
The Network Graph reconstructs every IP conversation in your capture as a live force-directed graph. A flagged host isn't a single line in a log — it's a hub with primary connections (who it talked to directly) and secondary connections (who those hosts talked to in turn). One click on an alert tells you exactly how far the problem reaches.
Point SPECTR at a capture and ask it what's going on. The analyst reads the full session — flows, protocols, payload metadata — and returns a structured finding with the exact packet IDs, the risk, and a recommended action. No alert-list scrolling, no rule-ID decoding. Plain-English answers, packet-level evidence.
Orchestrated from behavioral truth, not statistical guesses. Every finding traces back to packets. Every model runs where you do.
{c.b}
Crafted at the intersection. Packet-level depth. Real-time clarity. Every domain. One install.
Most packet analysis tools ship your capture to their cloud. SPECTR doesn't. The default inference path is a local model — Ollama, LM Studio, or SGLang — running on the same machine.
Orchestrated across IEC 62443, NERC CIP, NIST CSF 2.0, and NIS2. Delivered on your cadence. Audit-ready, every time.
{f.d}
Net Intel adds active infrastructure discovery to SPECTR Five transports (SSH · NETCONF · Serial · RESTCONF · SNMP v2c/v3) across five vendors, the new Pattern C hybrid (SSH for configs + SNMP for state), nine standard MIBs covered with zero vendor-MIB dependencies, deterministic risk rules, agentic troubleshooting, CVE correlation, and SBOM — same air-gap, multi-tenant, license-gated posture as core SPECTR.
{c.b}
Six features compose into a complete throughput-investigation workflow — from a one-shot iperf3 test in the Tools panel, to passive SNMP utilisation on the topology map, to perfSONAR-measured edges, AI-driven historical queries, and the differentiator: automatic before/after correlation when Net Intel detects config drift.
throughput: 1000 → 750 Mbps (Δ -25%) directly onto the drift finding. No other commercial network-monitoring tool does this. Air-gap safe; default off; opt-in via four env vars.
{p.b}
query_perfsonar_throughput and answers. (B3 · historical)throughput: 1000 → 750 Mbps (Δ -25%) to the change-window finding. (B4 · automatic)Auth, RBAC, multi-tenancy, and remote capture — all optional, all backward-compatible with the single-operator default.
{i.b}
Packet Intelligence is licensed per analyst seat, per year. Network Intelligence — the active layer for the gear under your team's care — is licensed per managed node, per year, and available to any Packet Intelligence customer.
Both run in a single install. One stack. One license file.
SPECTR 0.6.0 + Net Intel 1.7.0 are in late beta. Join the early-access list and we'll reach out with pricing, a demo, and a license for your environment. We don't blast — typically one email when there's something specific to share.