Documentation

What is NetScope?

NetScope is a full-stack network observability platform built for security and operations teams. It consists of three products that work independently or together: a native Desktop App for live packet capture, a headless Capture Agent for server and cloud deployments, and a SaaS Hub that aggregates flows from any number of agents into a searchable, alerting-capable analytics platform.

The entire pipeline — from raw packets to searchable flows — is designed for high throughput with minimal overhead. The capture core is written in Rust; the Hub backend uses Go with ClickHouse for storage, giving you sub-second query times even on hundreds of millions of flows.

NetScope Desktop

A native macOS and Windows application that turns your laptop or workstation into a real-time packet analyser. No tcpdump, no Wireshark filters — just open the app, pick an interface, and see enriched, decoded flows in milliseconds.

Installation

NetScope Desktop ships as a signed .dmg (macOS) and .exe installer (Windows). Download from the download page and run the installer — no additional runtime dependencies required.

Live Capture

Select any available network interface (en0, Wi-Fi, Ethernet, VPN tunnel) from the interface picker at the top of the window. Capture starts immediately. You can switch interfaces without restarting the application.

The flow table refreshes in real time. Each row represents a completed or active TCP/UDP flow with protocol, source/dest IPs and ports, packet/byte counts, duration, and any decoded application data. Scroll back through the session history — flows are retained in memory until the session is cleared or the app restarts.

Protocol Support

NetScope decodes the following application-layer protocols with full field extraction:

Threat Intelligence

Every external IP is checked against bundled threat intelligence feeds on first observation. Matching IPs receive a coloured badge in the flow table:

Feeds are embedded in the application binary and updated with each release. When Hub Connect Mode is active, the Hub's live threat feed is used instead, giving you real-time intelligence updates without waiting for a new app version.

UI Panes

The Desktop UI uses a three-pane layout. Each pane is resizable and can be collapsed to focus on what matters.

Hub Connect Mode

Enable Hub Connect Mode in Settings → Hub Connection. Enter your Hub URL and an API token generated in Hub Settings → Tokens. Once connected, all flows captured on this machine are streamed to the Hub in real time.

# Settings → Hub Connection
Hub URL     :  https://your-hub.example.com
API Token   :  nst_xxxxxxxxxxxxxxxxxxxx
Auto-start  :  ✓ (reconnect on app launch)
Label       :  Alice-MacBook  # appears in Hub Fleet view

The connection is a persistent WebSocket over TLS. If the Hub is temporarily unreachable, the Desktop buffers up to 50,000 flows in memory and replays them on reconnect.

NetScope Capture Agent

A lightweight, headless capture daemon designed for servers, cloud VMs, Kubernetes nodes, and network appliances. Deploy it once and it reports flows to the Hub continuously — no GUI, no manual intervention, zero local storage.

Installation

The quickest path is the Hub-hosted install script. Navigate to Hub → Fleet → Add Agent and copy the generated command:

# Generated by Hub — includes your token automatically
curl -sSL "https://your-hub.example.com/api/v1/agents/install?token=nst_xxx" | sudo bash

This script detects your OS and architecture, downloads the correct binary, installs it to /usr/local/bin/netscope-agent, writes a systemd unit (Linux) or launchd plist (macOS), and starts the service automatically.

Capture Modes

pcap mode (default)

Uses libpcap to capture packets from network interfaces. Works on all platforms. Suitable for moderate traffic volumes. Root or CAP_NET_RAW capability required.

netscope-agent \
  --hub       https://hub.example.com \
  --token     nst_xxxxxxxxxxxxxxxx \
  --iface     eth0 \
  --mode      pcap \
  --filter    "not port 22"  # exclude SSH

eBPF mode (Linux 5.8+)

Attaches an XDP / TC eBPF program directly in the kernel's network stack. Dramatically lower CPU usage at high packet rates. No buffer drops under sustained 10 Gbps. Requires Linux kernel 5.8+ and root.

netscope-agent \
  --hub   https://hub.example.com \
  --token nst_xxxxxxxxxxxxxxxx \
  --iface eth0 \
  --mode  ebpf

Enrollment & Tokens

Each agent authenticates to the Hub using a unique enrollment token. Tokens are generated in the Hub under Fleet → Add Agent or via the API. Tokens can be revoked at any time from the Fleet page without restarting the agent — it will receive a 401 and stop forwarding flows.

Configuration

The agent can be configured via command-line flags, environment variables, or a YAML config file at /etc/netscope/agent.yaml.

hub:     https://hub.example.com
token:   nst_xxxxxxxxxxxxxxxx
mode:    ebpf         # pcap | ebpf
ifaces:
  - eth0
  - eth1
filter:  "not port 22"
labels:
  env:    production
  region: us-east-1
  role:   web
batch_size:   500    # flows per HTTP push
flush_interval: 2s    # max wait before push
log_level:    info   # debug | info | warn | error

Remote Config Push

From Hub → Fleet → [Agent] → Configure, you can remotely update the filter expression, interface list, or labels without restarting the agent. Configuration changes are pushed over the existing WebSocket connection and applied within seconds.

NetScope Hub

The Hub is the central brain of a NetScope deployment. It receives flows from any number of agents and Desktop instances, stores them in ClickHouse, and exposes a rich web UI and REST API for search, alerting, anomaly detection, compliance, and more.

Deployment

The Hub is distributed as a single Go binary plus a ClickHouse database. The quickstart script handles both:

curl -sSL https://netscope.io/hub-quickstart.sh | sudo bash
# → installs ClickHouse, downloads hub binary, creates systemd service
# → hub available at http://localhost:8080 within ~60 seconds

Environment Variables

CH_ADDR=localhost:9000
CH_DB=netscope
APP_URL=https://hub.example.com
FRONTEND_URL=https://hub.example.com
SESSION_SECRET=change-me-64-random-chars
LICENSE_KEY=ENT-xxxx-xxxx-xxxx    # omit for Community tier
ANTHROPIC_API_KEY=sk-ant-…  # required for AI Copilot
PRODUCTION=true               # sets Secure cookies

Flows & Analytics

All flows from all agents land in the Hub's flows ClickHouse table. The Flows page provides a real-time view with powerful search and filter controls.

Searching Flows

Services View

The Services page automatically groups flows by (src_service, dst_service, protocol) and shows a dependency graph. Useful for discovering undocumented service relationships or lateral movement patterns.

Cloud VPC Ingestion

Import VPC Flow Logs from AWS (S3 or CloudWatch Logs), GCP (Cloud Logging), or Azure (Network Watcher) under Cloud Flows. The Hub normalises all formats into the same flow schema for unified analysis.

Security Features

Alerting

Create alert rules under Alerts → Rules. Each rule specifies a condition (e.g. any flow to a HIGH-threat IP in the last 5 minutes), a severity, and one or more notification channels.

Sigma Detection Rules

NetScope Hub implements a Sigma-compatible rule engine (Detection page). Import standard Sigma YAML rules or write custom ones. Rules are evaluated continuously against the incoming flow stream, with matches creating incidents automatically.

title:       Suspicious DNS Tunnelling
id:         netscope-dns-tunnel-001
status:     stable
level:      high
detection:
  selection:
    protocol: DNS
    query_len|gte: 60
    bytes_out|gte: 4096
  condition: selection
falsepositives:
  - AAAA record lookups for long CDN hostnames

Anomaly Detection

The anomaly engine builds a statistical baseline for each (src_ip, dst_ip, protocol) tuple over a rolling 7-day window. Deviations from the baseline — in bytes, flow count, or inter-arrival time — generate anomaly events visible on the Anomalies page. Each anomaly has a severity score and a natural-language description generated by the AI Copilot.

Threats

The Threats page aggregates all flows touching IPs from the threat intelligence feeds, grouped by threat actor and severity. Drill down into any threat entry to see the full timeline of connections, source agents, and associated alert history.

Incidents

Incidents are auto-created from high-severity alert or Sigma rule matches. Each incident gets a unique ID, a severity (P1–P4), and a status (open / in-progress / resolved). Assign incidents to team members, add investigation notes, and close with a resolution summary. Full audit trail is maintained.

Certificates

The Certs page shows every TLS certificate seen in flows, with expiry date, issuer, SANs, and the set of hosts that presented it. Expired or soon-to-expire certificates are highlighted. Certificate changes (e.g. unexpected issuer rotation) can trigger alerts.

Policies

Define network policies — permitted and denied communication paths — under the Policies page. NetScope automatically flags policy violations as they occur in the flow stream.

AI Copilot

The AI Copilot is a natural-language interface to your flow data, powered by Anthropic's Claude. Click AI Copilot in the sidebar to open the chat panel.

The Copilot enforces a row-limit cap on all generated SQL (default 1,000 rows) to prevent accidental full-table scans. Administrators can raise this limit per-user from Settings.

Custom Dashboards

Build any view you need from the My Dashboards page. Each dashboard is a collection of widgets arranged on a 12-column grid.

Available Widgets

Widget Sizes

Each widget can be resized independently to Small (⅓ width), Medium (½ width), or Full Width using the resize controls that appear on hover in edit mode. Use the arrow buttons to reorder widgets within the grid.

Enterprise Features

The following features require an Enterprise license (LICENSE_KEY environment variable):

API Reference

The Hub exposes a REST API at /api/v1/. All endpoints require a bearer token via the Authorization header.

curl -H "Authorization: Bearer nst_xxx" \
     https://hub.example.com/api/v1/flows?limit=50&protocol=TLS