NetScope captures, decodes, and visualises network traffic across your entire fleet — from a single laptop to hundreds of production servers.
curl -sSL https://netscope.ie/hub-quickstart.sh | sh
| Time | Proto | Source | Destination |
|---|---|---|---|
| 20:09:56.421 | DNS | 172.20.10.8:53201 | 8.8.8.8:53 |
| 20:09:56.198 | TLS | 172.20.10.8:52901 | 142.250.80.46:443 |
| 20:09:55.991 | HTTP | 172.20.10.8:51204 | 192.168.1.1:80 |
| 20:09:55.855 | ICMP | 172.20.10.8 | 1.1.1.1 |
| 20:09:55.612 | DNS | 172.20.10.8:53198 | 1.1.1.1:53 |
| 20:09:55.301 | TLS | 172.20.10.8:52899 | 35.186.224.47:443 |
No Kubernetes. No YAML files to write. One command starts the full stack.
One curl command starts ClickHouse, Kafka, the API, and the dashboard in Docker. A random API key is generated automatically.
curl -sSL https://netscope.ie/hub-quickstart.sh | sh
Create an enrollment token in the dashboard. Run the generated install command on any target machine — Linux, macOS, or Windows.
curl -sSL "https://hub/install?token=…" | INTERFACE=eth0 sh
Flows appear within seconds. Search by IP, protocol, or process name. Set alert rules, write Sigma detections, and export to SIEM.
Dashboard at http://localhost — open in browser
Every component works standalone. Together they give you complete, fleet-wide observability.
A native visual explorer for macOS and Windows. Browse live traffic, filter by protocol, view connection graphs, and export captures — no terminal required. Built with Tauri and React.
A lightweight sensor written in Rust. Runs in pcap mode on any platform, or eBPF mode on Linux for process attribution and TLS plaintext capture. Sends flow telemetry to the hub with zero local storage.
A self-hosted dashboard that aggregates flows from your entire fleet. Search across agents, configure alerts, write Sigma detection rules, and manage API tokens — all from one place.
From raw packets to actionable security intelligence.
Sub-millisecond latency from packet to dashboard. pcap on all platforms, eBPF on Linux for kernel-level visibility without copying to userspace.
HTTP hostnames, DNS query names, TLS cipher suites, gRPC method names, ICMP types. See the conversation, not just the IP header.
eBPF mode maps every connection to the process, PID, binary path, and user that owns it. Know which application is phoning home.
Automatic geolocation enriches every flow. AbuseIPDB lookups flag known malicious IPs inline — before they escalate to an incident.
Write detections in standard Sigma format. Get real-time alerts on lateral movement, suspicious DNS, beaconing patterns, and known-bad IPs.
Enroll agents with a single command, monitor heartbeats, push config remotely, and manage API tokens — all from the hub dashboard.
Use the agent directly from the terminal during incident response, or let the hub aggregate everything automatically.
Point the agent at any network interface. Works with physical NICs, virtual bridges, and container network namespaces.
All flows land in ClickHouse. Run ad-hoc SQL queries, export CSVs, or hook up Grafana for long-term trending.
Hostname resolution, geolocation, ASN lookups, and threat intel happen server-side — the agent stays lean.
Every plan includes the desktop app, capture agent, and self-hosted hub. No vendor lock-in, ever.
Deploy the hub in two minutes. No credit card, no sign-up, no telemetry.