Real-time network intelligence, from kernel to dashboard.
Capture raw network traffic at the kernel level with sub-microsecond latency, decode protocol layers defensively, and inspect live activity through an interactive web-based dashboard or high-performance terminal CLI. 100% local, lightweight, and engineered for deep network visibility.
Windows 10/11 · Requires Npcap · ~150MB Disk Space
Three languages. One real-time pipeline.
Engineered at every layer for predictable performance, safety, and visual clarity.
C++ Capture Engine
C++17 / NpcapBypasses user-space queues. Fixed-size kernel buffers are drained instantly with zero-copy operations. Ensures zero drops even during 10,000+ packets/second throughput without garbage collection latency.
Analysis Pipeline
Python 3.11 / FastAPIHandles parsing, aggregation, and tracking logic. Runs O(1) protocol verification, groups bidirectional network flows, calculates moving averages, and checks traffic patterns for potential port scans.
Web UI Dashboard
React 19 / ViteRenders real-time telemetry tables, protocol distributions, and device topology with sub-10ms latency. Virtual DOM updates keep UI layout changes smooth and non-blocking under high event rates.
Everything you need to see your network clearly.
Real-time capabilities engineered to provide granular insight into network packets, devices, and threats.
Kernel-Level Traffic Interception
Bypass traditional userspace capture bottlenecks. Netrivo binds directly to kernel-space buffer queues using libpcap and Npcap. Supported Berkeley Packet Filters (BPF) filter out unwanted packets inside the kernel environment, reducing processing overhead before packets reach userspace.
- Sustained 10,000+ pps capture capacity
- Zero-copy buffer pipeline for low overhead
- Custom interface bindings with customizable snapshot lengths
Defensive Protocol Decoding
Decapsulate packets without risking backend instability. Every packet parser validates header offsets defensively, verifying bounds for variable fields (such as IPv4 IHL and TCP Options). The engine outputs structured, immutable schemas for immediate processing.
- Ethernet II frame validation
- IPv4 structure decoders with checksum verification
- TCP, UDP, and ICMP protocol handlers
Real-Time Flow Statistics
Obtain clean traffic measurements. The telemetry pipeline filters data rates using an exponential moving average (alpha=0.3) to prevent UI display jitter. Tracks flows using a 5-tuple table, automatically classifying bandwidth anomalies and elephant connections exceeding 1MB in volume.
- Exponential moving average rate calculations
- Bidirectional 5-tuple flow aggregation
- 100,000 active flow tracking cache capacity
Dynamic Topology Mapping
Visualize active endpoints layout-free. The dashboard plots live nodes in a force-directed graph governed by real-time particle flows. Nodes are clustered automatically based on trust-zone rules, with interactive scaling to inspect connection details.
- Adaptive node repulsion and layout clustering
- Activity-scaled edge width with flow animation
- Focus mode highlighting adjacent nodes and endpoints
Application & Device Identity
Identify endpoints passively. The system monitors TLS client hellos and DNS traffic to catalog endpoints. Determines vendor details, OS targets, device classes (such as printer, laptop, or server), and security levels without generating active probes.
- DNS & SNI service fingerprinting
- Manufacturer vendor ID mapping
- Inventory lookup tables with timestamp tracking
Real-Time Threat Center
Identify suspicious activity without active probes. Netrivo analyzes incoming traffic behaviors using rules for port scans and protocol manipulation. Warnings light up the dashboard, tracking alerts with no remote cloud reporting.
- Behavioral port scan analysis and threshold triggers
- Dynamic traffic flood metrics and detection rules
- Completely local data path for operational security
Dual Interface — Web & CLI
Deploy how you want. Inspect results inside the modern web-based UI across 8 live dashboard views, or run Netrivo within terminal-only setups using the robust command-line client for automation scripts.
- 8-page React-powered web interface
- Verbose, summary, and quiet CLI execution parameters
- Offline validation using standard PCAP format records
See Netrivo in action.
A high-fidelity dashboard engineered to process real-time telemetry efficiently.
Visual telemetry trends and protocol breakdowns updated every 10ms.
Interactive force-directed node visualization clustering active hosts dynamically.
| Time | Protocol | Source | Destination | Length |
|---|---|---|---|---|
| 12:58:25.102 | TCP | 192.168.1.104 | 142.250.190.46 | 1,420 B |
| 12:58:25.105 | UDP | 192.168.1.1 | 8.8.8.8 | 78 B |
| 12:58:25.110 | ICMP | 192.168.1.12 | 192.168.1.1 | 32 B |
| 12:58:25.118 | TCP | 192.168.1.104 | 20.205.243.166 | 540 B |
Real-time packet capture grid with custom interface protocol coloring.
Anomaly detection engine flagging threat indices and scan attempts.
Built for depth and clarity.
A network analyzer structured to provide immediate operational insights locally.
Kernel-Level Performance
Harness native performance. Using Npcap and libpcap bindings written in C++17, the application drains network buffers quickly, allowing sustained capturing without frame dropping.
Real-Time Visual Intelligence
Understand patterns as they happen. Skip reading dense, static text logs; inspect active traffic structures visually via the interactive dashboard interface.
Open, Extensible Pipeline
Expand the analyzer's parser capabilities easily. Decoupling the C++ capture engine, Python parser logic, and React dashboard makes it simple to integrate custom decoders.
Deploy in minutes.
Simple desktop installation with clear requirements and guide steps.
System Requirements
| OS | Windows 10 or 11 (64-bit) |
| Privileges | Administrator permissions (for raw socket bindings) |
| Dependencies | Npcap Packet Capture Library Download Npcap |
| Disk Space | ~150 MB (Self-contained package) |
Getting Started Guide
Download Installer
Get the Netrivo setup program from our secure local mirror link.
Install Npcap Driver
Ensure Npcap is configured with WinPcap compatibility mode selected.
Elevate Privileges
Run Netrivo.exe with administrator privileges to permit interface bindings.
Start Capturing
Select an active adapter, configure custom filters, and start parsing traffic.
Questions, answered.
Technical answers addressing architecture, privileges, and product capabilities.
Netrivo is a real-time network packet analyzer that captures raw network traffic at the kernel level, decodes protocol headers defensively, tracks communication flows, and displays insights in a live local dashboard. Unlike traditional analyzers that save logs for offline analysis, Netrivo focuses on real-time visual inspection of local interfaces.
Yes, Netrivo requires the Npcap library (on Windows systems) for kernel-level socket binding and promiscuous mode capture. You can download Npcap from the official Npcap site. If Npcap is missing, Netrivo will operate only in offline replay mode using existing PCAP files.
No. Netrivo handles all processing entirely locally. Captured data never leaves your computer, and the telemetry dashboard binds by default to 127.0.0.1. Local HTTP API requests and WebSocket streams are secured with a token-based authentication token parameter (X-Netrivo-Token).
Capturing packets requires raw socket bindings and interface promiscuous mode configurations, both of which require administrator rights on Windows. However, only the C++ capture engine requires elevated privileges; the analysis pipeline and React-based user interface layers can be run as a standard user.
The initial v1.0 release is optimized for 64-bit Windows systems (Windows 10/11) as a standalone desktop app. However, the core logic layers are designed for cross-platform compatibility, permitting simple deployment on macOS and Linux environments.
Netrivo is developed under an educational and research architecture. While designed for network inspection and training, it is structured as an independent proprietary desktop product.
Our roadmap includes introducing native IPv6 decoding support, adding TLS/HTTP/DNS payload decoding options, exporting captures into standard PCAP files, and integrating keyword search functionality across live traffic tables.
Start seeing your network in real time.
Download Netrivo v1.0 and begin inspecting your packet streams with kernel-level performance.