Network Sentinel & Linux Endpoint Observability
Cerberus pairs lightning-fast tri-stage network sweeps (ARP + RustScan + Nmap) with Linux kernel eBPF telemetry and deterministic MITRE ATT&CK threat rules in a 100% local-first architecture.
Stage 2: High-Speed Port Sweep
RustScan tests all 65,535 TCP ports simultaneously using asynchronous socket multiplexing. Eliminates wasted timeouts on closed ports.
[RustScan] Sweeping 65,535 TCP ports across 18 target hosts
[RustScan] Adaptive batch: 4,096 sockets/sec | RTT: 1.2ms
[Discovered] 192.168.1.42 -> Open ports: [22, 80, 443, 8080, 5353]
[Discovered] 192.168.1.99 -> Open ports: [80, 554, 8000] (RTSP Camera)
[Status] Stage 2 complete in 3,420ms (Found 14 open services)Performance by the Numbers
How Cerberus delivers enterprise-grade intelligence while staying light on hardware and network bandwidth.
RustScan socket multiplexing + Nmap targeted -sV. 60x speedup over vanilla Nmap.
Sharded dispatcher matches MITRE ATT&CK rules concurrently in memory.
Pure Go daemon with embedded SQLite in WAL mode. Zero external database required.
Serialized scanGate prevents Wi-Fi packet drops, router freezes, or stream stutters.
Engineered for Complete Situational Awareness
Everything required to audit, track, and protect private networks in one cohesive platform.
Tri-Stage Hybrid Engine
Chains Layer-2 ARP sweeps, RustScan full-port sweeping, and targeted Nmap CVE analysis. Never scans closed ports twice.
3-Tier Identity Matcher
Survives iOS/Android randomized MAC addresses and DHCP lease renewals. Uses cryptographic keys, LAA bit checking, and port synergy.
Kernel eBPF Telemetry
Lightweight Linux probe catches reverse shells, webshell activity, memory injection, and privilege escalation with sub-5ms lag.
Fleet Posture (cvss-agg-v1)
Deterministic 0.0 to 100.0 health score. Automatically weighs CVSS base scores, 1.2x exploit bonuses, and active incident penalties.
100% Local-First Storage
All device records, timelines, and events reside in an embedded SQLite database in WAL mode. Zero tracking or cloud dependency.
Native Cross-Platform Desktop
Wails v2 native application for macOS (Touch ID / SMJobBless), Windows (UAC / Npcap), and Linux (Capabilities).
Get Started with Cerberus
Explore the full architectural specification, learn how the 3-tier matcher works, and start auditing your local network in minutes.