Comparison with Existing Solutions
How does Cerberus differ from standalone network scanners, consumer network discovery apps, and enterprise endpoint detection systems?
Security tools usually focus exclusively on external network scanning or exclusively on internal host telemetry. Cerberus combines both into a single local-first architecture.
| Capability / Feature | Cerberus Sentinel | Nmap Standalone | Fing / Consumer Tools | Osquery / Falco |
|---|---|---|---|---|
| Tri-Stage Hybrid Engine (ARP + RustScan + Targeted Nmap) | ✓ Yes | ✗ No | ✗ No | ✗ No |
| Full 1-65535 Port Audit in < 15s | ✓ Yes | ✗ No | ✗ No | ✗ No |
| Kernel eBPF Telemetry (Linux processes, sockets, shell) | ✓ Yes | ✗ No | ✗ No | ✓ Yes |
| MITRE ATT&CK Threat Incident Engine | ✓ Yes | ✗ No | ✗ No | ✗ No |
| 3-Tier Identity (Handles randomized MACs & DHCP changes) | ✓ Yes | ✗ No | Partial | ✗ No |
| Deterministic Fleet Posture Score (cvss-agg-v1) | ✓ Yes | ✗ No | ✗ No | ✗ No |
| 100% Local-First / Zero Cloud Requirement | ✓ Yes | ✓ Yes | ✗ No | ✓ Yes |
| Native Cross-Platform UI (Wails v2 Desktop IPC) | ✓ Yes | ✗ No | ✓ Yes | ✗ No |
Performance Benchmarks
1. Full Port Scan Speed (1 to 65,535 TCP Ports on Subnet)
Conventional scanners take minutes or hours to test all 65,535 ports across an entire subnet because they wait for closed-port timeouts host by host. Cerberus separates port discovery from service audits to achieve dramatic speedups:
RustScan async socket batching identifies open ports in 3s; Nmap audits only those ports.
Spends hundreds of seconds waiting on timeouts for filtered and closed ports.
2. Memory Footprint Comparison
Enterprise security solutions often consume 500 MB to 2 GB of RAM per host. Cerberus is engineered in Go and eBPF to run comfortably on low-power hardware (such as a Raspberry Pi or low-spec router):
Embedded SQLite, in-memory ring buffers, zero bloated runtimes.
Zero kernel context switching overhead, sub-millisecond execution.
Frequent CPU spikes during file system scans and background telemetry uploads.
Detailed Tool Comparisons
Cerberus vs. Standalone Nmap
- The Problem with Raw Nmap: Nmap is the undisputed industry standard for raw network auditing, but it is a point-in-time CLI tool. It does not track device identity over time, does not recognize when a smartphone changes its IP or randomizes its MAC address, and does not provide an endpoint view.
- The Cerberus Advantage: Cerberus harnesses Nmap as an internal worker for Stage 3 versioning, while wrapping it in automatic scheduling, link-layer neighbor extraction, RustScan acceleration, and persistent SQLite history.
Cerberus vs. Consumer Tools (Fing, Angry IP Scanner)
- Consumer Limitations: Tools like Fing or Angry IP are simple to use, but they only perform superficial ping sweeps and top-port checks. They cannot audit custom ports used by IoT backdoors, do not assess CVE vulnerabilities, and frequently rely on closed proprietary cloud backends.
- The Cerberus Advantage: 100% open-source, local-first data storage, full 65,535-port capability, and real CVE matching using authoritative vulnerability feeds.
Cerberus vs. Enterprise EDR (Osquery, Falco, Wazuh)
- EDR Limitations: Endpoint agents provide deep visibility, but they only protect devices where you can install an agent. They have zero visibility into unauthorized smart TVs, rogue Wi-Fi extenders, or compromised unmanaged laptops on your network.
- The Cerberus Advantage: Unified visibility. Cerberus audits unmanaged hosts across the wire while enriching managed Linux servers with kernel eBPF observability.