WireTrace is a distributed sensor-server architecture designed for passive network intelligence. Sensors capture and parse traffic at the wire level using a high-performance DPI engine; the server performs classification, analytics, threat detection, and compliance evidence generation. Fully on-premises. Air-gap deployable. No cloud dependency.
Passive mirror
of network traffic
Native DPI engine
250+ protocol parsers
Structured JSON
encrypted pipeline
Classification
Threat detection
Compliance engine
Dashboard
Reports & REST API
High-performance native deep packet inspection engine optimized for real-time protocol analysis. Captures traffic from SPAN port or network TAP and parses 250+ protocols, extracting structured fields: commands, parameters, certificates, device identity, and metadata. Zero packets transmitted on the monitored network.
Centralized intelligence engine that processes parsed protocol data into actionable outcomes. Multi-signal weighted classification, behavioral baselines, vulnerability correlation, IoC matching, and compliance evidence generation. Multi-tenant architecture with role-based access control.
Primary structured store for asset inventory, connection state, classification history, security observations, threat detections, compliance evidence, and tenant configuration.
High-throughput stream transport for the sensor-to-server data pipeline. In-memory caching for high-frequency dashboard queries and API response acceleration.
S3-compatible local storage for raw parsed data, protocol captures, and generated reports. Runs entirely on-premises — no external cloud dependency.
One server, one or more sensors on the same network. All components run as containers orchestrated via a standard compose file. Self-extracting installer — fully deployed in under 10 minutes. No internet required.
Remote sensors connect to a centralized server over the network. Each sensor operates independently during connectivity interruptions and synchronizes when the link is restored. Supports segmented OT, campus, and branch office topologies.
The DPI sensor parses protocols at the application layer, extracting structured fields specific to each protocol. This is not signature matching or port-based identification — it is full payload dissection with protocol-aware field extraction.
Modbus function codes and register values, S7Comm PLC parameters, DNP3 control commands, EtherNet/IP CIP messages, IEC 104 telecontrol, OPC-UA, PROFINET, BACnet, GOOSE, and more+
DICOM imaging commands, HL7 clinical messaging, Philips Respironics, Draeger, GE CARESCAPE, Hamilton, Masimo, Abbott i-STAT, and more+ vendor-specific medical protocols
TLS certificate extraction (subject, issuer, validity, chain), DNS queries, DHCP fingerprints, LLDP/CDP switch port mapping, SSDP/mDNS device announcements, SMB, SSH, RDP, and more+
Ubuntu 22.04 LTS and 24.04 LTS. Server and sensor run as containers on any Docker-compatible host.
VMware ESXi, KVM/QEMU, Hyper-V, Proxmox. Physical or virtual deployments supported. Cloud VMs for server; bare-metal or VM for sensors.
Passive capture from SPAN port or network TAP. No inline deployment. Air-gap supported — no internet dependency for any feature.
For detailed infrastructure sizing by environment size (assets, bandwidth, retention), refer to the WireTrace Deployment & Sizing Guide.
Request a technical demonstration or proof-of-value deployment. wiretrace.io | sales@wiretrace.io