Real-time network intelligence, from kernel to dashboard.
Capture raw network traffic at the kernel level with low-latency delivery, decode protocol layers defensively, and inspect live activity through an interactive web-based dashboard or high-performance terminal CLI. 100% local, lightweight, and engineered for deep network visibility.
Windows 10/11 · Requires Npcap · ~150MB Disk Space
Why Netrivo?
Network visibility is often fragmented across packet capture, traffic analysis, device discovery, and security tools. Cloud-based monitoring can also be inappropriate for networks where sensitive traffic data needs to remain local.
Netrivo brings capture, analysis, device intelligence, visualization, and threat detection into a single local-first platform.
Three languages. One real-time pipeline.
Engineered at every layer for predictable performance, safety, and visual clarity.
C++ Capture Engine
C++17 / NpcapBypasses user-space queues. Fixed-size kernel buffers are drained promptly with zero-copy operations, helping avoid drops during traffic bursts — with no garbage-collection pauses in the capture hot path.
Analysis Pipeline
Python 3.11 / FastAPIHandles parsing, aggregation, and tracking logic. Runs O(1) protocol verification, groups bidirectional network flows, calculates moving averages, and checks traffic patterns for potential port scans.
Web UI Dashboard
React 19 / ViteRenders real-time telemetry tables, protocol distributions, and device topology with minimal latency. Virtual DOM updates keep UI layout changes smooth and non-blocking under high event rates.
Everything you need to see your network clearly.
Real-time capabilities engineered to provide granular insight into network packets, devices, and threats.
Kernel-Level Traffic Interception
Bypass traditional userspace capture bottlenecks. Netrivo binds directly to kernel-space buffer queues using libpcap and Npcap. Supported Berkeley Packet Filters (BPF) filter out unwanted packets inside the kernel environment, reducing processing overhead before packets reach userspace.
- Configurable 16 MB kernel buffer to absorb bursts
- Zero-copy buffer pipeline for low overhead
- Custom interface bindings with customizable snapshot lengths
Defensive Protocol Decoding
Decapsulate packets without risking backend instability. Every packet parser validates header offsets defensively, verifying bounds for variable fields (such as IPv4 IHL and TCP Options). The engine outputs structured, immutable schemas for immediate processing.
- Ethernet II frame validation
- IPv4 header validation (version, IHL, bounds)
- TCP, UDP, and ICMP protocol handlers
Real-Time Flow Statistics
Obtain clean traffic measurements. The telemetry pipeline smooths data rates using an exponential moving average (alpha=0.3) to prevent UI display jitter. Tracks flows using a bidirectional 5-tuple table and ranks heavy-hitter flows by total volume.
- Exponential moving average rate calculations
- Bidirectional 5-tuple flow aggregation
- 100,000 active flow tracking cache capacity
Dynamic Topology Mapping
Visualize active endpoints layout-free. The dashboard plots live nodes in a force-directed graph governed by real-time particle flows. Nodes are clustered automatically based on trust-zone rules, with interactive scaling to inspect connection details.
- Adaptive node repulsion and layout clustering
- Activity-scaled edge width with flow animation
- Focus mode highlighting adjacent nodes and endpoints
Application & Device Identity
Identify endpoints passively. The system monitors TLS client hellos and DNS traffic to catalog endpoints. Determines vendor details, OS targets, device classes (such as printer, laptop, or server), and security levels without generating active probes.
- DNS & SNI service fingerprinting
- Manufacturer vendor ID mapping
- Inventory lookup tables with timestamp tracking
Real-Time Threat Center
Identify suspicious activity without active probes. Netrivo analyzes incoming traffic behaviors using rules for port scans and protocol manipulation. Warnings light up the dashboard, tracking alerts with no remote cloud reporting.
- Behavioral port scan analysis and threshold triggers
- Dynamic traffic flood metrics and detection rules
- Completely local data path for operational security
Dual Interface — Web & CLI
Deploy how you want. Inspect results inside the modern web-based UI across 8 live dashboard views, or run Netrivo within terminal-only setups using the robust command-line client for automation scripts.
- 8-page React-powered web interface
- Verbose, summary, and quiet CLI execution parameters
- Offline replay from saved binary capture files
Built for engineers who need network visibility.
Network Engineers
Monitor traffic, flows, devices, and network behavior.
Security Engineers
Investigate suspicious activity, scans, and network threats.
Developers & Researchers
Inspect and analyze network traffic locally.
IT Teams
Troubleshoot networks and understand connected devices.
See Netrivo in action.
A high-fidelity dashboard engineered to process real-time telemetry efficiently.
Visual telemetry trends and protocol breakdowns updated in real time.
Interactive force-directed node visualization clustering active hosts dynamically.
| Time | Protocol | Source | Destination | Length |
|---|---|---|---|---|
| 12:58:25.102 | TCP | 192.168.1.104 | 142.250.190.46 | 1,420 B |
| 12:58:25.105 | UDP | 192.168.1.1 | 8.8.8.8 | 78 B |
| 12:58:25.110 | ICMP | 192.168.1.12 | 192.168.1.1 | 32 B |
| 12:58:25.118 | TCP | 192.168.1.104 | 20.205.243.166 | 540 B |
Real-time packet capture grid with custom interface protocol coloring.
Anomaly detection engine flagging threat indices and scan attempts.
What makes it different.
Product-level differentiators, not just a feature list.
Local-First
Network traffic is processed locally.
Real-Time
Capture, analysis, and visualization happen continuously.
Unified
Capture, decode, analyze, identify, and detect in one workflow.
Lightweight
Designed to run locally without requiring a cloud monitoring stack.
Extensible
Modular C++ / Python / React architecture.
Deploy in minutes.
Simple desktop installation with clear requirements and guide steps.
System Requirements
| OS | Windows 10 or 11 (64-bit) |
| Privileges | Administrator permissions (for raw socket bindings) |
| Dependencies | Npcap Packet Capture Library Download Npcap |
| Disk Space | ~150 MB (Self-contained package) |
Getting Started Guide
Download Installer
Get the Netrivo setup program from our secure local mirror link.
Install Npcap Driver
Ensure Npcap is configured with WinPcap compatibility mode selected.
Elevate Privileges
Run Netrivo.exe with administrator privileges to permit interface bindings.
Start Capturing
Select an active adapter, configure custom filters, and start parsing traffic.
Where Netrivo is going.
- Real-time packet capture
- Flow analysis
- Device discovery
- Threat detection
- Dashboard and CLI
- Expanded protocol support
- Improved detection
- Performance improvements
- Broader platform support
- Advanced network analytics
Questions, answered.
Technical answers addressing architecture, privileges, and product capabilities.
Netrivo is a real-time network packet analyzer that captures raw network traffic at the kernel level, decodes protocol headers defensively, tracks communication flows, and displays insights in a live local dashboard. Unlike traditional analyzers that save logs for offline analysis, Netrivo focuses on real-time visual inspection of local interfaces.
Yes, Netrivo requires the Npcap library (on Windows systems) for kernel-level socket binding and promiscuous mode capture. You can download Npcap from the official Npcap site. If Npcap is missing, Netrivo will operate only in offline replay mode using previously saved capture files.
No. Netrivo handles all processing entirely locally. Captured data never leaves your computer, and the telemetry dashboard binds by default to 127.0.0.1. Local HTTP API requests and WebSocket streams are secured with a token-based authentication token parameter (X-Netrivo-Token).
Capturing packets requires raw socket bindings and interface promiscuous mode configurations, both of which require administrator rights on Windows. However, only the C++ capture engine requires elevated privileges; the analysis pipeline and React-based user interface layers can be run as a standard user.
The initial v1.0 release is optimized for 64-bit Windows systems (Windows 10/11) as a standalone desktop app. However, the core logic layers are designed for cross-platform compatibility, permitting simple deployment on macOS and Linux environments.
Netrivo is developed under an educational and research architecture. While designed for network inspection and training, it is structured as an independent proprietary desktop product.
Our roadmap includes introducing native IPv6 decoding support, adding TLS/HTTP/DNS payload decoding options, exporting captures into standard PCAP files, and integrating keyword search functionality across live traffic tables.
Start seeing your network in real time.
Download Netrivo v1.0 and begin inspecting your packet streams with kernel-level performance.