Configuration says what should happen. The wire says what did.
A high-performance Rust sensor that passively parses TLS, SSH, IKE/IPsec, DTLS and QUIC handshakes and reports the cryptography your systems actually negotiated — cipher suites, key-exchange groups, certificates and keys — as evidence CADP turns into an inventory.
Deploys on a span port, a tap or the host itself. Reports facts, never verdicts — so policy can change without touching a single node.
A config scan tells you what was intended.
Every estate has the gap between the policy written in a config file and the handshake that actually completed. Post-quantum migration lives in that gap, and only traffic closes it.
Offered is not negotiated
A client can offer ML-KEM and still settle on classical X25519 because the server never supported it. The config shows the intent; only the handshake shows the downgrade.
Crypto on unexpected ports
TLS on 8443, SSH on 2222, an IKE tunnel nobody documented. Port-based scanning finds the estate you drew; content-based detection finds the estate you have.
Certificates hidden by design
TLS 1.3, QUIC and DTLS encrypt the server certificate inside the handshake. Passive capture alone cannot see it, so the inventory silently loses its certificate spine.
New algorithms, old sensors
Codepoints for post-quantum algorithms keep arriving. A sensor that only recognises what it was compiled to know reports them as blanks.
What you configured ≠ what you negotiated
The sensor records both, and the difference between them is usually the finding.
Raw facts, no verdicts.
The sensor reports exactly what it observed and nothing more. Risk scoring, post-quantum posture and CBOM assembly happen centrally in CADP, so classification policy can change without redeploying a single node.
Capture
Traffic arrives from a span port, a tap or the local interface. No inline placement, no termination, no decryption.
Detect
Content-based protocol detection identifies TLS, SSH, IKE and the rest on any port, after flow tracking and stream reassembly.
Parse
Handshakes are decomposed into cipher suites, named groups, signature algorithms, X.509 details and SSH host keys.
Report
CycloneDX-aligned events stream to CADP over authenticated HTTPS, or to Kafka, a JSONL file or stdout.
What it recovers.
Depth matters more than breadth here. Half a handshake produces an asset nobody can act on.
Post-quantum awareness
ML-KEM, Kyber, hybrids
Recognises hybrid and ML-KEM key exchange, distinguishes offered from negotiated, and passes unknown codepoints through verbatim — so algorithms standardised after the sensor shipped still appear in the inventory rather than vanishing.
Active certificate recovery
Opt-in, rate-limited, CIDR-scoped
TLS 1.3, QUIC and DTLS hide the server certificate inside the encrypted handshake. A safe, rate-limited probe retrieves it, scoped strictly to the address ranges you have declared as your own estate.
Port-agnostic detection
Content-based
Protocols are identified by what the bytes are, not by which port they arrived on. TLS on 8443 and SSH on 2222 are found the same way as the well-known ports.
Deep fact extraction
Decomposed, not summarised
Cipher suites split into their key-exchange, authentication, encryption and MAC parts; full X.509 details; SSH host keys; and honest coverage flags such as cert_encrypted_in_handshake and buffer_truncated when the sensor could not see everything.
STARTTLS upgrades
SMTP, IMAP, POP3, PostgreSQL, MySQL, FTP, LDAP, XMPP
Opportunistic TLS begins as plaintext, so it is routinely missed. The sensor follows the upgrade and records the cryptography that results.
Fleet management
Enrol once
Authenticated enrolment, central registration, remote configuration and pull-based self-update, with Prometheus metrics and a health endpoint on every node.
Coverage flags are part of the contract. Where the sensor could not observe something, it says so rather than leaving a confident blank.
At a glance.
Current shipping version 1.10.
| Attribute | Specification |
|---|---|
| Protocols | TLS 1.0–1.3 · SSH 2.0 · IKE/IPsec v1/v2 · DTLS 1.0/1.2 · QUIC v1 / HTTP-3 · STARTTLS |
| Detection | Content-based, port-agnostic |
| Post-quantum | Hybrid and ML-KEM aware · offered vs negotiated · forward-compatible passthrough |
| Active probing | TLS certificate recovery — opt-in, rate-limited, scoped to your declared estate |
| Outputs | HTTPS to CADP · Kafka · JSONL file · stdout — CycloneDX 1.7-aligned events |
| Fleet | Authenticated enrolment · remote management · heartbeat · pull-based self-update |
| Observability | Prometheus /metrics · /health |
| Throughput | 1 Gbps design target · up to 100,000 concurrent flows |
| Platforms | Linux (glibc and musl) · Windows · FreeBSD · Solaris · x86-64 and ARM64 |
| Requirements | Root or CAP_NET_RAW and libpcap on Unix platforms |
| Implementation | Rust, no garbage collector, no runtime dependency on the host toolchain |
Packages are signed and delivered through the same licensed update channel as the rest of the platform.
What it does not do.
Worth stating plainly, because the alternative is discovering it during a proof of value.
It does not decrypt
The sensor reads handshakes, which are the part of the conversation sent in the clear. Payloads are never decrypted and never stored.
It does not sit inline
Passive capture from a span port or tap. It cannot fail a connection because it is never in the path of one.
It sees only what crosses it
A service that never talks during the capture window does not appear. That is exactly why the host sensor exists alongside it.
It reports, it does not judge
No risk score, no verdict, no policy. Those are CADP's job, deliberately, so that re-classifying the estate never means redeploying the fleet.
Probing is opt-in and bounded
Active certificate recovery is off until you enable it, and only ever targets the CIDRs and hostnames you have registered as your own estate.
Nothing leaves your environment
Events go to your CADP instance. There is no Acutiv-hosted collector and no telemetry channel back to us.
Put a sensor on a span port and see what a week of real traffic says.
Most proofs of value start here: one sensor, one segment, one week. It is usually enough to settle an argument about what the estate actually negotiates.