A single binary that sees every packet, understands every flow, and enforces every policy.
No per-product copy. No kernel socket round-trip. One shared-memory pipeline that combines deep inspection, policy evaluation, and routing — with atomic updates and sub-millisecond latency.
Three planes. One pass. Every packet.
The data plane stays on shared-memory rings from wire to egress. The control plane feeds policy, intel, and health into the match point. Observability taps every stage without slowing it down.
14 actions. One decision tree.
Every match resolves to one — or a chain — of fourteen possible actions. No custom plumbing; the same runtime serves NGFW blocking, SASE steering, WAF redirection, and SOAR escalation.
- application
- category
- SNI / domain
- TLS fingerprint
- IP · CIDR · port
- user · group · device
- geography · schedule
- allow · log
- drop · reset
- shape · tarpit
- redirect · rewrite
- scan · quarantine
- exec · call-api
- mark · escalate
- deterministic, ordered evaluation
- multiple actions per match
- versioned generations
- atomic hot-reload
- legacy and new rule sets coexist
Same engine. Three ways to wire it.
Promoting from observation to enforcement to steering requires no configuration rewrite. The pipeline stays intact — only the interaction with the network changes.
- RX-only tap on a selected interface
- No packet modification; forwards through the kernel untouched
- Ideal for baseline, audit, and compliance programmes
- Recommended first deployment before enforcement
- Transparent bridge between two interfaces
- Full DPI, TLS inspection, and 14-action policy evaluation
- Fails open through a pass-through on worker exit
- Preserves the existing Layer-3 topology — no routing changes
- Per-flow routing decisions driven by policy
- Integrates with the kernel FIB and SD-WAN peer selection
- Strategy-pattern transmit layer with optional SNAT
- Enables hub-spoke SASE enforcement at wire speed
Push a policy change. Don't drop a packet.
Policy, threat-intelligence, and routing updates are applied as atomic generation swaps on a live control plane. No restart, no re-bind, no service window.