security · July 2026
NetLens
A passive, offline network-forensics backend for authorized packet captures. It validates PCAP/PCAPNG by magic bytes, normalizes Zeek and Suricata output into one event model, runs ten explainable heuristics, and serves investigations, findings, and reports over a typed FastAPI. It never touches a wire — it only reads capture files an analyst deliberately hands it.
Tornike Kalandadze — software engineer & technical lead, client delivery since 2019 · Tbilisi (GMT+4)
Problem
Opening a packet capture usually means handing the file to something that trusts it — and a malicious capture is a payload aimed straight at the parser. Most tooling blurs the line further: it captures live, scans hosts, and analyzes all at once, so "just look at this PCAP" quietly becomes "run code with network access."
Approach
Draw a hard passive/offline boundary and never cross it: NetLens reads only capture files an analyst supplies — no interfaces, no scanning, no packet injection. Validation streams the file by magic bytes (not its extension) with an incremental size cap and single-pass SHA-256; Zeek and Suricata run inside a Docker jail with the network off, capabilities dropped, a read-only filesystem, non-root, no-new-privileges, and hard resource ceilings. Their output is parsed defensively and rendered as data, never markup. Ten explainable heuristics each ship their rationale, the calculation behind them, benign explanations, and validation steps — findings are framed as evidence to investigate, not verdicts.
Impact
A threat-hunting backend that treats its own inputs as hostile and can show its work: 98 core tests green, evidence stored under UUIDs with path-containment, and every finding written as a lead rather than a verdict. It is in development — the queued worker orchestration and the web UI are the next milestones — but the security spine (validation, isolation, defensive parsing) is already the whole point.
Through every lens
01 · Full-stack
A backend where the security model is the architecture: streaming validation, UUID evidence with path-containment, async SQLAlchemy over PostgreSQL or SQLite, Argon2 and JWT auth with ownership checks and audit records, and Redis-backed rate limiting that falls back to in-memory. The honest status is on the tin — 98 core tests green, worker orchestration and UI still ahead.
04 · Automation
Ingestion as a sandboxed pipeline: a capture is validated, hashed, and stored, then Zeek and Suricata run in a locked-down Docker jail (no network, dropped capabilities, hard resource ceilings) whose output is normalized into one event model and scored by ten explainable heuristics — the queued worker that drives this end to end is the next milestone.
05 · Security
It assumes its own parsers are hostile ground: uploaded captures and tool output are attacker-influenced, so each analysis run is jailed in Docker with the network off, capabilities dropped, a read-only root filesystem, a non-root user, no-new-privileges, and CPU/memory/PID/wall-clock ceilings. Evidence mounts read-only as a single file, output is rendered as data rather than markup, and findings are framed as evidence to investigate — never verdicts. A defensive forensics backend that audits traffic without ever producing any.
Built with
Python 3.11+ · FastAPI · async SQLAlchemy · PostgreSQL · Redis · Zeek · Suricata · Docker (sandboxed runners) · Argon2 · JWT
Notes
NetLens is intentionally a backend rather than a demo: the engineering worth showing is the containment. A capture is validated by its magic bytes (never its filename), size-capped as it streams, and hashed in a single pass before it is stored under a UUID with path-containment checks and restrictive permissions. Zeek and Suricata then run inside a Docker sandbox that has no network, no capabilities, a read-only root, a non-root user, and hard CPU, memory, PID, and wall-clock limits — because a native protocol parser handed hostile bytes is exactly where things go wrong. Their output is normalized into a single event model and run through ten explainable heuristics (beaconing, rare destinations, suspicious DNS shapes, large outbound transfers, failed connections, uncommon ports, certificate validity), each shipping its rationale, the numbers behind it, plausible benign explanations, and the steps to validate it. Findings are leads, not verdicts. 98 core tests pass; the queued worker that drives an upload to a finished report end to end, and the web UI, are the next milestones.