The problem
Adversaries have gone dark, not gone away. Hostile traffic hides inside encrypted protocols, operators move across devices and accounts, and investigators face telemetry that is abundant but thin when it is not fused across sources. Existing tools either collect data or analyze it, never both, so teams glue them together by hand.
What Etherflow does
One platform, two missions. Data gathering ingests line-rate network traffic, operator and ISP records, open-source and third-party feeds into a single controlled warehouse with selective retention. Data intelligence turns that evidence into identity graphs, behavioral cues and investigative leads, with full chain of custody on every item. Encryption protects the message; Etherflow uncovers the network behind it.
Built for national scale
Validated at 360 Gbps of sustained traffic per host, with selective capture, flow records and L7 logging at the same time, and over 300 standing capture targets per host. Scaling is linear: an eight-host fleet handles close to 3 Tbps and more than a thousand targets, and operator queries answer in seconds at billion-row scale over years of retained history.
A tenth of the cost
400 Gbps and above normally comes with a hardware tax: proprietary appliances, FPGA and ASIC line cards, and per-port or per-subscriber licenses that put a national rollout in the hundreds of millions. Etherflow runs native software offload on standard servers with off-the-shelf NICs, at roughly ten times lower capital cost, with no recurring license walls and no vendor lock-in. A national-scale program that fits an agency budget, not a defense budget.
How it is built
Three planes that scale independently. The dataplane runs VPP and DPDK on commodity x86 with flow rules offloaded to the NIC, IPFIX export, selective capture and Zeek for L7 analysis. Data moves through Redpanda into a ClickHouse warehouse, with MinIO for cold packet archives and a Neo4j or ArangoDB graph for resolved entities. The control plane is Python and FastAPI on Postgres with per-host agents, and a React and TypeScript operator UI. Operations run on Prometheus, Grafana, Loki and Ansible, on Docker Compose for pilots or Kubernetes for fleets. Access goes through Keycloak with role- and field-level permissions, secrets live in Vault or an HSM, and every observation is hashed at ingest. Proven open-source where it exists; everything Etherflow-specific is our own code, delivered as source for audit.
Lawful authority and compliance
Etherflow fits the legal framework, it does not replace it. It aligns with ETSI TS 102 232 and 103 221 and with 3GPP TS 33.107, 33.127 and 33.128 handover interfaces, with per-warrant scoping, warrant separation and a tamper-evident audit log for judicial and parliamentary oversight. It does not authorize collection, does not bypass encryption, and never phones home.