Have you ever opened Wireshark to figure out why your app is failing to connect, only to be greeted by a terrifying wall of 50,000 raw packet hex bytes? 😅
Don't get me wrong — Wireshark is an engineering masterpiece. But for most developers, debugging a network issue shouldn't require a Ph.D. in Wireshark display filters just to answer three simple questions:
- What actually happened on my network?
- Which app or process caused it?
- Is it dangerous or normal?
That's why I've been building NetPulse (formerly NetPlus) — a local-first, privacy-focused, beginner-friendly Internet observability platform built from scratch in Rust and React/Tauri.
Our goal? Making the Invisible Internet Visible. 🌐✨
💥 The Problem: Raw Data vs. Actual Understanding
When something goes wrong on the wire, traditional tools throw raw bytes at you first and leave the interpretation to you:
14:02:01.482019 IP 192.168.1.45.52412 > 1.1.1.1.53: 41203+ A? api.github.com. (32)
14:02:01.501923 IP 1.1.1.1.53 > 192.168.1.45.52412: 41203 1/0/0 A 140.82.121.4 (48)
Unless you process packet traces in your sleep, translating raw 5-tuples into human concepts takes cognitive effort:
- You have to correlate TCP handshake SYN/ACK flags to spot latency.
- You have to cross-reference IP addresses with
netstatorlsofto find out which process made the request. - Cloud-based telemetry tools solve this, but at a huge cost: they upload your private network traffic to someone else's server.
NetPulse was designed from the ground up to solve all three issues: deliver understanding first, correlate processes automatically, and keep 100% of your data on your machine.
✨ Meet NetPulse: Understanding First, Deep Inspection One Click Away
NetPulse reconstructs, explains, and teaches the complete story behind network events on your computer.
Here is what makes it different:
1. 🪜 Progressive Disclosure (Beginner → Intermediate → Expert)
Instead of forcing everyone into an expert-only interface, NetPulse serves one rich data model across three distinct depth levels:
- 🟢 Beginner Mode: Human narrative cards. Plain-English summaries like: > "Spotify requested audio stream data from Fastly CDN over encrypted TLS 1.3 (1.2 MB transferred in 45ms)."
-
🟡 Intermediate Mode: Interactive flow diagrams, connection latency metrics, protocol distribution, and local OS process attribution (e.g.,
spotify.exePID 4812). - 🔴 Expert Mode: Zero-copy packet hex dump, frame disassembly, raw TCP state machine inspection, and PCAP export.
2. 🧠 Narrative Engine: Turning Packets into Stories
Under the hood, netpulse-narrative correlates packets into bi-directional flows, synthesizes causal HTTP transactions and TLS handshakes, and projects them into human-understandable Story Cards.
No more guessing if a burst of UDP traffic was a DNS lookup or a video stream — NetPulse groups related events into single coherent timelines.
3. 🛡️ Calibrated Security & Anomaly Detection
Security findings shouldn't be binary "good/bad" guesses that generate alert fatigue.
NetPulse includes built-in engines for:
- DNS Tunneling & Data Exfiltration Detection
- Port Scanning & Reconnaissance Analysis
- Statistical Bandwidth & Latency Anomaly Engine
Every finding carries an explicit, calibrated confidence score (e.g., 92% Confidence — DNS Tunneling pattern detected based on entropy & query frequency) directly linked to exact packet evidence.
4. 🎓 Built-in Education & The "Website Load Journey"
One of my favorite features in NetPulse is the Interactive Curriculum (netpulse-learn):
-
Website Load Journey: Hit a button to visually simulate and explain everything that happens when you type
https://google.cominto your browser — from OS socket creation, DNS resolution, ARP table resolution, TCP 3-way handshake, TLS 1.3 key exchange, to HTTP GET requests. - Protocol Explorer: An interactive reference guide built right into the app to learn how Ethernet, IP, TCP, UDP, DNS, TLS, and HTTP work under the hood.
5. 🔒 Local-First & 100% Private
Privacy isn't an afterthought; it's an architectural invariant:
- Zero Remote Egress: All parsing, flow aggregation, and anomaly detection happen offline in Rust.
-
Auditable Egress Boundary: The entire backend has a strict rule prohibiting outbound network calls. The only exception is
netpulse-ai, an opt-in local/remote LLM assistant boundary that you explicitly control.
🛠️ The Architecture: How It's Built
NetPulse is built as a multi-crate Rust workspace paired with a high-performance React + Tauri v2 frontend.
┌─────────────────────────────────────────────────────────────────────────┐
│ Desktop User UI │
│ ┌───────────────────────────────────────────────────────────────────┐ │
│ │ Vite + React Application │ │
│ │ (@netpulse/app, @netpulse/components, @netpulse/viz) │ │
│ └─────────────────────────────────┬─────────────────────────────────┘ │
│ │ IPC (Tauri v2 invoke / events) │
│ ┌─────────────────────────────────▼─────────────────────────────────┐ │
│ │ Tauri Desktop Shell (`src-tauri`) │ │
│ └─────────────────────────────────┬─────────────────────────────────┘ │
└────────────────────────────────────┼────────────────────────────────────┘
│ Query / Command (netpulse-api v4)
┌────────────────────────────────────▼────────────────────────────────────┐
│ Engine Process (`netpulse-engine`) │
│ │
│ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ ┌──────────┐ │
│ │ narrative │ │ intel │ │ learn │ │ ai │ │
│ └──────┬───────┘ └──────┬───────┘ └──────┬───────┘ └────┬─────┘ │
│ └──────────────────┼──────────────────┘ │ │
│ ▼ │ │
│ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ │
│ │ storage │◀──│ flow │◀─│ decode │ │ │
│ └──────────────┘ └──────────────┘ └──────┬───────┘ │ │
│ ▲ │ │ │
└────────────────────────────┼──────────────────┼────────────────┼────────┘
The Tech Stack Highlights:
-
Rust (14 Workspace Crates):
-
netpulse-decode: Zero-copy protocol dissectors (Ethernet, IPv4/v6, TCP, UDP, DNS, HTTP, TLS) fuzzed withcargo-fuzz. -
netpulse-flow: 5-tuple flow aggregation state machine with causal event ordering. -
netpulse-platform: Cross-platform OS bindings (Npcap on Windows, AF_PACKET on Linux, BPF on macOS) and socket process attribution (GetExtendedTcpTable).
-
-
TypeScript & React 18 Workspace:
-
@netpulse/contract: Auto-generated TypeScript DTOs from Rust structs, enforced in CI to prevent drift. -
@netpulse/viz: WebGL and Canvas graphics for real-time sparklines, flow diagrams, and bandwidth meters. - Tauri v2 Shell: Ultra-lightweight native desktop window with tiny memory footprint compared to Electron.
-
💡 Key Lessons Learned
Building a high-throughput network engine in Rust taught us a few crucial lessons:
- Zero-Copy Everything Matters: Parsing gigabytes of packet data per second will shred your CPU if you allocate heap memory per frame. Slicing raw bytes directly with Rust lifetimes keeps memory usage flat.
-
Type Safety Across IPC: Generating TypeScript types directly from Rust DTOs (
netpulse-api→@netpulse/contract) eliminated an entire class of serialization bugs between Tauri and React. -
Privilege Separation: Capturing raw network sockets requires elevated privileges (Administrator/
CAP_NET_RAW). Instead of running the entire UI and engine as admin, NetPulse isolates packet capture into a tiny daemon (netpulse-capture-svc), keeping the main engine and webview at normal user privileges.
🎯 What's Next?
NetPulse is actively developing live Npcap capture streaming, WASM plugin loaders, and an offline local ONNX model backend for offline conversational packet queries.
If you love network engineering, Rust, React, or privacy-first software, we'd love for you to check out the project, star the repository, or contribute!
⭐ GitHub Repository: NetPulse on GitHub
💬 Over to You!
How do you currently debug network issues in your stack? Would a human-readable, progressive packet analyzer fit into your workflow?
Let me know in the comments below! 👇
Top comments (0)