Manticore Network Intelligence

I opened the manticore-net tree because that is where a hub-PC network tool lives. Keep-warm for peerweave.com is not here — that job is in PeerWeave at deploy/keep-warm/. Notes for that: the log and the operator page.

manticore-net captures traffic the chosen interface can already see, stores rotating PCAP plus structured metadata in SQLite, and presents a live TUI driven by keyboard or an iNNEXT pad. Flow-level JSONL can be exported for local analysis. Packet payloads are not copied into that export.

Unauthorized interception of network traffic is illegal in many jurisdictions. Use this only on networks you own or have explicit permission to monitor. A switched LAN does not copy other hosts’ unicast to a Pi unless you use a tap, SPAN/mirror, or the Pi sits in the path.

Why the architecture is the interesting part

The sniffer thread never waits on SQLite. The TUI never walks the full database except when you press Enter in SEARCH. Only the visible tab is rebuilt. That split is the whole design:

interface
    │
    ▼
Scapy AsyncSniffer ──► unsynced rotating PCAP
    │
    ├── cheap parse (no pkt.summary(), raw DNS QNAME)
    ├── in-memory ring / flows / hosts   ◄── TUI reads this only
    └── queue (drop-oldest if backed up)
            │
            ▼
      batched SQLite WAL writer (256 rows / 50 ms)

Live buffer cap is 8,000 packets. The writer uses WAL, batches, and a bounded queue so a disk hiccup drops history rather than stalling capture. PCAPs rotate at 128 MB by default; rotation is not deletion — archive or remove old files so an SD card cannot fill. Version is manticore_net/__init__.py (currently 1.3.0).

Views

The app opens on HOME: rate, protocol mix, storage, top talkers, newest DNS names.

Install and run

Linux with libpcap. Python 3.11+ recommended. Root or cap_net_raw to sniff. Optional: iNNEXT USB gamepad in group input.

git clone git@github.com:Lucastil2212/manticore-net.git
cd manticore-net
chmod +x scripts/install.sh run.sh
./scripts/install.sh

ip route
ip -br link
./run.sh eth0    # wired
./run.sh wlan0   # Wi-Fi
./run.sh --map-controller

run.sh wraps the app with sudo -E so the virtualenv Python keeps MANTICORE_HOME (default ~/manticore-net-data). There are no API keys, tokens, or cloud credentials.

Search

Type in SEARCH; the live buffer filters as you type. Enter also reads SQLite history. Tokens AND together.

Y cycles a global filter on LIVE and SEARCH: ALL, TCP, UDP, DNS, ICMP, HTTPS, HTTP, SSH, DNS-53. Keyboard: arrows, PageUp/PageDown, [ ] for views, Enter for detail, Esc back, / find, s capture, h HOME, e export JSONL, q quit. Pad map (DragonRise 0079:0011, “USB Gamepad”) is in the in-app HELP tab and the repo README.

Data layout

~/manticore-net-data/
  captures/          raw rotating PCAP
  data/network.db    packet metadata and flows
  exports/           flow-level JSONL for local analysis
  logs/              reserved for service logs

Those paths are gitignored. Never commit PCAPs, SQLite databases, or flow exports. Full controls: docs/MANUAL.md in the repo.

Notes from the review

• The capture path is correctly isolated from SQLite. That is the choice that will still matter on a Pi under load.
• Token search is the right UX: no FTS syntax, prefixes like host: and port:, and a blob fallback for leftover terms.
• Legal and topology scope are written into README, HELP, and MANUAL — keep them there. Visibility is only what the interface can see.
• Rotation does not delete. Treat disk as an operator duty, especially on SD cards.
• The keep-warm ping for PeerWeave is a different daemon on the same kind of always-on box. Do not hunt for it in this tree.