Marc Pardo

Spin up a realistic multi-router network — impairments, WireGuard, VXLAN, VRFs — as fast and reproducibly as running a unit test, without Docker or vendor NOS images.

• NLL, a typed topology language: loops, parametric imports, IP arithmetic, editor tooling (tree-sitter, VS Code, Zed, Helix)
• Sub-second deploys on plain network namespaces; per-destination impairments Docker-based tools can't express
• #[lab_test] macro runs whole topologies inside cargo test with automatic teardown

# Two sites joined by an impaired WAN link — one file, one command.
profile router { forward ipv4 }

node router-a : router { route 10.2.0.0/24 via 172.16.0.2 }
node host-a   { route default via 10.1.0.1 }

link router-a:eth0 -- host-a:eth0 { 10.1.0.1/24 -- 10.1.0.10/24 }

link router-a:wan0 -- router-b:wan0 {
  172.16.0.1/30 -- 172.16.0.2/30
  delay 30ms jitter 5ms loss 0.1% rate 50mbit
}

Capture, analyze and transmit packets from safe Rust at high rates — AF_PACKET TPACKET_V3 mmap rings and AF_XDP, no native C dependencies.

• ~4.7 M frames/s/core of userspace flow-tracking dispatch in the reproducible benchmark, with zero per-packet allocations enforced in CI
• RX and TX: fanout sharding, atomic BPF filter swap, rate-paced injection, hardware TX timestamps
• Typed subscription engine splits filters between kernel BPF and userspace; JA3/JA4, Sigma, YARA-X detections built in

// Zero-copy borrowed batches via AsyncFd — nothing is copied per packet.
let mut cap = netring::AsyncCapture::open("eth0")?;
loop {
    let mut guard = cap.readable().await?;
    while let Some(batch) = guard.next_batch() {
        for pkt in &batch {
            let data: &[u8] = pkt.data();   // borrows from the ring
            let ts = pkt.timestamp();       // ns kernel timestamp
        }
    }
}

Watch a fleet of Linux hosts and network devices — SNMP, syslog, NetFlow, Modbus, gNMI, kernel telemetry — through one data model and one live desktop UI, without a heavyweight monitoring stack.

• 11 protocol sensors plus eBPF probes publish into one Zenoh keyspace; every sensor is auto-discovered
• A correlator fuses per-sensor identity evidence into a single entity per host
• Prometheus and OpenTelemetry exporters bridge it to existing stacks; native Iced frontend

# Every sensor publishes into one Zenoh keyspace — add one, it appears.
zensight/v1/h-9706b31ddad3/telemetry/sysinfo/cpu/usage
zensight/v1/h-9706b31ddad3/telemetry/netflow/flows
zensight/v1/h-9706b31ddad3/state/netlink/health
zensight/v1/h-9706b31ddad3/@rpc/netlink/sockets