Eon Aethis Network observability. See what your network actually does. Network observability. See what network really do.

// topology — clusters, hosts, graded flows

Most operations teams cannot answer one simple question: what is talking on my network right now, and is any of it broken? Eon Aethis answers it, on your own infrastructure.

Who this is for

Operations and security teams who:

Run a monitoring tool, a metrics tool, a flow tool and a topology diagram that do not speak to each other.
Need to know which cipher and which protocol version a connection actually used, not that "TLS is on".
Cannot send telemetry off site, because of a sovereignty requirement or a customer contract.

What it does

Monitoring. Host and service checks on the Icinga 2 engine, with alert rules, escalations and acknowledgements. Existing Nagios configuration imports directly.
Flow classification. Every flow on the wire identified by its first bytes rather than its port number — 55 protocols and more, across eleven categories including industrial.
Encryption grading. JA3 and JA4 fingerprints per flow, cross-referenced against known malware signatures, and each flow graded strong, legacy, weak or plaintext.
Topology. A 2D force-directed graph for daily work and a 3D view for walking into a bottleneck, with IP ranges drawn as named clusters.
Ask it things. A question in plain language becomes a query against the flow store and comes back as data you can save as a view.
Dependencies and impact. Declared or proposed, then used to answer what else breaks when a host goes down — and to silence the cascade instead of the cause.

How it works

1 · Deploy. A probe on any Linux host where you want flow visibility, agents on the endpoints you want checked. Most deployments need no port mirror.
2 · Observe. Flows, hosts, services, dependencies and topology are kept live. The probes push; nothing polls the network into the ground.
3 · Ask. Plain language in, query and data out, saved as a view the rest of the team can recall.

Facts

protocols55+, first-byte classified

fingerprintsJA3 · JA4, malware cross-reference

topology2D force graph · 3D walkthrough

transportTLS 1.3 + X25519MLKEM768 hybrid

deploymenton-prem or hybrid, runs without internet

telemetrynone leaves your perimeter

For teams under scrutiny

Activity logs and role-based access at admin, operator and viewer level, which is what an audit against NIS2, DORA, ISO 27001 or BIO 2.0 asks to see. Personal data stays on your infrastructure, so the GDPR question is about your own processing and not about ours.

Request demo See Eon Insights

One question. Most team cannot answer. What talk on my network right now, and is any of it broken?

Eon Aethis answer it. On your own machine.

What it do

Monitor. Host and service check. Icinga 2 engine. Alert, escalate, acknowledge. Old Nagios config import straight in.
Classify flow. Read first byte, not port. 55+ protocol. Eleven category. Industrial too.
Grade crypto. JA3 and JA4 per flow. Check against malware signature. Every flow get grade: strong, legacy, weak, plaintext.
Draw topology. 2D graph for daily work. 3D for walk into bottleneck. IP range become named cluster.
Ask it. Type question in plain words. Get query and data back. Save as view.
Impact. This host die — what else break? Silence the cascade. Show the cause.

How it work

1 · Deploy. Probe on Linux host. Agent on endpoint. Mostly no port mirror needed.
2 · Observe. Flow, host, service, dependency, topology. All live. Probe push. Nothing hammer network.
3 · Ask. Plain words in. Data out. Save view. Team reuse it.

Facts

protocols55+, first-byte classified

fingerprintsJA3 · JA4, malware cross-reference

topology2D force graph · 3D walkthrough

transportTLS 1.3 + X25519MLKEM768 hybrid

deploymenton-prem or hybrid, runs without internet

telemetrynone leaves your perimeter

request demo see eon insights

Eon Aethis — network observability platform. Monitoring, flow classification, topology and natural-language flow analytics. On-prem or hybrid; no telemetry egress.

Pipeline

probe (passive capture, plus active probes) → first-byte classification → flow store → topology, dependency and impact graph → natural-language query. Host and service state is collected in parallel by the Icinga 2 engine and shares the same map.

Capabilities

monitoring engineIcinga 2 — checks, notifications, escalations, acknowledgements

agentsNCPA · Go-native · agentless SSH / SNMP / API

migrationNagios .cfg import

flow classification55+ protocols by first-byte signature, 11 categories

industrialModbus · DNP3 · S7 · OPC-UA and further, natively classified

tls fingerprintingJA3 / JA4 with malware-signature lookup

encryption gradingper flow: strong · legacy · weak · plaintext

topology2D force-directed · 3D walkthrough · configurable IP-range clusters

flow analyticsnatural language → SQL → live result, saved as a shared view

discoverycontinuous passive, plus scheduled or ad-hoc active scans

classificationAI-assisted device and dependency proposals, approval inbox

dependenciesdeclared or proposed; impact analysis; topology-aware alerting

Data tier

configurationPostgreSQL

metricsVictoriaMetrics

flowsClickHouse

probe transportTLS 1.3, X25519MLKEM768 hybrid key exchange

Access and evidence

Role tiers admin / operator / viewer, with activity logging. Relevant to NIS2, DORA, ISO 27001 and BIO 2.0 evidence requirements. Deployment is on your own infrastructure and functions without outbound internet access.