# PacketSpear White Paper: Self-Hosted Microsegmentation (DRAFT v0.1) > **Status:** Draft — proposed external-facing white paper. Grounded in implemented PacketSpear features (see the internal competitive feature pass). Commercial, support, and customer-portal features remain draft/private-beta readiness work and are not represented as generally available services. --- ## Executive Summary Modern networks have dissolved the perimeter. Every endpoint — laptop, server, mobile device, cloud instance — is a potential entry point. Traditional network segmentation tools are expensive, complex, and tied to specific hardware or cloud vendors. **PacketSpear** is a self-hosted microsegmentation platform that gives every team free visibility, operator-owned enforcement, and cross-platform coverage from mobile to server — without the enterprise price tag. --- ## The Problem: Perimeter Dissolution Organizations face three compounding challenges: 1. **Attack surface expansion.** Remote work, BYOD, cloud migration, and IoT mean every device is a potential lateral-movement vector. 2. **Tool complexity.** Enterprise microsegmentation products (Illumio, Guardicore, Cisco Secure Workload) require dedicated appliances, cloud management planes, and six-figure commitments. 3. **Visibility gaps.** Most teams cannot see east-west traffic between their own endpoints, let alone enforce policies on it. The result: organizations either overspend on tools they don't fully use, or go without segmentation entirely. --- ## PacketSpear's Approach PacketSpear addresses these challenges with four design principles: ### 1. Self-hosted sovereignty PacketSpear runs entirely on your infrastructure. No cloud dependency, no data exfiltration, no vendor lock-in. You own the Certificate Authority, the encryption keys, the flow data, and the audit trail. ### 2. Free visibility, graduated enforcement The free tier provides unlimited device visibility, flow maps, the Command operator dashboard, and Prometheus metrics — forever. Enforcement (L3/L4 nftables, L7 TLS/URL filtering, eBPF probes) is available when you're ready to upgrade. ### 3. Every endpoint is a boundary PacketSpear treats every device as its own security boundary. Policies are evaluated and enforced at the endpoint, not at a central choke point. This design eliminates single points of failure, scales horizontally, and works across heterogeneous environments — macOS, Linux, and (designed for) Windows, iOS, and Android. ### 4. Operator-owned observability Prometheus metrics, Grafana dashboards, and alerting rules ship in the standard installer. No separate monitoring stack, no additional agents, no observability upsell. --- ## Architecture PacketSpear consists of four binaries plus an embedded dashboard: | Component | Role | |-----------|------| | **Core** | API server: device enrollment, policy management, internal CA, flow ingestion, commercial ops, threat intel | | **Node** | Host agent: collects flows, sends heartbeats, enforces policies via Gate engine | | **Gate** | CLI enforcement engine: reads policies from PostgreSQL, generates and applies nftables rulesets (apply, dry-run, clear) | | **Relay** | Background worker: polls PostgreSQL for unprocessed flows/audit events, outputs to stdout/files/webhooks | | **Command** | Embedded operator dashboard: device inventory, flow maps, policy status, audit viewer | All server-side components (Core, Relay) run on macOS and Linux. The Node agent runs on macOS and Linux, with the endpoint policy contract designed to support Windows, iOS, and Android. --- ## Key Capabilities ### Microsegmentation Enforcement - **L3/L4 nftables enforcement** on Linux (kernel 5.15+) with dry-run, apply, and clear workflows. - **L7 firewall** with TLS fingerprinting, SNI inspection, URL/path filtering, and HTTP method constraints. - **eBPF process probes** for deep process-level context, socket monitoring, and TLS metadata extraction. - **Platform-aware degradation**: macOS endpoints operate in visibility-only mode with safe no-op enforcement logging. No kernel panics, no broken networking. ### Policy Management - **Policy-as-code** with JSON format, CLI-driven management, and version-controlled policy files. - **Terraform provider** for day-1 infrastructure-as-code integration. - **Policy bundles** with Ed25519 cryptographic signing for integrity verification. - **Snapshot and rollback** with reliability simulation to validate policy changes before deployment. - **Real-time policy engine** evaluating flows against enabled rules. ### Identity-Aware Just-in-Time Access - **JIT firewall grants** with configurable TTL expiry and automatic revocation. - **Multi-factor authentication** supporting TOTP, Duo Security, OIDC, and RADIUS providers. - **Device certificates** with identity binding for cryptographically verified endpoint identity. - **Identity predicates** in policy rules, enabling rules like "allow SSH only when MFA session is active." - **Full audit trail** for every access grant, certificate issuance, and authentication event. ### Webhook Automation - **Event-driven webhooks** for device enrollment, policy changes, threat detection, JIT grants, and flow anomalies. - **Automation actions**: quarantine devices, send notifications, trigger custom payloads. - **HMAC-SHA256 payload signing** for integrity verification at the receiver. - **Scoped to policy, device, or account** for fine-grained control. ### Threat Intelligence Integration - **STIX/TAXII feed ingestion** with automatic indicator extraction. - **Custom threat indicator management** with observables (IP, domain, URL, hash). - **TTL-scoped block rules** that expire automatically. - **Policy engine integration** for automatic enforcement of threat-based rules. ### MSSP Multi-Tenancy - **Parent/child account hierarchy** with administrative boundaries. - **Global policy templates** with selective rollout to child accounts. - **Tenant-safe policy bundles** that prevent cross-tenant information leakage. - **Inherited policy visibility** for MSSP operators managing multiple customers. ### Observability by Default - **Prometheus-compatible metrics endpoint** (`/metrics`) with counters, gauges, and histograms. - **Bundled Grafana dashboards** and **Prometheus AlertManager rules** in the standard installer. - **Command dashboard** with device inventory, flow topology, policy status, and audit viewer. - **Responsive design** supporting desktop, tablet, and phone form factors. --- ## Competitive Positioning PacketSpear is positioned as the self-hosted, affordable alternative to enterprise microsegmentation products: - Against **Illumio/Guardicore/Cisco**: 90% of the core value, simpler, self-hosted, cross-platform/mobile, and priced for everyone else. - Against **Zero Networks**: MFA/JIT access plus deeper process/TLS flow context, mobile coverage, self-hosted ownership, and lower-friction pricing. - Against **Tailscale/NetBird**: Overlay networks connect devices; PacketSpear sees and controls all paths, including LAN, process, identity, audit, and enforcement. - Against **Elisity/NSX**: No switch fabric or hypervisor lock-in; every endpoint carries its own boundary. See the internal competitive feature pass for a detailed gap analysis. --- ## Go-Live Commercial Operations (DRAFT — in review) The following capabilities are implemented on branch `feat/golive-commercial-ops` and are required for public launch: - **Commercial operations**: Back-office workflows for customer readiness remain in review and are not a public entitlement or licensing commitment. - **CRM foundation**: Customer accounts, contacts, and opportunity tracking via admin APIs. - **Support portal**: Ticket, bug, and enhancement/RFE intake with public submission and admin-only listing. - **Knowledge base**: Published article management with public read access and admin-only create/edit. These features are integrated with the Core API server and are pending merge review. --- ## Roadmap ### v1 (current) All capabilities described in this document, plus go-live commercial operations now under private-beta review. ### v1.x (committed) - Cloud/container/Kubernetes awareness: pod/namespace labels, cloud policy predicates. - Compliance report templates: SOC 2, PCI, HIPAA. - Packet capture on alert (privacy/performance boundaries permitting). - Pre-built SIEM integrations: Microsoft Sentinel, ServiceNow, Splunk. ### Later versions - Network fabric/switch enforcement. - Deception/honeypots. - Multi-site Core federation. - OT/IoT protocol-specific enforcement. --- ## Conclusion PacketSpear brings enterprise-grade microsegmentation to every team: free visibility, self-hosted sovereignty, graduated enforcement, and cross-platform coverage from mobile to server. It replaces vendor lock-in with operator ownership and makes zero-trust networking accessible to the 99%. --- *© 2026 PacketSpear. This document is a draft and may be updated as features are finalized.*