Nitwity is an open-source cyber forensics platform built on three pillars: always-on rolling packet capture, real-time network metrics, and deep packet inspection. When an incident hits, the evidence is already recorded.
Most tools start recording after something goes wrong. Nitwity is designed to already be watching — so the packets that matter are on disk before you knew you needed them.
Always-on ring-buffer capture to disk. Set your window — hours or days — and rewind to the exact moment an incident began. Full packets, not just summaries.
Decode traffic down to the payload: protocols, sessions, files, anomalies. Open every packet up and see what's actually moving across your wire.
Live dashboards for throughput, top talkers, protocol mix, flows, and errors. Know what normal looks like, so abnormal jumps out instantly.
Scrub backward through captured history like a DVR for your network. Correlate metrics spikes with the raw packets underneath them.
Engineered for sustained line-rate capture with a minimal footprint — built to run quietly on sensors, servers, and edge boxes alike.
Free forever, developed in the open. Audit the code that watches your network — no black boxes, no phone-home, no license tricks.
One sensor, three stages — from raw wire to actionable forensic evidence.
Attach Nitwity to an interface or tap and it writes packets into a rolling on-disk ring buffer — --ring 500G and the last N hours of your network are always available.
The DPI engine classifies protocols, reassembles sessions, and extracts metadata and artifacts in real time as traffic flows through.
Query flows, graph metrics, and pivot from a suspicious spike straight to the raw PCAP evidence — exportable for your existing forensic toolchain.
Nitwity is early — the design is taking shape now, and every step happens publicly on GitHub. Star the repo to follow along and help steer it.
High-performance rolling packet capture with configurable ring buffers and PCAP-compatible storage.
Real-time throughput, flow, and protocol analytics with a built-in web UI.
Protocol decoders, session reassembly, and payload-level analysis.
DVR-style history scrubbing, query language, and evidence export.
AI-powered traffic analysis: an AI agent that reasons over flows, payloads, and protocol anomalies in the capture history to surface zero-day exploits and novel attack patterns no signature database knows yet.
Fleet of capture nodes reporting to a central console, with anomaly alerts.
Nitwity is just getting started. Star the repository to follow development, open issues to shape the design, and be there from commit one.