Total Analyses

0 +12%

Avg Confidence

0 % +2%

Active Models

4 All Online

Avg Latency

0 ms -15%

Quick Analysis

Start New Analysis

Click to submit a query

Recent Analyses

Your latest multi-LLM consensus results

Query ID	Status	Confidence	Models	Analyzed At
Loading...

Platform Capabilities

Multi-LLM Consensus

Query Claude, GPT-4o, Llama, and Perplexity simultaneously for higher accuracy through 4-model agreement.

RMM Agent Management

Deploy lightweight agents across your infrastructure for remote monitoring and real-time diagnostics.

AI-Powered Diagnostics

Run ping, traceroute, mtr, and nmap with intelligent AI analysis providing actionable recommendations.

PCAP Analysis

Upload network captures for deep packet inspection with AI-powered threat detection and protocol analysis.

Compliance Reports

Generate PCI-DSS, HIPAA, and SOC2 compliance assessments with MITRE ATT&CK mapping.

Threat Intelligence

AI-powered threat scoring (0-10) with severity indicators, risk recommendations, and remediation guidance.

User / Organization ID

Analysis Query

PCAP File (Optional)

Drop PCAP file here or click to browse

Supports .pcap, .pcapng, .cap (max 10MB)

Select Models

Claude 3.5 Sonnet GPT-4o Llama 3.1 70B Perplexity Sonar Pro

Querying models and building consensus...

How It Works

1. Submit Query

Enter your prompt

2. Query Models

3 LLMs in parallel

3. Build Consensus

Compare & synthesize

4. Get Results

With confidence score

User / Organization ID

Query History

All previous analyses for this organization

Query ID	Status	Confidence	Models	Analyzed At	Actions
Enter your Organization ID and click Load History

Claude 3.5 Sonnet

Active

Anthropic's latest model with strong reasoning and analysis capabilities. Excellent at understanding context and providing nuanced responses.

via OpenRouter API

GPT-4o

Active

OpenAI's flagship multimodal model with broad knowledge base. Fast response times with comprehensive understanding across domains.

via OpenRouter API

Llama 3.1 70B

Active

Meta's open-source model offering competitive performance. Great for diverse perspectives and alternative viewpoints in consensus building.

via OpenRouter API

Perplexity Sonar Pro

Active

Perplexity's flagship model with real-time web search capabilities. Excels at providing up-to-date information and grounded responses with citations.

via Perplexity Direct API

Why Multi-Model Consensus?

Reduced Hallucinations

When multiple models agree on a response, you can be more confident the information is accurate.

Diverse Perspectives

Different models have different training data and approaches, providing more comprehensive analysis.

Transparency

See individual model responses alongside the consensus, with clear confidence scoring.

Resilience

If one model fails or produces poor output, others can still provide a useful response.

User / Organization ID

Enter your Organization ID to view usage statistics

Default User / Organization ID

Default Models

Claude 3.5 Sonnet GPT-4o Llama 3.1 70B Perplexity Sonar Pro

Theme Preference

Dark Mode Light Mode

Email Notifications

Email Address

We'll send analysis completion notifications to this address

Notify me when analysis completes

Receive an email with the consensus summary and a link to view full results

Run a Diagnostic

Select an agent, choose a diagnostic tool, and enter a target to begin. Results will appear here with AI-powered analysis.

0

Running Monitors

0

Paused Monitors

0

Active Anomalies

--

Avg Latency (ms)

Active Monitors

No Monitors Yet

Create your first network monitor to start continuous monitoring with anomaly detection.

Network Topology

Visualize network paths and node relationships discovered from monitoring

0

Nodes

0

Links

0

Routers

0

Anomalies

Network Graph

Zoom:

No Topology Data

Run traceroute monitors to discover network paths and build the topology map.

Welcome to NetworkShark AI

NetworkShark AI is an AI-powered network diagnostics and monitoring platform. It combines multiple Large Language Models (LLMs) to analyze network issues and provide intelligent recommendations through consensus-based analysis.

Key Features

RMM Agent

Deploy lightweight agents on your network devices for remote monitoring and diagnostics execution.

NetPulse Monitors

Continuous monitoring for ping latency, IP changes, traceroute paths, and anomaly detection.

Network Diagnostics

Run ping, traceroute, MTR, nmap scans, and bandwidth tests with AI-powered analysis.

Multi-LLM Consensus

Analyze results using Claude, GPT-4o, Llama, and Perplexity for more accurate insights.

CVE Scanner

Automated vulnerability scanning with NVD lookup and AI-powered risk prioritization.

Asset Inventory

Auto-discovery and classification of network assets from diagnostic scans.

Self-Healing AI

Background health monitoring with LLM-powered diagnosis and automatic remediation.

Auto-Deploy

Push-install agents to discovered hosts via SSH/WinRM with approval workflow.

Quick Start

Install the RMM agent on your target machine (see Agent Setup)
The agent will appear in the Agents page once connected
Run diagnostics from the Diagnostics page
Set up continuous monitoring with NetPulse Monitors
Run a vulnerability scan from the CVE Scanner page
Monitor platform health via the Self-Healing dashboard

Agent Installation

The NetworkShark agent is a lightweight Python application that runs on your network devices, executing diagnostics and reporting back to the controller.

Prerequisites

Python 3.9 or higher
pip or pipx package manager
Network connectivity to the controller (default port: 8000)
Optional: nmap, iperf3, speedtest-cli for extended diagnostics

Linux Installation

# Install with pipx (recommended)
pipx install networkshark-agent

# Or install from source
cd agent && pip install -e .

# Run the agent
export NETWORKSHARK_CONTROLLER_URL=http://YOUR_SERVER:8000
export NETWORKSHARK_ORG_ID=my-organization
networkshark-agent

macOS Installation

# Install with pipx
brew install pipx && pipx ensurepath
pipx install networkshark-agent

# Run the agent
export NETWORKSHARK_CONTROLLER_URL=http://YOUR_SERVER:8000
networkshark-agent

Windows Installation

# Install Python from python.org, then:
pip install pipx
pipx install networkshark-agent

# Set environment variables (PowerShell)
$env:NETWORKSHARK_CONTROLLER_URL = "http://YOUR_SERVER:8000"
networkshark-agent

Environment Variables

Variable	Description	Default
`NETWORKSHARK_CONTROLLER_URL`	Backend API URL	Required
`NETWORKSHARK_ORG_ID`	Organization identifier	dev-local
`NETWORKSHARK_AGENT_NAME`	Custom agent display name	hostname

Verify Installation

After starting the agent, it should appear in the Agents page within 60 seconds. The agent status should show as ● Online.

The agent stores its ID in ~/.networkshark/agent_id. Delete this file to reset and get a new agent ID.

Troubleshooting Guide

● Agent Showing as Offline

An agent shows as offline when it hasn't sent a heartbeat within 2 minutes. Common causes:

1. Agent process not running

Check if the agent is running: ps aux | grep networkshark

2. Network connectivity issues

Test connectivity to the controller: curl http://YOUR_SERVER:8000/health

3. Firewall blocking outbound connections

Ensure port 8000 (or your configured port) is open for outbound TCP connections.

4. Incorrect controller URL

Verify NETWORKSHARK_CONTROLLER_URL is correct and includes the protocol (http:// or https://).

● Agent Not Appearing in Dashboard

If the agent doesn't appear at all:

Check agent logs for registration errors
Verify the controller URL is reachable from the agent machine
Check if the backend service is running: docker compose logs backend
Ensure Redis is running (required for task queue)
Try deleting ~/.networkshark/agent_id and restarting

● Diagnostics Stuck or Failing

If diagnostic tasks aren't completing:

Tool not installed: Check if the required tool (ping, traceroute, nmap, etc.) is installed on the agent machine
Permissions: Some tools (nmap, iperf3) may require elevated privileges
Timeout: Long-running scans may timeout. Try reducing the target scope
Target unreachable: Verify the target IP/hostname is correct and reachable from the agent

Connection Refused / Timeout Errors

# Test backend health
curl -v http://localhost:8000/health

# Check Docker services
docker compose ps

# View backend logs
docker compose logs -f backend

# Restart services
docker compose restart

NetPulse Continuous Monitoring

NetPulse monitors run continuously on agents, collecting metrics at regular intervals and detecting anomalies automatically.

Monitor Types

Ping Monitor

Tracks latency and packet loss to one or more targets. Reports min/avg/max/jitter statistics.

Use for: Gateway monitoring, upstream ISP health, critical service availability

Traceroute Monitor

Monitors network paths and detects route changes. Alerts on path changes, hop additions/removals, and latency spikes.

Use for: Route stability monitoring, ISP peering changes, network topology mapping

IP Monitor

Detects public IP changes with ASN/ISP resolution. Queries multiple providers for consensus.

Use for: Dynamic IP detection, failover monitoring, WAN link tracking

Ping Sweep

Discovers active hosts in a CIDR range. Useful for subnet inventory and rogue device detection.

Use for: Asset discovery, subnet inventory, new device alerts

Anomaly Detection

NetPulse automatically detects anomalies using statistical analysis:

LATENCY_SPIKE

Z-score > 3 from baseline

PATH_CHANGED

Route differs from baseline

HOP_ADDED/REMOVED

Network path length changed

BLACKHOLE

Packets stop at intermediate hop

Creating a Monitor

Go to NetPulse → Monitors
Click Create Monitor
Select an agent to run the monitor on
Choose monitor type and enter target(s)
Set the check interval (minimum 30 seconds)
Optionally configure alert thresholds

Network Diagnostics Tools

Run one-shot diagnostic commands on remote agents. Results are analyzed by AI for insights and recommendations.

Tool	Description	Requirements
ping	Basic connectivity and latency test	Built-in
traceroute	Network path discovery	Built-in
mtr	Combined ping + traceroute with statistics	Install mtr
nmap	Port scanning and service detection	Install nmap
iperf3	Network bandwidth testing	Install iperf3 + server
speedtest	Internet speed testing via Speedtest.net	Install speedtest-cli

Running a Diagnostic

Go to Enterprise → Diagnostics
Select an online agent from the dropdown
Choose a diagnostic tool
Enter the target (IP address or hostname)
Configure any additional parameters
Click Run Diagnostic
Results appear automatically when complete

Frequently Asked Questions

How many agents can I deploy?

There's no hard limit on agents. The platform scales based on your infrastructure. Each agent consumes minimal resources on the target machine (typically < 50MB RAM, < 1% CPU when idle).

What ports does the agent need?

The agent only needs outbound HTTP/HTTPS access to the controller (default port 8000). It doesn't require any inbound ports to be open.

Can I run the agent as a service?

Yes! Installation scripts are provided for:

Linux: systemd service (scripts/install-linux.sh)
macOS: launchd agent (scripts/install-macos.sh)
Windows: Scheduled task (scripts/install-windows.ps1)

How often does the agent check in?

The agent sends a heartbeat every 60 seconds. An agent is considered offline after 2 minutes without a heartbeat.

What LLM models are used for analysis?

The Multi-LLM Consensus Engine uses:

Claude 3.5 Sonnet (via OpenRouter)
GPT-4o (via OpenRouter)
Llama 3.1 70B (via OpenRouter)
Perplexity Sonar Pro (direct API)

Responses are synthesized with similarity scoring to provide consensus-based analysis.

How long is monitoring data retained?

Data retention varies by type:

Monitor data points: 30 days
Anomaly records: 90 days
IP history: 365 days

Can I use my own LLM API keys?

Yes. Set the following environment variables or secrets in your deployment:

OPENROUTER_SECRET_ARN - For Claude, GPT-4o, Llama
PERPLEXITY_SECRET_ARN - For Perplexity Sonar Pro

What vulnerabilities does the CVE Scanner detect?

The CVE Scanner uses nmap service version detection to identify running software, then queries the NIST National Vulnerability Database (NVD) for known CVEs. It detects any vulnerability that has a published CVE entry matching the detected service and version, including critical RCEs, privilege escalations, and information disclosures. An AI risk analyzer then prioritizes findings based on real-world exploitability in your specific environment.

How does self-healing work?

A background scheduler checks platform health every 60 seconds, probing Redis, DynamoDB, the agent fleet, and the task queue. When degradation is detected, the health snapshot is sent to an LLM for root cause analysis. The system then performs pre-approved safe actions like clearing stale queues, flushing expired heartbeats, or reconnecting to Redis. Every action is logged to DynamoDB as a full audit record. You can view the timeline from the Self-Healing dashboard.

Is auto-deploy safe? What safeguards exist?

Auto-deploy includes multiple layers of safety:

Deployments require manual approval by default
Maximum 5 concurrent deployments (configurable)
Emergency stop cancels all in-progress deployments instantly
Organization-scoped — cannot deploy cross-org
Pre-flight checks verify SSH/WinRM connectivity and Python availability
Auto-timeout at 5 minutes prevents hung deployments
Credentials stored in AWS Secrets Manager, never exposed in API responses

CVE Scanner

The CVE Scanner automatically detects vulnerabilities on your network devices by combining nmap service detection, NVD (National Vulnerability Database) lookups, and AI-powered risk analysis to deliver prioritized, actionable findings.

How It Works

1

Service Detection — The agent runs nmap -sV on the target to identify open ports and running service versions.

2

NVD Lookup — Detected service/version combos are queried against the NIST NVD API to find known CVEs, with local caching and rate limiting.

3

AI Risk Analysis — An LLM reviews the findings in the context of your environment to prioritize by real-world exploitability and suggest remediation steps.

Running a Scan

Navigate to the CVE Scanner page from the sidebar
Select an online agent to run the scan from
Enter a target IP address or subnet (e.g. 192.168.1.0/24)
Click Start Scan and wait for results

Understanding Results

Scan results include severity levels (Critical, High, Medium, Low), CVSS scores from NVD, and AI-prioritized findings with specific remediation recommendations. Findings are sorted by risk score so you can address the most critical issues first.

API Reference

POST /api/v1/cve/scan — Start a vulnerability scan
GET /api/v1/cve/scan/{id} — Get scan status and results
GET /api/v1/cve/scan/{id}/findings — Get prioritized findings with remediation

Asset Inventory

The Asset Inventory automatically discovers and classifies network devices found during diagnostic scans and CVE assessments. It maintains a living inventory of your infrastructure with change tracking over time.

Auto-Discovery

When a scan or diagnostic runs, discovered hosts are automatically added to the inventory. Each asset records its IP address, hostname, open ports, detected services, operating system, and the agent that discovered it.

Classification

Assets are classified using a two-layer approach:

Rule-based — Port/service patterns identify common device types (e.g. port 80/443 = web server, port 3306 = database server)
AI-powered — An LLM analyzes the full scan context for ambiguous or complex devices to provide accurate classification

Change Tracking

The inventory tracks changes between scans so you can detect:

New devices appearing on the network
Ports opening or closing on existing hosts
Service version changes (important for CVE tracking)
Devices going offline or changing IP addresses

Organization Scoping

Assets are scoped per organization. Each org sees only its own inventory, and assets can be grouped into network segments for easier management. Queries use the X-Org-Id header for isolation.

Self-Healing AI

The Self-Healing system runs as a background scheduler that continuously monitors platform health, uses an LLM to diagnose issues, and safely auto-remediates common problems without manual intervention.

Health Probes

Every 60 seconds (configurable), the scheduler checks:

Redis — Connection status and response time
DynamoDB — Table accessibility and latency
Agent Fleet — Ratio of online vs offline agents, stale heartbeats
Task Queue — Queue depth and stuck tasks

LLM Diagnosis

When a health check detects degradation, the health data is sent to an LLM (via OpenRouter) for root cause analysis. The LLM identifies the likely cause and suggests remediation actions. If the LLM is unreachable, a keyword-based fallback provides basic diagnosis.

Safe Remediation

The system only performs pre-approved, safe actions:

Clear stale tasks from the queue
Flush expired heartbeat records
Reconnect to Redis after transient failures
Restart internal service components

Configuration

HEALING_ENABLED — Enable or disable the scheduler (default: true)

HEALING_CHECK_INTERVAL — Seconds between health checks (default: 60)

HEALING_AUTO_REMEDIATE — Allow automatic fixes (default: true)

Audit Trail

Every healing action is logged to DynamoDB with a full audit record including the health snapshot, diagnosis, action taken, and outcome. View the timeline from the Self-Healing dashboard or via GET /api/v1/healing/actions.

Auto-Deploy

Auto-Deploy lets you push-install the RMM agent onto discovered hosts via SSH (Linux/macOS) or WinRM (Windows), with an approval workflow and full audit trail.

Credential Management

Deployment credentials (SSH keys, passwords) are stored securely in AWS Secrets Manager. They are never returned in API responses, logged, or stored in Redis/DynamoDB. You can manage credentials from the Deployments page or via the API.

Deployment Lifecycle

                                    pending → approved → deploying → verifying → success

                                                                               → failed → (retry) → approved

                                    pending / approved / deploying → cancelled (via emergency stop)

Safety Controls

Approval required — Deployments need manual approval before execution (configurable)
Rate limited — Maximum 5 concurrent deployments (configurable via DEPLOY_MAX_CONCURRENT)
Emergency stop — One-click cancellation of all in-progress deployments
Org-scoped — Cannot deploy cross-organization
Pre-flight checks — Tests SSH/WinRM connectivity and Python version before installing
Auto-timeout — Deployments that take longer than 5 minutes are automatically cancelled

Batch Deploy

Deploy to up to 20 targets at once using POST /api/v1/deployments/deploy-batch. Each target goes through the same approval and safety workflow independently.

Dashboard

Quick Analysis

Platform Capabilities

New Analysis

How It Works

Analysis History

LLM Models

Why Multi-Model Consensus?

Reduced Hallucinations

Diverse Perspectives

Transparency

Resilience

Usage Statistics

Settings

Email Notifications

Network Agents

Network Diagnostics

Run a Diagnostic

Network Monitors

Active Monitors

No Monitors Yet

Network Topology

Network Graph

No Topology Data

Node Details

Platform Health

Agent Deployments

Documentation

Welcome to NetworkShark AI

Key Features

Quick Start

Agent Installation

Prerequisites

Linux Installation

macOS Installation

Windows Installation

Environment Variables

Verify Installation

Troubleshooting Guide

● Agent Showing as Offline

● Agent Not Appearing in Dashboard

● Diagnostics Stuck or Failing

Connection Refused / Timeout Errors

NetPulse Continuous Monitoring

Monitor Types

Ping Monitor

Traceroute Monitor

IP Monitor

Ping Sweep

Anomaly Detection

Creating a Monitor

Network Diagnostics Tools

Running a Diagnostic

Frequently Asked Questions

CVE Scanner

How It Works

Running a Scan

Understanding Results

API Reference

Asset Inventory

Auto-Discovery

Classification

Change Tracking

Organization Scoping

Self-Healing AI

Health Probes

LLM Diagnosis

Safe Remediation

Configuration

Audit Trail

Auto-Deploy

Credential Management

Deployment Lifecycle

Safety Controls

Batch Deploy

Analysis Result

Create Network Monitor

Monitor Details

Sign In

Report a Bug