Version 4.0
Latest July 2026A ground-up rebuild of the collector and analyzer — the same sFlow v5 wire parsing and detection catalogue, now with adaptive traffic baselines, deduplicated alerting with email delivery, a live desktop control panel, and HTTPS by default.
Added
- Adaptive traffic baselines. A new anomaly detector learns what each agent’s traffic normally looks like — per hour of the week, with an overall baseline as fallback — and scores every minute against it, instead of requiring a threshold to be guessed per network. Alerts state what was observed, what was expected, and by how much they differed. Ships in learning-only mode: it studies live traffic and records what it would have raised, without alerting, until you switch it on under Alert Settings.
- Alert occurrence counts. The Alert History page shows a Last-seen column and an occurrence count, and each alert carries first-seen, last-seen and the number of occurrences.
- Live control panel. A rebuilt desktop shell with custom window chrome, light/dark themes, separate collector and web-server views, an agent list with live traffic sparklines, and a native About box.
- Host Watch and dashboard drill-downs. Live-monitor a chosen set of IP and MAC addresses on their own page, and drill into top talkers and conversations from the dashboard.
- Email alert configuration for custom SMTP, Gmail and SendGrid, with a save-and-test button, cooldown and digest settings, and per-detector thresholds.
- HTTPS by default on port 8443 with a self-signed certificate generated on first run; drop your own certificate and key into the data directory’s
sslfolder to replace it. HTTP on 8080 remains available. - Collector health monitoring. A heartbeat every 15 seconds and an anonymous stats endpoint (queue depth, datagrams, drops, insert timing), plus a version endpoint surfaced in the dashboard, the About page and the login footer — so a headless deployment can be monitored without signing in.
Changed
- A condition that keeps firing is now one alert, not one per check. Repeats update an occurrence count and a last-seen time on the existing alert instead of adding a new row every poll (which used to push the unread badge into the thousands within a day). If the condition worsens, the alert is raised to the new severity and marked unread again, so escalations are not buried. The grouping window is configurable (default 15 minutes).
- Baseline spike thresholds are now deviation scores, not multiples of a short-term average, so they carry across networks of different sizes; the defaults keep their previous meaning.
- Alert lists and retention are ordered by last activity, so something still happening stays at the top.
- Settings are saved to a per-user location, so the application runs correctly from a read-only install (Microsoft Store package or Program Files).
- The web interface was rebuilt on a new design system with a dark default theme and a light toggle; fonts are bundled, so the dashboard needs no internet access. The routine first-run “certificate created” dialog no longer appears.
Fixed
- Much higher sustained ingest throughput. The collector now keeps up under heavy load and no longer drops datagrams when traffic bursts.
- ARP spoofing, MAC flapping and duplicate-IP detectors now fire — each previously read fields its query didn’t produce, so it never triggered. Severity tiers are now respected, and the baseline-spike detector works.
- Top-N rankings are no longer arbitrary on quiet networks (everything used to tie at a rounded 0.00), and bandwidth figures auto-scale between Mbps, Kbps and bps instead of showing 0.0 Mbps.
- Empty-state and null-value handling in the interface no longer overflows its container or renders blank rows, and the About box shows the build date correctly.
Security
- The first login creates the administrator account — no default credentials ship with the application.
- Agent registration is hardened against a race under concurrent inserts.
Notes
- Adaptive baseline detection ships in learning-only mode; its hour-of-week baselines need roughly two weeks to mature, so on networks with a strong day/night rhythm it is worth waiting before enabling alerts.
- The application does not start automatically when Windows restarts — after a reboot, launch it again to resume collection. Counter samples (sFlow format 2) are parsed but not stored.