Skip to main content

System architecture

The system is built around several architecture concepts:

  • Microservices

    • The system is composed of tens of microservices, with independent storage and functional segregation.
    • They communicate together using HTTP REST APIs with JSON payload and JWT signed authentication & authorization.

  • CQRS - Command & Query Responsibility Segregation

    • Capture / Analysis and Search / Representation flows are decoupled and operated with independent services, optimized for their own processing.

High level system view​

High level view

Technologies​

Spider is built using modern technologies and architecture patterns:

  • Agents built in Go
    • Packets capture with AF_PACKET or LIBPCAP
    • Tls keys capture with eBPF
  • Microservices in Node.js
  • Open API with REST APIs
  • Security with JSON Web Tokens
  • Clustering with Kubernetes
  • Web application using React.js
  • Distributed memory with Redis
  • Search engine with Elasticsearch

Technologies

Parsing process​

Capture / Analysis and Search flows are decoupled and operated with independent services, optimized for their own processing.

Parsing Architecture

Data storage​

Spider uses Redis as a distributed memory to have optimal processing speed.

Then Spider serializes its captured and monitoring data in Elasticsearch search engine.

  • Its open API exposes Elasticsearch query and aggregation features.
  • Elasticsearch is configured for both speed of ingestion and search optimisation, with time based rolling indices, and progressive asynchronous loading of data on the UI.
  • Spider is designed to store billions of communications efficiently.

Low level network data​

  • Packets
  • Tcp sessions

Ciphering protocols​

  • TLS

Higher protocols​

  • Http communications
  • More will come...

Configuration data​

  • Users
  • Teams
  • Whisperers

Monitoring data​

  • Whisperer status
  • Capture status …

Complete system view​

Spider set of microservices and related storage is visible in real time in its monitoring UI, with network flows and quality.

Microservices

Scalability​

Spider system architecture has been proven to scale very well, with a track record of parsing more than 1GB/min with only 7 cores of CPU used.

Perf