Paqtra vs PacketWolf

Paqtra is the free, Apache-2.0 community edition. PacketWolf is the commercial platform built on the same Cilium-native foundation. Paqtra shows you what your Cilium cluster is doing and why. PacketWolf goes further: it attributes traffic to processes, detects threats, contains them, and operates policy for you.

Both target Kubernetes clusters running Cilium 1.14+ with Hubble enabled. Paqtra is read-only toward the datapath by design (see cilium-brotherhood.md). PacketWolf adds custom eBPF probes, an in-cluster operator and enforcement backends.

PacketWolf figures are its own published numbers (Feature Guide), with the capabilities spot-checked against its source tree. Paqtra figures come from this repository.

At a glance

	Paqtra (community)	PacketWolf (commercial)
License	Apache 2.0	Proprietary, commercial license from ZyvorAI Labs
Web dashboard	60+ pages	72+ routes, desktop-style shell with global search
REST API	OpenAPI-documented, 90+ paths	130+ routes plus live WebSocket streams
Terminal UI	13 tabs	18 tabs (adds Graph, Kernel, L7, ChaosBPF, Sandbox)
CLI	paqtra install / status / TUI	netpred: trace, policy, graph, chaos, canary, kernel, operator, CRDs, explain
Datapath access	Read-only Cilium map inventory via bpftool	Read-only map decoding plus opt-in custom eBPF probes
Kernel process attribution	No	Yes: socket → process → container → pod
Threat detection	Baseline anomaly scoring	ThreatSense detectors, learned baselines, attack graph
Containment / enforcement	Policy applied as CiliumNetworkPolicy	Six containment profiles, gated auto-response with rollback
Kubernetes operator and CRDs	No	Yes (GitOps-managed network intent)
Copilot	No	Ask Zyra, with 58 read-only tools
Identity	JWT	JWT plus OIDC, SAML and LDAP, tenant views
VMs and non-Kubernetes containers	No	KubeVirt VMs, podman/docker/containerd hosts
Support	Community	ZyvorAI Labs

What both give you

Paqtra is not a demo. These capabilities exist in both products:

• Live Hubble flows with verdict coloring, service map and topology.
• Packet drop analytics and root-cause analysis with one-click CiliumNetworkPolicy fixes.
• AutoPolicy learning, a visual rule builder, a YAML editor and a dry-run policy simulator.
• A network healer, chaos engineering, canary deployments and flow replay.
• Multi-cluster registration and topology.
• Read-only kernel data views: conntrack, policy maps, IP cache, LB maps.
• Web dashboard, REST API and terminal UI.

What PacketWolf adds

1. Kernel intelligence: past pod-to-pod

Paqtra sees flows between pods and identities. PacketWolf sees the process behind every socket.

• Process-to-network attribution. Maps each socket to the process, container and pod that owns it.
• TCP lifecycle tracking. SYN, ESTABLISHED, FIN, RST and TIME_WAIT with per-connection timing, to spot stuck, half-open and churning connections.
• Behavioral fingerprinting. Per-workload profiles of connection patterns, ports and timing, for drift detection against a workload's own history.
• Cross-layer correlation. L3, L4, L7, process and eBPF signals in one incident view.
• Syscall tracing. connect, bind, accept, sendmsg and execve through kprobes and tracepoints (opt-in, needs CAP_BPF).
• God Mode explain. netpred explain <service> fuses kernel, DNS, network and policy state into one root-cause narrative.

2. A custom eBPF data plane

Paqtra never attaches programs, on purpose. PacketWolf adds opt-in probes for TCP lifecycle, process mapping, DNS path, drops and TCP anomalies, draining into an event bus. Its /ebpf-dataplane view reports which probe phases attached, which failed and which still run in userspace, so an empty panel is never a mystery.

3. Threat detection

• ThreatSense detectors with confidence, a reason chain and a recommended action.
• Learned behavioral baselines using per-workload EWMA and a z-score gate, not fixed thresholds.
• DGA and NXDOMAIN-storm detection, and beaconing detection by inter-arrival periodicity.
• ThreatThread and attack graph. Alerts are correlated into multi-stage attack stories.
• GeoThreat enrichment with ASN, country and reputation, with optional MaxMind and threat-intel feeds.
• ProcessLens and RuntimeGuard. Tetragon exec events tied to the Hubble flows they opened.

4. Policy and Zero Trust, in depth

• Zero-Trust Pilot. A guided observe → simulate → approve ratchet toward default-deny, one reviewed step at a time.
• Policy Insight. Plain-language explanation of any policy and a least-privilege scorecard.
• Blast-radius simulation. Which flows and services a change would affect before it ships.
• Policy drift scanner and KubePosture. Intended versus live posture, and a single segmentation score with default-deny gaps and world-egress findings.
• Guided scope wizard. Pick a VM, pod, namespace or the whole cluster instead of hand-typing selectors.

5. Autonomous response and containment

• Six containment profiles: FullIsolation, InternetLock, ExfiltrationLock, InvestigationMode, LateralMovementLock and timed Maintenance. They are enforced through Cilium, nftables or libvirt backends.
• Detect-to-contain loop. Each high or critical detection is mapped to a profile with a simulated blast radius and a gated confidence.
• Gated auto-response with verification and automatic rollback on failure. It is off until you enable it, and anything not confident or safe queues for approval.
• Namespace and cluster-wide GuardPolicy, reconciled by the operator into a real CiliumNetworkPolicy or CiliumClusterwideNetworkPolicy.
• Forensic pack and incident story. IR evidence with a CEF sample and an attack narrative, ready for responders.
• Durable by design. The WorkloadContainment CRD is the source of truth, so containment survives restarts and control-plane loss.

6. Ask Zyra, the network copilot

Ask questions about cluster networking in plain English. In agent mode Zyra investigates with 58 read-only tools in a bounded observe-then-replan loop, routes hard questions to threat, policy, DNS, forensics and containment specialists, and keeps per-conversation memory. Write actions (submit a policy, run a playbook, apply a response) require explicit confirmation. On LLM failure it falls back to a deterministic rule router. LLM and agent modes are off by default.

7. Compliance, cost and prediction

• Compliance Lens maps live posture to SOC 2, PCI-DSS, HIPAA and Zero Trust controls. Paqtra's audits cover CIS, NIST and SOC 2.
• CVE posture. Prioritize the CVEs that are reachable over the wire.
• Cost-aware egress. See where bytes leave and where the spend is.
• Risk trend and forecast. A 14-day ring buffer projects when risk turns critical and likely next targets.
• Network SIEM report, digital twin and network score. An executive report, a snapshot of the network and one trendable health number.

8. Platform and enterprise integration

• Kubernetes operator and CRDs, built on kube-rs with finalizers, status conditions and leader election, for GitOps-managed network intent.
• netpred CLI, scriptable end to end.
• Enterprise identity: OIDC, SAML and LDAP sign-in, and tenant views. On Paqtra's roadmap, shipping in PacketWolf.
• SIEM export and remote-access audit.
• SASE-adjacent APIs: ingress and egress security overviews, structured egress-gateway management and Hubble-to-policy drafts.

9. Consoles for every kind of workload

• KubeVirt VMs: serial console and VNC in the browser, NIC binding control, and VM network context next to pods.
• In-browser shell into pods and containers.
• Non-Kubernetes containers. A lightweight node agent surfaces podman, docker and containerd containers as first-class workloads.
• Expose and de-expose ports on demand, and block/allow enforcement per workload (nftables for non-Kubernetes containers).

Which one should I use?

Choose Paqtra when…	Choose PacketWolf when…
You run Cilium and want to see flows, drops and policy verdicts	You need to know which process opened a connection
You are evaluating, learning or running a lab	You are running production workloads that need detection and containment
Apache 2.0 and community support are enough	You need vendor support and a commercial license
You apply policy yourself, through Cilium	You want the platform to draft, simulate, enforce and roll back for you
One team, one cluster, JWT sign-in	SSO, multiple tenants, audit and SIEM requirements
Kubernetes pods only	VMs and standalone containers share the network

What to expect

Some PacketWolf features are opt-in, and they are documented that way: custom eBPF probes need CAP_BPF, L7 detectors such as DGA stay inert until deep inspection is enabled for a workload (so they never false-alarm on L3/L4-only clusters), and the Zyra LLM and agent modes are off until you configure them. High-impact containments are approval-gated by default.

Talk to us

PacketWolf is licensed by ZyvorAI Labs. For a demo, a trial or pricing, contact sales@zyvor.dev or visit zyvor.dev.

See also: features.md for what Paqtra ships today, and cilium-brotherhood.md for the boundaries Paqtra keeps.