Everything the Zedmos engine does, laid out on one page.
Each capability below has a dedicated deep dive with architecture notes and, where relevant, benchmark numbers. Click any card to read more.
Pick any block. It runs on the same pipeline.
Each capability below is a live feature of the engine, documented and deployable today. Click any card for the deep dive — architecture, config snippets, and benchmarks.
Shared-memory packet rings bypass the kernel socket path. ~14 Gbps on a single core.
SNI extraction, full client and server fingerprinting, forward-proxy bumping with a short-lived CA.
200+ application protocols, category pairs, encrypted traffic heuristics — all on the fast path.
allow / drop / reset / shape / redirect / quarantine / tarpit / scan / rewrite / exec / mark / escalate / route / log.
Steer any app / category / SNI / user / geo out of any egress — a second WAN, a WireGuard, OpenVPN or GRE tunnel, or a plain NIC.
IP, domain, URL, and TLS-fingerprint blocklists. Suffix-trie matching. Atomic hot-swap via control socket.
AD DC agent, Azure Graph pull, SCIM hook, ARP/DHCP fingerprinting. Per-flow user tags.
A device is enrolled against your directory, granted named applications with their ports at the hub, re-checked on a deadline, and judged on what your Intune or CrowdStrike says about the machine.
ICMP / DNS / HTTP probes every 5 s, one score per uplink; a flow leaves a failing link on the next cycle. Hysteresis-aware.
SIGHUP and UNIX-socket commands swap policies, feeds, and routes with zero packet loss.
Protocol-aware payload reassembly across web, mail, and file-sharing traffic with content-type inference and per-flow deduplication.
Block or downgrade encrypted bypass paths per policy. 90% QUIC, 85% DoT effective.
Hub-and-spoke, a hub pair with automatic failover, direct tunnels between the spokes that need them, or full mesh up to eight sites — drawn on the console canvas, written to both ends of every tunnel.
Kernel driver patched so encrypted overlay peers can join the same fast path. Opt-in on bare-metal deployments; standard SASE still defaults to the kernel socket path.
Lock-free shared-memory ring into a dedicated writer daemon. File, syslog, SQLite, and Elasticsearch sinks today — with write-ahead log, circuit breaker, and adaptive sampling under load.
Intel 1/10 GbE multi-queue, NIC preflight, CPU affinity — 10× cache-miss reduction.