Host & Reach
Sweeps a scope for live, reachable hosts at local or internet scale — the first layer of the map.
Nmap · Masscan · Arp-scanIf you're the one everyone asks "what's actually on our network?", you know how hard that is to answer. Trakorn keeps one clear, always-current map of your network — so instead of digging through a pile of tools, you just ask, and get the answer. It only ever looks at networks you own or are cleared to test.
Why we built this
Most network tools hand you a wall of text and forget it the moment you close the terminal. Trakorn keeps one living map of your network that you can talk to — so the next question takes seconds, not an afternoon.
"Something's talking to a server in the warehouse that shouldn't be."
Priya runs IT for a logistics firm with three sites. That Slack message lands at 9:02am. The old way: she opens four terminals, runs an Nmap scan, grabs a Tcpdump capture, cross-checks ARP, and hand-types notes into a doc. Forty minutes before she even knows what the host is.
With Trakorn, she opens the twin and types one question:
Two minutes. She has the host, its OS, its open port, and who it's calling — because every tool already wrote it to the same map. She spends the other thirty-eight minutes on the actual decision, not the gathering.
Not a faceless "enterprise." Specific people with the same Monday.
Three sites, no security team, no budget for a six-figure platform. Needs to know what's on her network and what changed, fast.
Drowning in tools that don't talk to each other. Wants one place where a finding in one tool informs the next.
Walks into a new network every week. Needs to map it, understand it, and hand over a clean report — repeatably.
New analysts learn the tools the hard way. Wants them practising on real cases without touching production.
"Did anything change on the finance VLAN this month?" → open your notes from three weeks ago (if you took any), re-scan, compare by eye, hope you remember what was there before. An hour, and you're not fully sure.
"Diff the finance VLAN against last month." → the twin already has both points in time. Two new hosts, one newly-opened port, highlighted. Ten seconds, and it's exact.
One suite · everything inside
Everything works together as one product — no juggling separate apps, no stitching tools together yourself. These are the five parts of Trakorn, and what each one does for you.
The six modules and all seven tools — Discover, Survey, Read, Resolve, Identify, Watch. The hands-on layer that gathers the map.
The living model every tool writes into: ask-the-network queries, time-travel replay, and the asset inventory. The single source of truth.
The intelligence over everything — correlates, summarizes in plain English, and ranks what deserves attention first.
Graded, sandboxed case practice built into the tool, so a team learns the suite on real scenarios without touching production.
Self-hosting, playbooks, scheduling, roles, the open API and integrations — the engine that runs it all and plugs into your stack.
The original idea
The seven tools don't each open their own terminal and dump text. They write into a single shared model — a digital twin of the network that is always the latest known truth. You stop reading output and start reading your network: ask it questions, scrub it back through time, and let the suite reason about it for you.
What makes it different
Plenty of tools put everything in one window. These four are the reasons Trakorn actually saves you time instead of adding another thing to check.
"Show every Windows host exposing SMB that wasn't here last week." Answered from facts the tools already gathered — no query syntax.
Scrub the whole network back to any past moment and diff two points in time — what appeared, moved, or opened.
Chain tools into named, reusable routines with approval gates, so a job runs the same way every time.
Intelligence reading across all tools at once: correlates, flags what stands out, explains findings in a sentence.
Architecture · field work
Each part has one clear job — find what's out there, see what's open, read what's happening — and quietly writes it all to your map so you don't have to.
Sweeps a scope for live, reachable hosts at local or internet scale — the first layer of the map.
Nmap · Masscan · Arp-scanTurns live hosts into a service inventory: open ports, what's listening, version banners where offered.
NmapCaptures and analyzes packets on an interface with filters and a readable timeline, not raw dumps.
TcpdumpEnumerates DNS records and the name surface of a domain you administer, mapped onto the host list.
DNSReconInfers operating systems passively from observed traffic, so every asset carries a platform guess.
p0f · NmapA monitored view of a segment on your own network for troubleshooting and authorized testing, with a clear on-air indicator.
BettercapYou're not limited to these six. Any tool you already rely on that can hand off its results can plug in and write to the same map — so the suite grows with you instead of boxing you in.
Open plugin interfaceHere's the point of all six: whatever each one finds, it writes to the same living map. You're never piecing the answer together from six different windows again.
The living mapMapping
Each keeps its own engine; the suite gives it a home, a shared target list, and one twin to write into.
| Tool | Module | What it writes to the twin |
|---|---|---|
| Nmap | Discover · Survey · Identify | Live hosts, open ports, service and version detail, active OS guesses. |
| Masscan | Discover | Fast, wide-range presence sweeps across large scopes before the detailed pass. |
| Arp-scan | Discover | Local-segment devices by hardware address — the ground-truth layer. |
| Tcpdump | Read | Filtered packet captures feeding the traffic timeline and exports. |
| p0f | Identify | Passive OS fingerprints from observed packets — no probes sent. |
| DNSRecon | Resolve | DNS records and name-surface for domains under your control. |
| Bettercap | Watch | Live session data for troubleshooting and authorized testing on owned segments. |
Automation
Save a sequence once and re-run it as one named action. Approval gates stop the suite before anything active or sensitive.
The smart layer
Sense reads results across all seven tools at once, so a finding in one place informs the next move everywhere else.
Stitches ARP entry, open ports, OS fingerprint, DNS names and traffic into a single living profile.
After a sweep it proposes the sensible follow-up — a deeper survey, a capture on an odd service — in plain words.
Turns raw output into a readable brief: what's on the network, what changed, what deserves a human's eye.
Scores hosts and services by how far they sit from your known baseline, so the top of the list is where to look.
Learn as you go
The best DFIR practice platforms — CyberDefenders, HTB Sherlocks, Blue Team Labs, LetsDefend, Malware-Traffic-Analysis, Root-Me, DFIR Madness — all teach the same way: give someone a self-contained case, let them investigate end to end, then grade the answer. Range borrows that model and runs it inside Trakorn, on a sandboxed twin, so practice never touches a live network.
Self-contained scenarios with questions and a graded answer key — the CyberDefenders / Sherlocks model.
Alert-driven exercises in the LetsDefend / Blue Team Labs spirit: triage and decide the response.
Malware-Traffic-Analysis-style capture puzzles opened straight in the Read module.
A multi-stage narrative case (DFIR-Madness style) threading every module together.
Root-Me-style ladders per module, from first host sweep to full incident.
Assign cases, see scores, run a shared drill — onboarding without touching production.
How it's built
Designed to self-host inside your own walls first — your network data never has to leave — then to scale the same stack for customers.
Small collectors run the real tool binaries on a segment and stream results up. Run one on a laptop for a site visit, or many across locations. They do the work; they hold no long-term data.
A time-versioned datastore of every host, service, name and capture — the single source of truth that powers queries, diffs and replay. Self-hosted on your box, or a managed cloud instance for customers who want it.
Enforces the authorization scope on every action, runs playbooks and schedules, and hosts the Sense reasoning layer. Everything it does lands in the audit trail.
A web console for people, a CLI for scripts, and a documented API so the twin plugs into what you already run — SIEM, ticketing, asset databases, CI.
Docker/compose and a single-binary option for internal use; a managed multi-tenant cloud for the commercial editions.
Push findings to a SIEM, open tickets on drift, sync assets to your CMDB, trigger playbooks from CI or a webhook.
A plugin interface so the seven tools become dozens — any CLI that writes structured output can feed the twin.
Role-based access, SSO/SAML for teams, per-project scoping, and a full who-did-what trail for compliance.
The problems it solves
If any of these sound like your week, here's what Trakorn does about it.
Trakorn keeps one always-current map of every device, so you finally have a single picture you can trust — not guesses and a stale spreadsheet.
It quietly tracks your network over time, so you can see exactly what appeared, moved, or opened since last week — in seconds, not an afternoon.
The tools you already trust all write to the same place, so you stop copy-pasting between windows and just ask one question.
Built-in practice cases let your team learn on a safe copy of a real network, so they're pulling their weight sooner — without touching production.
How it works
No big setup project. You're up and answering questions the same day.
Tell Trakorn which networks you're allowed to look at. It will never touch anything outside them — that line is built in, not a setting you can forget.
It runs the tools for you and builds one living map of what's there — devices, open ports, names, and operating systems.
Ask your network questions in plain words, rewind it through time, and let it flag what deserves a look. From then on the map keeps itself up to date.
How we're different
Here's where Trakorn sits next to tools you might already know.
Tools like runZero or Axonius tell you what's on your network. Trakorn does that too — and adds the hands-on tools, the plain-language answers, and the team training, all in one place.
Scanners like Nessus hunt for weaknesses. Trakorn is about understanding your network first — what's on it and what changed — with issues flagged along the way, not a wall of findings to wade through.
The usual way is seven terminals and a notes file you keep forgetting to update. Trakorn gives those same trusted tools one home, one shared map, and one place to ask.
Who can use it
The common thread is simple: lots of devices, limited visibility, and a duty to stay secure. Anyone who owns a network they're responsible for can run Trakorn on it — these are the groups that get the most out of it.
Business · pricing
Open-core: a free Core you run internally, paid tiers that add the intelligence, training and scale. These are proposed numbers to pressure-test, not final — set below the big enterprise scanners so a small team can actually say yes.
Your own team, one site · up to 100 nodes
A working IT or security team · up to 1,000 nodes
Teams that want the brain and the range · up to 5,000 nodes
Multi-site orgs & providers · unlimited nodes · priced to your estate (typically from ~$18k/yr, 25 seats)
The three levers that make the Pro upgrade obvious: how much you can see (nodes), how far back (history), and how much intelligence and training you get.
| Feature | Core | Team | Pro | Enterprise |
|---|---|---|---|---|
| Active asset cap | 100 nodes | 1,000 nodes | 5,000 nodes | Unlimited / custom |
| Data history depth | 7 days | 30 days | 1 year · full time-travel | Custom / unlimited |
| Sense AI queries | — | — | 500 / user · mo | Unlimited · dedicated API |
| Range training | Baseline | Baseline | Full catalog + monthly drops | Custom team paths |
| Deployment & tenancy | Single instance | Cloud hosted | Cloud / single-tenant | Multi-tenant / on-prem |
| Data residency | — | — | — | Region-locked |
Fresh graded cases every month, team-wide — keeps training current without building it yourself.
We run the twin store for you, for teams that don't want to self-host. Scales with data volume.
Sense is the one feature with a real per-use cost (the AI calls). These limits keep it from eating your Pro margin without getting in a real user's way.
Soft cap on Pro. Past it the user drops to a slower lane or adds a query pack — never a hard lockout mid-investigation.
Per-user burst limit stops a script from firing thousands of queries and running up the bill.
Sense answers only from your own twin — no open-ended external calls — so cost per query stays bounded and predictable.
Each query sends a bounded slice of the twin and caps answer length, keeping token cost per call flat.
Identical or near-identical questions in a short window are served from cache instead of re-running the model.
A cheap model handles routine summaries; the premium model runs only on complex reasoning — so most queries cost little.
Internal first, public later
Prove it on your own networks, then package what already works.
Stand up Core self-hosted, wire in the seven tools, build the twin for our real scopes. Use it daily; log what's missing. No selling yet — this is the proving ground.
Scope guard, audit trail, roles, scheduling and drift alerts solid. Add Sense on top of real data so its summaries are trustworthy. Write the first Range cases from our own incidents.
Invite a few friendly teams / MSSPs onto Team and Pro. Charge a little, listen hard, fix the rough edges, confirm the pricing bands hold.
Release free Core publicly, open Team/Pro sign-up and the Range subscription, line up MSSP/Enterprise deals. Growth loop: free Core in, paid upgrade out.
Before it goes public · must-haves
A tool that maps networks and captures traffic carries real responsibility. These are not optional for a sellable security product.
Declared, enforced scope and approval gates on active steps are core, not a setting — the defensible line between admin tool and misuse.
Packet captures and host data may include IPs and personal data. Retention limits, redaction, and a lawful-basis stance are needed before public sale (GDPR and equivalents).
Self-host and regional hosting so customers in the EU, UK and elsewhere keep network data in-region — a buying requirement for many.
Review export-control and dual-use considerations, publish an acceptable-use policy, and gate higher-risk capabilities behind verified, authorized use.
Next