Live Traffic View
Logs tell you what happened. This tells you what is happening — a terminal view of fingerprints, traffic and threat data as the agent sees them, and a way to ask a running agent about one specific connection.
It is the fastest way to answer "is this thing actually working?" during a deployment, and "what is that client?" during an incident.
The terminal view
Synapse ships an interactive terminal interface. It renders live JA4+ fingerprints, traffic, and threat context — no dashboard, no browser, no shipping logs somewhere first.
There are two ways to run it:
| Mode | Command | What it does |
|---|---|---|
| Embedded | synapse --mode agent --terminal | The view runs in the same process as the agent |
| Standalone | synapse --terminal | Connects to an already-running daemon over a local socket |
Standalone is the one you usually want in production: the agent keeps running untouched, and you attach a viewer to it and detach again. Embedded suits a laptop or a test box where you are starting the agent anyway.
The transport differs by platform — a Unix domain socket on Linux and macOS, a loopback TCP address on Windows — but the view is the same.
Asking about one connection
The same interface answers direct questions: give a running agent a connection's four-tuple and it returns the fingerprints, SNI, ALPN and TLS version it captured for it. That is a programmatic interface rather than a view, so it has its own page — see EventBridge.
Limits worth knowing
- It is a live view, not history. The terminal shows what is happening now, and the query answers from a cache of recent connections. For anything retrospective, use Security Event Export.
- The cache is bounded. A connection old enough to have been evicted will not be found.
- Attaching a viewer is an operator action. It is not a substitute for monitoring — nobody is watching a terminal at 3am.
Use cases
- Verify a deployment in seconds — start the view, generate traffic, watch fingerprints appear.
- Watch a rule take effect rather than waiting for a log pipeline to confirm it.
- Demonstrate what the agent sees to someone who does not believe fingerprinting works.
- Debug a client you cannot reproduce by watching it live instead of reconstructing it afterwards.
See also
- Security Event Export — the durable, machine-readable counterpart
- Configuration — socket paths and terminal mode settings
- JA4+ — what the fingerprints in the view mean
- Dendrite — the sensor producing them