How fleptor/cipher works
CIPHER is a network-security router with an eBPF packet-filtering agent and a cloud control plane. The router inspects traffic, reports telemetry, and receives policy or device-state commands over a WebSocket; the server exposes user, network, and device management APIs and can request AI threat analysis. The README is only a project description, so capabilities and connections here are grounded in sampled source and the source index; unsampled implementation details are not expanded.
Main entry points: handlers.rs Network and device handlers · src/main.rs HTTP and WebSocket server · src/main.rs Router daemon · kernel_space.c eBPF packet filter
Components 17
Packet inspection
- eBPF packet filter
ROUTER/ebpf/src/kernel_space.c - Packet data definitions
ROUTER/ebpf/src/shared_defs.h
Router agent
- Router daemon
ROUTER/daemon/src/main.rs - Router message schema
ROUTER/daemon/src/router_generated.rs - Telemetry fallback store
ROUTER/daemon/src/main.rs
Cloud control plane
- HTTP and WebSocket server
Server/src/main.rs - Network and device handlers
Server/src/handlers.rs - Authentication
Server/src/auth.rs - Domain models
Server/src/models.rs - Control-plane database
Server/src/main.rs - Shared message schema
Server/src/router_generated.rs
Threat intelligence
- Statistical anomaly detection
Server/src/ai.rs - LLM supervisor
Server/src/ai.rs
Other components
- Network operator
- Managed devices
- OSINT feeds
- Anthropic API
Connections 19
- Managed devices → eBPF packet filter: sends traffic
ROUTER/ebpf/src/kernel_space.c - eBPF packet filter → Packet data definitions: uses structures
ROUTER/ebpf/src/kernel_space.c - Router daemon → eBPF packet filter: loads eBPF
ROUTER/daemon/src/main.rs - Router daemon → Router message schema: encodes telemetry
ROUTER/daemon/src/main.rs - Router daemon → Telemetry fallback store: stores failed reports
ROUTER/daemon/src/main.rs - Router daemon → HTTP and WebSocket server: connects by WebSocket
ROUTER/daemon/src/main.rs - HTTP and WebSocket server → Network and device handlers: routes requests
Server/src/main.rs - HTTP and WebSocket server → Control-plane database: initializes database
Server/src/main.rs - HTTP and WebSocket server → Authentication: initializes secrets
Server/src/main.rs - Network and device handlers → Authentication: checks credentials
Server/src/handlers.rs - Network and device handlers → Domain models: uses domain types
Server/src/handlers.rs - Network and device handlers → Control-plane database: reads and updates
Server/src/handlers.rs - Network and device handlers → Shared message schema: builds responses
Server/src/handlers.rs - Network and device handlers → LLM supervisor: requests verdict
Server/src/handlers.rs - LLM supervisor → Anthropic API: requests analysis
Server/src/ai.rs - HTTP and WebSocket server → Statistical anomaly detection: refreshes threat intel
Server/src/main.rs - Statistical anomaly detection → OSINT feeds: fetches threat feeds
Server/src/ai.rs - Network operator → HTTP and WebSocket server: uses management API
- Router daemon → Shared message schema: shares message format