# kvvvvvvvvv/nta architecture

> Architecture diagram of the GitHub repository kvvvvvvvvv/nta, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/kvvvvvvvvv/nta
- Repository: https://github.com/kvvvvvvvvv/nta

## Overview

NTA is a full-stack live network-monitoring application. A user selects an interface and starts capture; the Flask backend sniffs and analyzes packets, checks for anomalies and threats, then streams updates for dashboard visualization. Users can also inspect network and threat-intelligence analytics and export capture sessions. The README documents feature extraction, SQLite/session logging, and replay/export; sampled backend excerpts are partial, so finer internal call wiring is not asserted.

Main entry points: [`frontend/src/components/CyberDashboard.jsx`](https://github.com/kvvvvvvvvv/nta/blob/main/frontend/src/components/CyberDashboard.jsx) (Cyber dashboard), [`backend/app.py`](https://github.com/kvvvvvvvvv/nta/blob/main/backend/app.py) (Packet capture), [`frontend/src/App.jsx`](https://github.com/kvvvvvvvvv/nta/blob/main/frontend/src/App.jsx) (Application shell), [`frontend/src/components/ThreatIntelligence.jsx`](https://github.com/kvvvvvvvvv/nta/blob/main/frontend/src/components/ThreatIntelligence.jsx) (Threat intelligence)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_capture["Capture and Analysis"]
  node_capture["Packet capture<br/>[app.py]"]
  node_features["Packet analysis<br/>[app.py]"]
  node_anomaly["Anomaly detection<br/>[app.py]"]
end

subgraph group_intel["Network Intelligence"]
  node_threatcheck["Threat checks<br/>[app.py]"]
  node_analytics["Network analytics<br/>[app.py]"]
end

subgraph group_backend["Backend Services"]
  node_realtime["Live updates<br/>[app.py]"]
  node_sessiondata[("Session records<br/>[app.py]")]
end

subgraph group_frontend["Dashboard"]
  node_app["Application shell<br/>[App.jsx]"]
  node_dashboard["Cyber dashboard<br/>[CyberDashboard.jsx]"]
  node_session["Session controls<br/>[SessionCapture.jsx]"]
  node_live["Live traffic"]
  node_charts["Traffic charts<br/>[CyberCharts.jsx]"]
  node_anomalyui["Anomaly view"]
  node_threatui["Threat intelligence"]
  node_flagged["Flagged IPs<br/>[FlaggedIPs.jsx]"]
  node_masked["Masked IPs"]
end

node_operator(("Network operator"))
node_scapy["Scapy packet source"]
node_abuseipdb["AbuseIPDB"]

node_operator -->|"uses"| node_app
node_app -->|"renders"| node_dashboard
node_app -->|"starts capture"| node_capture
node_capture -->|"sniffs packets"| node_scapy
node_capture -->|"passes packets"| node_features
node_features -->|"classifies traffic"| node_anomaly
node_features -->|"checks IPs"| node_threatcheck
node_threatcheck -.->|"queries"| node_abuseipdb
node_capture -->|"records session"| node_sessiondata
node_features -->|"supports analysis"| node_analytics
node_anomaly -->|"publishes alerts"| node_realtime
node_analytics -->|"publishes updates"| node_realtime
node_realtime -->|"streams updates"| node_dashboard
node_dashboard -->|"shows traffic"| node_live
node_dashboard -->|"renders insights"| node_charts
node_dashboard -->|"shows alerts"| node_anomalyui
node_dashboard -->|"opens intelligence"| node_threatui
node_threatui -->|"renders flagged IPs"| node_flagged
node_threatui -->|"renders masked IPs"| node_masked
node_session -->|"stops capture"| node_capture
node_session -->|"requests export"| node_sessiondata
node_app -->|"loads interfaces"| node_capture

click node_app "https://github.com/kvvvvvvvvv/nta/blob/main/frontend/src/App.jsx"
click node_dashboard "https://github.com/kvvvvvvvvv/nta/blob/main/frontend/src/components/CyberDashboard.jsx"
click node_session "https://github.com/kvvvvvvvvv/nta/blob/main/frontend/src/components/SessionCapture.jsx"
click node_live "https://github.com/kvvvvvvvvv/nta/blob/main/frontend/src/components/LiveTrafficTable.jsx"
click node_charts "https://github.com/kvvvvvvvvv/nta/blob/main/frontend/src/components/CyberCharts.jsx"
click node_anomalyui "https://github.com/kvvvvvvvvv/nta/blob/main/frontend/src/components/AnomalyDetection.jsx"
click node_threatui "https://github.com/kvvvvvvvvv/nta/blob/main/frontend/src/components/ThreatIntelligence.jsx"
click node_flagged "https://github.com/kvvvvvvvvv/nta/blob/main/frontend/src/components/FlaggedIPs.jsx"
click node_masked "https://github.com/kvvvvvvvvv/nta/blob/main/frontend/src/components/PrivacyMaskedIPs.jsx"
click node_capture "https://github.com/kvvvvvvvvv/nta/blob/main/backend/app.py"
click node_features "https://github.com/kvvvvvvvvv/nta/blob/main/backend/app.py"
click node_anomaly "https://github.com/kvvvvvvvvv/nta/blob/main/backend/app.py"
click node_threatcheck "https://github.com/kvvvvvvvvv/nta/blob/main/backend/app.py"
click node_analytics "https://github.com/kvvvvvvvvv/nta/blob/main/backend/app.py"
click node_realtime "https://github.com/kvvvvvvvvv/nta/blob/main/backend/app.py"
click node_sessiondata "https://github.com/kvvvvvvvvv/nta/blob/main/backend/app.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_capture,node_features,node_anomaly toneBlue
class node_threatcheck,node_analytics toneAmber
class node_realtime,node_sessiondata toneMint
class node_app,node_dashboard,node_session,node_live,node_charts,node_anomalyui,node_threatui,node_flagged,node_masked toneRose
class node_operator,node_scapy,node_abuseipdb toneIndigo
```

## Components

### Capture and Analysis

- [Packet capture](https://github.com/kvvvvvvvvv/nta/blob/main/backend/app.py): `backend/app.py`
- [Packet analysis](https://github.com/kvvvvvvvvv/nta/blob/main/backend/app.py): `backend/app.py`
- [Anomaly detection](https://github.com/kvvvvvvvvv/nta/blob/main/backend/app.py): `backend/app.py`

### Network Intelligence

- [Threat checks](https://github.com/kvvvvvvvvv/nta/blob/main/backend/app.py): `backend/app.py`
- [Network analytics](https://github.com/kvvvvvvvvv/nta/blob/main/backend/app.py): `backend/app.py`

### Backend Services

- [Live updates](https://github.com/kvvvvvvvvv/nta/blob/main/backend/app.py): `backend/app.py`
- [Session records](https://github.com/kvvvvvvvvv/nta/blob/main/backend/app.py): `backend/app.py`

### Dashboard

- [Application shell](https://github.com/kvvvvvvvvv/nta/blob/main/frontend/src/App.jsx): `frontend/src/App.jsx`
- [Cyber dashboard](https://github.com/kvvvvvvvvv/nta/blob/main/frontend/src/components/CyberDashboard.jsx): `frontend/src/components/CyberDashboard.jsx`
- [Session controls](https://github.com/kvvvvvvvvv/nta/blob/main/frontend/src/components/SessionCapture.jsx): `frontend/src/components/SessionCapture.jsx`
- [Live traffic](https://github.com/kvvvvvvvvv/nta/blob/main/frontend/src/components/LiveTrafficTable.jsx): `frontend/src/components/LiveTrafficTable.jsx`
- [Traffic charts](https://github.com/kvvvvvvvvv/nta/blob/main/frontend/src/components/CyberCharts.jsx): `frontend/src/components/CyberCharts.jsx`
- [Anomaly view](https://github.com/kvvvvvvvvv/nta/blob/main/frontend/src/components/AnomalyDetection.jsx): `frontend/src/components/AnomalyDetection.jsx`
- [Threat intelligence](https://github.com/kvvvvvvvvv/nta/blob/main/frontend/src/components/ThreatIntelligence.jsx): `frontend/src/components/ThreatIntelligence.jsx`
- [Flagged IPs](https://github.com/kvvvvvvvvv/nta/blob/main/frontend/src/components/FlaggedIPs.jsx): `frontend/src/components/FlaggedIPs.jsx`
- [Masked IPs](https://github.com/kvvvvvvvvv/nta/blob/main/frontend/src/components/PrivacyMaskedIPs.jsx): `frontend/src/components/PrivacyMaskedIPs.jsx`

### Other components

- **Network operator**
- **Scapy packet source**
- **AbuseIPDB**

## Connections

- Network operator → Application shell: uses
- Application shell → Cyber dashboard: renders
- Application shell → Packet capture: starts capture
- Packet capture → Scapy packet source: sniffs packets
- Packet capture → Packet analysis: passes packets
- Packet analysis → Anomaly detection: classifies traffic
- Packet analysis → Threat checks: checks IPs
- Threat checks → AbuseIPDB: queries
- Packet capture → Session records: records session
- Packet analysis → Network analytics: supports analysis
- Anomaly detection → Live updates: publishes alerts
- Network analytics → Live updates: publishes updates
- Live updates → Cyber dashboard: streams updates
- Cyber dashboard → Live traffic: shows traffic
- Cyber dashboard → Traffic charts: renders insights
- Cyber dashboard → Anomaly view: shows alerts
- Cyber dashboard → Threat intelligence: opens intelligence
- Threat intelligence → Flagged IPs: renders flagged IPs
- Threat intelligence → Masked IPs: renders masked IPs
- Session controls → Packet capture: stops capture
- Session controls → Session records: requests export
- Application shell → Packet capture: loads interfaces