snflabsio

SNF Labs builds passive network forensics tooling for environments where cloud-based security solutions are not an option.

Our flagship product — SNF (Shadow Network Fingerprinting Engine) — is a deterministic, offline-first packet analysis engine written in Rust. Designed from the ground up for:

• 🏭 ICS/SCADA networks — Modbus, DNP3, S7comm, EtherNet/IP, PROFINET support
• 🔒 Air-gapped environments — zero network calls during analysis, ever
• 🔬 Forensic investigations — SHA-256 identical output on every run, on any OS
• 🏛️ Critical infrastructure — passive visibility with no active scanning, no agents

SNF-Core is the open source protocol analysis layer of the SNF engine. Complete and production-ready as a standalone tool.

$ snf-core --forensic --pcap-file capture.pcap

[SNF] Loaded 52 IOC IPs, 28 IOC domains
[SNF] Loaded 50 JA3 fingerprints (50 with threat actor)

  IOC hits       : 23   ← C2 IPs matched offline
  Threat matches : 52   ← malicious JA3/JA4 fingerprints
  Parse errors   : 0

Most network analysis tools require cloud connectivity, produce non-reproducible output, or have no ICS/SCADA protocol support.

SNF is different:

Deterministic — F(dataset, config, version) → identical NDJSON output
Same PCAP + same config + same binary = SHA-256 identical results. Every time. On any OS.

Offline-first — All threat intelligence loaded from local CSV files at startup. No API keys. No subscriptions. No external lookups during analysis.

ICS/SCADA native — Protocol support for Modbus, DNP3, Siemens S7comm, EtherNet/IP, PROFINET, LLDP, and CDP. Built for industrial network visibility.

Commercial inquiries, partnerships, or enterprise deployment:

📧 snflabs.io@gmail.com
🐦 @snf_labs