Engineering Lab · Native systems engineering
Native architecture. Measurable engineering improvements.
A network-visibility application whose Python collector was replaced with Rust and whose Electron interface is being replaced with a native Rust desktop. Documented five-minute Linux comparisons measured 96.87% lower average CPU and 86.57% lower mean resident memory for the complete application, under the published conditions.
The native desktop, as rendered.
Actual renders of the native application's framebuffer, showing an entirely fictional dataset from a documented fixture. Switch theme, and open the detail view of the connection graph.
Actual native framebuffer, not a composited desktop capture. Fixture: examples/gallery_fixture.rs, using 192.0.2.0/24, 198.51.100.0/24, .example only; no personal data. native-light.png · 1440 × 1040
· SHA-256 cab8d923f65b0b3afe3d9c667655737753dac14bf67e68b9d87619721f2a1708native-dark.png · 1440 × 1040
· SHA-256 e022574d7afe5238a54c1d652b37ada8616056ddbbb5359bd649d0ab40fb5f86
Gallery provenance and reproduction
Architecture makes the difference.
See how Genyra's native reconstruction performed against the original application in documented Linux resource comparisons. Lower resource use under these conditions; not a claim of equal functionality or higher frame rates.
Complete applicationDesktop open, graph view, including every collector, frontend and helper process.
Exact values and build identities
| Measurement | Original | Native | Reduction |
|---|---|---|---|
| Average CPU | 324.33% | 10.16% | 96.87% |
| Mean summed RSS | 1279.49 MiB | 171.89 MiB | 86.57% |
| Mean summed PSS | 755.24 MiB | 113.77 MiB | 84.94% |
| RSS at start | 1221.71 MiB | 162.80 MiB | |
| RSS at end | 1314.68 MiB | 181.23 MiB | |
| Highest sampled RSS | 1316.69 MiB | 183.23 MiB |
Original Snitch 1.6.4 at 062f2a8, Electron 44.9.1. Native desktop 0.1.0-alpha.5 at 375ce8c; collector 0.1.0-alpha.2 at c120556. Host: Intel Core i9-14900K, 32 logical CPUs, NVIDIA GeForce RTX 4080 SUPER.
Method, provenance and limitsfull report
Test conditions
- Linux x86-64, Intel Core i9-14900K (32 logical CPUs), NVIDIA GeForce RTX 4080 SUPER.
- 300-second sample after a 45-second warm-up, one sample per second, concurrent real traffic on the same interface.
- Native source commit 375ce8c; original Snitch 1.6.4 at 062f2a8, Electron 44.9.1.
- Both windows 1440 × 1040 logical pixels, dark mode, English, graph view; collectors had CAP_NET_RAW only.
- Capture policies differ: native non-promiscuous 4,096-byte IPv4/IPv6/ARP; original promiscuous 65,535-byte IPv4/IPv6.
What the figures do not establish
- Measured resource consumption under the documented conditions. Not proof of equal application performance, identical functionality or higher rendered frame rates.
- The native desktop ran a lower update cadence (38.16 callbacks a second against Electron's 116.39); the CPU result is not normalised to equal rendering.
- Feature parity is incomplete and capture configurations differ. Linux measurements do not transfer automatically to Windows or macOS, where native builds pass CI but live capture and privileged features remain under validation.
- A Linux alpha, not an enterprise-ready commercial security product. Some privileged and advanced functions remain incomplete.
01 / THE CASE
Why this case matters.
Snitch by aiXis Studio shows what applications on a machine connect to: a live connection graph, per-process attribution, device discovery, alerts and firewall controls. Its original architecture is a Python collector and an Electron interface. Genyra's fork replaces the collector with Rust and the interface with a native Rust desktop on egui and OpenGL, with Tokio for the collector's runtime, libpcap capture and local SQLite storage.
It is in the Lab because it extends the practice beyond legacy business systems into native application architecture, operating-system integration, network inspection and measured performance, and because the measurement method is published with the numbers.
02 / STATUS
Current status, stated plainly.
The published application is a Linux x86-64 alpha. The native desktop has Genyra light and dark themes and eight languages for navigation and the main overview; some advanced descriptions and collector messages remain in English. Windows and macOS have experimental native adapters: builds and synthetic service-lifecycle tests pass in CI, which does not establish live capture or privileged feature parity there. Some privileged and advanced functions remain incomplete, and development continues.
03 / BOUNDARY
The boundary of the claim.
The resource figures describe consumption under the documented conditions: the same Linux host, concurrent real traffic, five minutes after warm-up, every process in each application counted. The two applications have different capture configurations and incomplete feature parity, the native desktop ran a lower update cadence, and both applications' memory grew during the window. None of this is hidden in the exhibit, and none of it supports a claim of equal functionality, higher frame rates or a universal speed-up.
Inspect the evidence.
Each view answers one question: what was shown, how, what Genyra built, the numbers, what has not been established, where the code is and how to run the same check yourself.
Native architecture. Measurable engineering improvements.
A network-visibility application whose Python collector was replaced with Rust and whose Electron interface is being replaced by a native Rust desktop, with documented five-minute Linux resource comparisons against the original.
Original work: aiXis Studio, AGPL-3.0, retained with upstream notices. Rust implementation and evidence: Genyra LLC. Status: Linux x86-64 alpha · native desktop 0.1.0-alpha.5.
Two separate five-minute Linux cohorts after a 45-second warm-up, sampled once per second with concurrent real traffic on the same interface: the collector alone, and the complete application with every frontend, collector and helper process counted. CPU uses one logical core as 100%.
Standards used on this project
- Real runtime measurement
- Synthetic tests
- CI build success
- Experimental platform support
Recorded test conditions
- Linux x86-64, Intel Core i9-14900K (32 logical CPUs), NVIDIA GeForce RTX 4080 SUPER.
- 300-second sample after a 45-second warm-up, one sample per second, concurrent real traffic on the same interface.
- Native source commit 375ce8c; original Snitch 1.6.4 at 062f2a8, Electron 44.9.1.
- Both windows 1440 × 1040 logical pixels, dark mode, English, graph view; collectors had CAP_NET_RAW only.
- Capture policies differ: native non-promiscuous 4,096-byte IPv4/IPv6/ARP; original promiscuous 65,535-byte IPv4/IPv6.
What Genyra engineered
- A native Rust collector (Tokio, libpcap capture, local SQLite in WAL mode) compatible with the upstream REST and WebSocket contracts.
- A native Rust desktop on egui/eframe with OpenGL rendering: live connection graph, offline map, alerts, traffic history, Genyra light and dark themes and eight languages for navigation and the main overview.
- Native service integration: a Linux systemd user service, with experimental launchd and Windows SCM adapters and synthetic lifecycle tests on macOS and Windows CI.
- A published measurement method and a Rust process sampler, so the resource comparison can be repeated.
Figures are read from the repository's evidence file at build time; every label states which standard produced it. Figures of different standards are never combined.
- Measured resource consumption under the documented conditions. Not proof of equal application performance, identical functionality or higher rendered frame rates.
- The native desktop ran a lower update cadence (38.16 callbacks a second against Electron's 116.39); the CPU result is not normalised to equal rendering.
- Feature parity is incomplete and capture configurations differ. Linux measurements do not transfer automatically to Windows or macOS, where native builds pass CI but live capture and privileged features remain under validation.
- A Linux alpha, not an enterprise-ready commercial security product. Some privileged and advanced functions remain incomplete.
The full list is in the published report.
- Genyra repository · Genyra Snitch, Rust implementation and harness
- Original project · Snitch by aiXis Studio, AGPL-3.0, retained with upstream notices
- Verification evidence · machine-readable results
- Report · decisions, conditions and limitations
- Native source measured ·
375ce8cb4ef0 - GitHub Actions · the same verification on every push
Latest verification run passed · 2026-11-04 · 4b968b0· run
cargo build --release --locked --manifest-path desktop/Cargo.toml --bin genyra-resource-probe ./desktop/target/release/genyra-resource-probe \ --pids PYTHON_PID,RUST_PID --seconds 300 --interval 1 > samples.csv
Start fresh isolated collectors with equivalent data, settings and capture permissions, confirm both receive packets, allow a warm-up, then sample for at least five minutes. The published CSV and JSON files hold every per-second sample and build identity. Instructions in the repository.
- Native application architecture
- Operating-system integration
- Network capture
- Bounded async runtime
- Local storage
- Resource measurement
- Profiling
- Architectural optimisation
Questions we are asked.
Short answers in the same terms as the page. Anything specific to your systems is agreed by enquiry.
- Are the screenshots real?
- They are actual renders of the native application's framebuffer at version 0.1.0-alpha.5, showing an entirely fictional dataset generated by a documented fixture that uses reserved example addresses and names. They are not captures of real network activity, and their SHA-256 hashes are published in the repository.
- Does lower CPU mean the native application is faster?
- Not by itself. CPU time and memory are resource measurements. The report also records that the native interface ran fewer update callbacks a second than Electron, that capture policies differ and that feature coverage is incomplete. Throughput, rendered frame rate and input latency were not measured.
- Is Genyra Snitch a product Genyra sells?
- No. It is an independent AGPL-3.0 fork maintained by Genyra as a public example of native systems engineering, at Linux alpha maturity. It is not an official upstream release and not an enterprise-ready commercial security product.
Discuss native development
From an unanswered question
to an engineered possibility.