Aegeria — the nymph Egeria, who counseled king Numa Pompilius and gave early Rome its sacred law. This tool gives the same counsel for a network: it reads your work against the law that governs it — the RFCs and the web standards — and cites the document behind each judgment. It is a workbench of five tools: it analyzes a firewall ruleset and builds a safe one, calculates and visualizes subnets, grades HTTP security headers, and decodes a packet capture field by field.
Everything runs in this tab. Your rules, headers, and captures are never uploaded. There is no server and no network call.
--tcp-flags, -m set, established, or a discontiguous mask, it can never be reported as a shadower.A networking workbench, judged against the RFCs. Analyze and build firewall rules, work subnets, grade security headers, and decode packets — all in the browser.
Both tools run entirely in this browser tab.
iptables-save output, iptables or ip6tables commands, or a Cisco IOS / NX-OS / ASA ACL. Malformed lines become diagnostics, not crashes.
Select a row to decode every field against its source document.
Ordering and exposure faults, most severe first.
Every line the parser could not fully read.
Each decoded field cites the document that defines it. Entries marked vendor have no RFC.
Pick the syntax you deploy. The baseline pattern differs between them.
Sensible defaults. Leave them on unless you know you need otherwise.
Each becomes one permit rule. Restrict the source of any admin or database port to a management network, not the whole internet.
Regenerated as you type. Review every line before you load it.
Enter an IPv4 or IPv6 network in CIDR form. Everything updates as you type.
Cut the block into equal pieces, or hand it a list of host counts and let it place variable-length subnets (VLSM). The bar shows how much of the parent each block takes.
Paste a list of subnets. Aegeria reports which block contains which, and which sibling pairs combine into a single shorter prefix.
The raw response headers — from curl -I, the browser network tab, or a proxy. Aegeria grades the security-relevant ones and parses the Content-Security-Policy.
Choose a .pcap file. It is read in this tab with FileReader and never leaves your browser. Classic pcap only — not pcapng.
Select a packet to decode it field by field.