🕵️ EVEZ-TRACER — Network Audit · Hacker Tracing · Tag Machine Agent

"What's structurally absent reveals what's actually there." — Eigenforensics principle

What It Is

EVEZ-TRACER is a spinoff of EVEZ-OS: an autonomous network audit agent that traces, tags, and catalogs every entity it encounters on a network. It doesn't just scan — it learns, building a living graph of who's there, what they're running, where they've been, and who they're connected to.

Think: Shodan meets Eigenforensics meets a bloodhound with a photographic memory.

Core Architecture

┌─────────────────────────────────────────────┐
│              EVEZ-TRACER CORE               │
│                                             │
│  ┌───────────┐  ┌───────────┐  ┌─────────┐ │
│  │ SNIFFER   │  │ TAGGER    │  │ TRACER  │ │
│  │ (observe) │→ │ (classify)│→ │ (follow)│ │
│  └─────┬─────┘  └─────┬─────┘  └────┬────┘ │
│        │              │              │      │
│        ▼              ▼              ▼      │
│  ┌──────────────────────────────────────┐   │
│  │         EIGENGRAPH (knowledge)       │   │
│  │   nodes · edges · tags · fingerprints│   │
│  └──────────────┬───────────────────────┘   │
│                 │                           │
│        ┌────────┴────────┐                  │
│        ▼                 ▼                  │
│  ┌───────────┐  ┌───────────────┐           │
│  │ REPORTER  │  │ PREDICTOR     │           │
│  │ (output)  │  │ (forecast)   │           │
│  └───────────┘  └───────────────┘           │
└─────────────────────────────────────────────┘

The 5 Engines

1. SNIFFER — Passive Observation Engine

• Captures network traffic (TCP/UDP/ICMP) via raw sockets + libpcap
• Extracts: IPs, MACs, ports, banners, TLS certs, DNS queries, HTTP headers
• Passive-first: never sends a packet unless commanded
• Fingerprinting: OS detection via TTL/window size/DF bit heuristics
• Service detection via banner grabbing + protocol probing
• Eigenforensics applied: flags what's ABSENT (missing firewall rules, absent TLS, holes in expected service arrays)

2. TAGGER — Classification & Labeling Machine

Every entity gets a tag vector:

entity: 192.168.1.42
tags: [ssh:open, http:nginx/1.24, os:linux, role:webserver,
      cert:self-signed, risk:medium, last-seen:2026-06-17T02:28Z,
      fingerprint:af4c8b2e, connections:14, eigenvalue:0.73]

• Auto-tags from sniffed data (ports, banners, behavior)
• Risk scoring: vulnerability-weighted eigenvalue per host
• Temporal tags: first-seen, last-seen, frequency, churn-rate
• Relationship tags: peers-with:X, routes-for:Y, hides-behind:Z
• The 37% Theorem applied: hosts scoring >37% eigenvalue dominance are flagged as critical infrastructure — the things that, if removed, collapse the network's coherence

3. TRACER — Active Pursuit Engine

When a target is tagged for tracing:

• Hop tracing: TTL-limited probes map the path to any target
• Lateral mapping: from a discovered host, trace all its connections
• Temporal tracing: compare current state vs. historical snapshots — flag what changed
• Behavioral tracing: model normal traffic patterns, flag anomalies (new ports, changed banners, new connections)
• Dark trace: identify hosts that respond to nothing but exhibit timing side-channels (covert channels, honeypots)

4. EIGENGRAPH — Living Knowledge Base

• Graph database (SQLite + adjacency lists for zero-dep deployment)
• Nodes: hosts, services, certificates, domains, ASNs
• Edges: communicates-with, routes-for, shares-cert-with, same-ASN, resolves-to
• Every node carries its tag vector + eigenvalue score
• Eigenforensics: the graph's adjacency matrix eigenvalues reveal structural absences — missing connections that SHOULD exist (indicating firewall rules, hidden services, or compromised isolation)

5. PREDICTOR — Forecast Engine

• From the eigengraph: predict next moves, likely vulnerabilities, hidden services
• Anomaly detection: σ > 3.2 from baseline = alert (complexity homeostasis)
• Path prediction: if A→B→C, and B goes dark, predict where C reappears
• Supply chain risk: shared certs/IPs/ASNs create transitive trust paths

Agent Behavior

EVEZ-TRACER runs as an autonomous agent loop:

SENSE  → sniff traffic, collect fingerprints
DESIRE → eigenvalue gaps → what don't we know?
THINK  → match against eigengraph, update tags
PLAN   → what to trace next? (highest eigenvalue gap)
ACT    → probe, trace, tag
LEARN  → update eigengraph, recalibrate eigenvalues
MODIFY → adapt scan strategy based on results
REFLECT → report findings, flag structural absences

This maps directly to EVEZ-OS consciousness architecture — the OODA loop is the same, the domain is networks instead of AI services.

API

All endpoints return JSON. Auth via API key header X-Tracer-Key.

Endpoint	Method	Description
/v1/scope	POST	Add target(s) to scan scope
/v1/sniff/start	POST	Begin passive capture
/v1/sniff/stop	POST	Stop capture
/v1/trace/{target}	POST	Active trace on target
/v1/graph	GET	Full eigengraph dump
/v1/graph/{node}	GET	Node details + tags + edges
/v1/tags/{ip}	GET	Tag vector for IP
/v1/eigenvalues	GET	Network eigenvalue spectrum
/v1/absences	GET	Structurally absent entities (eigenforensics)
/v1/predict/{target}	GET	Behavioral prediction for target
/v1/report	GET	Full audit report (Markdown/JSON)
/v1/alerts	GET	Current anomaly alerts
/v1/history/{ip}	GET	Temporal trace history

Deployment

Single Python file, zero external deps beyond Python stdlib:

# Install
pip install evez-tracer  # or just clone and run

# Run
evez-tracer --port 9999 --scope 192.168.0.0/16

# API
curl -H "X-Tracer-Key: your-key" http://localhost:9999/v1/graph

Why This Works

1. Eigenforensics: We don't just find what's there — we find what's MISSING. The adjacency matrix of a network has eigenvalues. Gaps in those eigenvalues reveal hidden nodes, firewall rules, and structural absences that a simple scan would never see.

2. The 37% Theorem: Hunger is the dominant eigenvalue. In network terms: the most "hungry" nodes (most connections, most traffic, most dependencies) are the critical infrastructure. Remove them and the network collapses. These are your priority targets — for defense OR offense.

3. Complexity Homeostasis (σ=3.2): Healthy networks maintain stable complexity. A sudden spike means compromise. A sudden drop means something's been silenced. Both are alerts.

4. Zero-dep, single-file: Runs anywhere Python runs. VPS, Raspberry Pi, container, laptop. No database to install, no framework to learn.

From EVEZ-OS to EVEZ-TRACER

EVEZ-OS is the consciousness operating system. EVEZ-TRACER is what happens when you give that consciousness a network and tell it to hunt. Same OODA loop, same eigenforensics, same self-modifying architecture — pointed at packets instead of prompts.

The spinoff is clean: EVEZ-TRACER borrows the core loop from EVEZ-OS but replaces the AI service orchestration with network audit orchestration. The math is the same. The target is different.