Start where the problem happens.
Diagnostics live in the same client as VPN, ZTNA, RBI, and PQC. Associate observations with the active tunnel, device, resource, and observation window.
Meet the unified clientANTARA / AGENTIC PACKET AUDITINGFrom “it won’t connect”
From “it won’t connect”
to here’s the evidence.
Start with the employee’s experience. Follow the connection. Give your team an explanation they can act on.
Read the architectureCHOOSE AN INVESTIGATION Interactive demo · Synthetic evidence
Investigation workspaceINV / TLS / 001
INVESTIGATION FINDING5 evidence sources
The connection opens. TLS does not complete.
DNS and TCP succeed, but no TLS response is observed before the 30-second timeout. Two internal comparison connections complete.
AssessmentDestination-specific failure suspected
What the evidence establishes
- DNS resolved the destination in 14 ms; TCP established in 38 ms.
- One ClientHello and two retransmissions were observed. No corresponding TLS response was captured.
- Two other internal destinations completed TLS during the same observation window.
What remains open
Client-side evidence cannot establish whether the origin received the ClientHello, or whether a gateway, path issue, or server caused the silence.
RECOMMENDED NEXT STEP
Correlate the destination, time window, and session with gateway inspection events and origin TLS logs. Check SNI policy and destination-specific routing.
Administrator review · No automated policy changeONE CLIENT. A CONNECTED INVESTIGATION.The context makes
The context makes
the difference.
Packet timing explains what happened on a connection. Identity, browser, and policy evidence help explain why.
An explanation with provenance.
Compare healthy and affected flows, correlate authorized sources, and distinguish measured facts from hypotheses. Every next step starts with evidence.
Explore the audit capabilityKeep the operator in control.
Review the finding, source records, and collection scope. Approve remediation through existing policy controls, with an auditable decision trail.
Explore administrator controlsA precise view of the connection.
Capture coverage depends on platform support and configured routes. TLS certificate and PQC negotiation details come from endpoint or gateway instrumentation. RBI events come from the remote session. These sources complement packet observations without pretending encrypted application content is visible.