CERNIS PRO follows a natural flow: first see what is there, then get to the bottom of something, record it, share it — all on the user’s terms. Here is the full feature set, organised into five areas.
Every functional area comes with built-in help in plain language — in German and English.
What is there and what is happening — scan, topology, traffic, monitoring, SNI.
The home screen sums up the state of the network at a glance: status, quick access, notes, new CVE matches and live metrics. The quick access is dynamic — it moves the functions the user opens most often to the front, with no configuration at all.
The heart of it: a scan searches the network for active devices, finds open ports and detects services and operating systems. Progress appears live. The result is a clear table — IP, MAC, vendor, host name, open ports, OS and response time for every device.
CERNIS cleanly separates facts (new, changed, new port) from judgements (unusual, critical). Both kinds of marking stay separate, so it is clear at once what has changed and how to weigh it — without one drowning out the other.
A port the user has checked and found harmless can be acknowledged. It disappears from the active warning but stays traceably logged. So no permanent warnings pile up, and the user’s assessments are not lost.
For every device: whether it is known, new or changed, which ports are open, how it fits into the network. It can be classified (trusted / neutral / watch) and annotated with the user’s own notes.
The network as a star-shaped picture: the gateway at the centre, devices around it. Solid lines are actually measured (via LLDP/CDP), dashed ones sensibly assumed. Show either just the devices from the last scan or every device ever known.
Shows which programs currently have connections to the network and how much data is flowing — organised by the application causing it. Updates run automatically or on demand, exactly as the user prefers.
On request, CERNIS resolves the bare IP addresses of remote peers into readable names — only on request, loaded in the background.
Passively captures which internet addresses the user’s programs contact — even over encrypted connections — and attributes them to the program responsible. It is visible where an app is talking without touching the content. The live data stays transient and disappears again. Anyone who wants to keep the host names derived from it switches on the recording of external contacts.
Lists running programs with their path and quietly points out when a program may be disguising itself as something else — a subtle but important hint at something unusual.
For anyone using a FRITZ!Box, the official TR-064 interface provides a rich detail view: connection data, DSL values, WLAN clients, the event log and configured port forwardings — all in one place, without clicking through the router menu.
Shows the machine’s network interfaces with their actual status and highlights the ones carrying the main traffic.
Continuously watches the reachability and response time of the detected gateways and of two preset internet references — Google Public DNS (8.8.8.8) and Cloudflare DNS (1.1.1.1) — and shows outages immediately, with a live chart and an optional audible signal. To do so, CERNIS sends its own check requests to those targets at short intervals. Users can add their own targets.
Records the reachability of a target over a chosen period, permanently. It runs only when deliberately set up and survives a restart — ideal for pinning down sporadic dropouts over hours or days.
A recording can raise an alert when a target becomes too slow or fails. The condition must hold several times in a row — no false alarm from a single outlier.
Get to the bottom of something — diagnostics, vulnerabilities, resolving remote peers.
Checks whether a name resolves correctly (DNS) and which path data packets take to a target (traceroute) — the classic diagnostic tools, presented so they make sense.
Shows the path to an internet target as a list of hops, each with country and network operator (ASN). On request the exact operator name can be loaded. So it is visible which countries and networks the user’s data travels through.
Shows the public IP address from the outside and checks whether a given port is reachable from outside — using an external helper service. Useful for understanding how the network looks from the internet.
Looks for devices handing out network addresses without permission. An unknown server of this kind can be a sign of a problem or an attack — CERNIS makes it visible.
Many services voluntarily reveal what they are when a connection is opened. This function fetches that banner to help place an open port in context.
Gathers facts about an IP address from several sources: name, network operator, country, certificate. Every detail is shown with its source, without judgement — the core principle in its purest form. The user gets the facts and decides for themselves.
Continuously cross-checks the detected services of the known devices against public CVE entries and shows every match with severity, date and description, sortable by severity or device. CERNIS fetches those entries from a public vulnerability database on the internet by itself whenever a cross-check falls due. New matches are specially marked. What appears there are pointers for checking, not confirmed vulnerabilities: a match says nothing about whether a device is actually open to attack — that always takes a check of its own.
A deliberately sharp special function: it checks, per device and model, whether a device is still reachable with default credentials (factory password) — one of the most common real-world holes in home networks. Strictly opt-in, with safeguards (session release, restriction to the private network, rate limiting).
Detects when a device (TV, IoT, phone) bypasses the intended home DNS and secretly contacts a different DNS server. Plus a trust model: CERNIS lists the observed DNS servers, groups them by type (router / local / external) and lets the user decide which server to trust.
Record and share — six report types as PDF, CSV or JSON.
Network security report (with a “network health” score of 0–100), inventory report, CVE report, external-contacts report, DNS-guardian report and behaviour-profile report. Every report is cleanly structured and carries a logo and creation date. It describes and puts things in context — the judgement stays with the user.
Beyond the reports, scan results and analysis findings can be saved at any time as CSV, JSON or PDF — for archiving, sharing or one’s own analysis. The save dialog is the operating system’s native dialog; the user decides where things go.
Everything on the user’s terms — analysis rules, language, appearance, alarms.
The user decides what counts as unusual: which ports are critical, how many open ports trigger a warning, which rules are active at all. Custom port lists can be imported from a file. CERNIS provides sensible defaults — but the final word is the user’s.
Language (German / English, switchable instantly, including the manual), appearance (light / dark, any time via a toggle), automatic refresh and which sections the home screen shows. Everything is stored safely in a database — configuration files never have to be touched.
CERNIS can notify the user of certain events — as a desktop notice and, if set up, by email. The email credentials are stored securely.
Honesty as a principle — what makes it reliable beneath the surface.
CERNIS checks which system-level network tools are available on the machine and says so honestly when something is missing — instead of silently swallowing a function.
Some deep functions (such as passive reading for SNI) need elevated system permissions. If they are missing, CERNIS says so honestly and offers the normal path — it never takes permissions in secret. Only a slim, specialised helper carries the required permission, not the whole application (privilege separation).
