Glossary

The key technical terms around CERNIS PRO and your own network — explained in one to three sentences in plain language. Ordered alphabetically.

ASN / network operator: An ASN (Autonomous System Number) identifies a connected network on the internet managed by a particular operator — such as an internet provider or data centre. It lets CERNIS say which operator an IP address belongs to.
Black box: A tool that gives a result without revealing how it was reached — for example a bare “dangerous” or “safe” with no reason. CERNIS is deliberately the opposite: it shows the source for every statement.
CVE: CVE (Common Vulnerabilities and Exposures) is a globally uniform numbering scheme for publicly known security holes. Each hole gets a unique ID (e.g. CVE-2024-1234) through which its description and severity can be looked up.
DHCP: DHCP is the service that automatically assigns an IP address to devices on the network — usually handled by the router. An unexpected, “rogue” DHCP server can be a sign of a problem or an attack.
DNS: The DNS (Domain Name System) is the address book of the internet: it translates a memorable name such as example.com into the matching IP address that devices actually need in order to connect.
DNS over HTTPS (DoH): A variant of DNS in which name resolution runs encrypted over an ordinary web connection. This protects privacy but can also be used to quietly bypass the intended home DNS — which CERNIS points out.
FRITZ!Box: A router range widely used in German-speaking countries. Via the official TR-064 interface, CERNIS can read detailed information such as connection data, WLAN clients and port forwardings.
Gateway: The crossing point from your own network into the next — in a home network usually the router. All traffic leaving the local network passes through the gateway.
GPL: The GNU General Public License is a widely used licence for free software. It allows the program to be used, its source code to be inspected, modified and passed on. The packages shipped for CERNIS PRO carry the declaration GPL-2.0-only — version 2, without the option of later versions.
Hostname: The name under which a device or server is addressed on the network — such as “living-room-tv” at home or a server name on the internet. It is easier for people to remember than the matching IP address.
IP address (IPv4 / IPv6): The unique “house number” of a device on the network. IPv4 is the older, scarce form (e.g. 192.168.0.10), IPv6 the newer one with far more available addresses (e.g. 2001:db8::1). Both serve to route data packets to the right device.
Latency / RTT: The time a data packet takes to reach a target and come back (round-trip time). Low latency means a fast response; high or fluctuating values point to an overloaded or disrupted connection.
LLDP / CDP: Protocols through which neighbouring network devices “introduce” themselves to each other. CERNIS uses them to tell real, measured connections from sensibly assumed ones in the topology picture.
MAC address: An identifier built permanently into a device’s network hardware. Unlike the IP address it normally does not change, and it often already hints at the device’s manufacturer.
Network scan: An active search of your own network for reachable devices. It determines which devices are online, which services they offer (open ports) and sometimes which operating system they run.
Passive observation: Simply reading along with the traffic that is there anyway, without generating requests of one’s own. This is gentle on the network and unobtrusive — in contrast to active scanning or “interrogating” devices.
Ping: A simple reachability test: you send a target a small signal and measure whether and how quickly it answers. “No ping” usually means the target cannot be reached.
Port: A numbered “door” on a device, behind each of which a particular service listens (e.g. a website on port 443). Open ports show which services a device offers to the outside.
Privilege separation: A security principle in which only a small, specialised part of a program carries elevated permissions — not the whole application. This keeps the attack surface small. CERNIS uses a slim helper for this.
RDAP / WHOIS: Public lookup services through which administrative details for an IP address or a domain name can be retrieved — such as the responsible network operator. RDAP is the more modern, machine-readable successor to WHOIS.
Router: The central device that connects the home network to the internet and relays traffic between the devices and the outside. It is typically also the network’s gateway.
SNI: Server Name Indication: when an encrypted connection is set up, the target host name is still sent unencrypted. From this CERNIS passively recognises where a program is talking — without touching the content of the connection.
SPAN / TAP port: Special connectors on professional network hardware through which all traffic can be “tapped off” for analysis. Serious passive monitoring with professional tools often requires something like this — CERNIS deliberately does without.
Telemetry: The automatic sending of usage or diagnostic data to the manufacturer in the background. CERNIS does entirely without it: no telemetry, no crash reports to a server, no advertising IDs.
Topology: The picture of how the devices on a network are connected to each other. CERNIS shows it in a star shape — the gateway at the centre, the devices around it.
TR-064: An official interface on many routers (including the FRITZ!Box) through which configuration and status data can be read in a structured way. CERNIS uses it for the FRITZ!Box detail view.
Traceroute: A diagnostic tool that makes the path of a data packet to a target visible station by station (hop by hop) — including the countries and network operators it travels through.