Before a migration
Find the forgotten dependency before you move the server and discover it at 2am. Every service, every port, and the process behind it, as it really runs today.
Map
Know what actually
talks to what.
A lightweight agent on each host streams real TCP and UDP activity — with the owning process behind every connection — into a live dependency map. No guessing from a CMDB export.
Flowlast 7 days
SRV-BKP-01 → SRV-FILE-01 tcp/445
- Process
- bkpagent.exe → System
- Account
- svc-backup
- Seen
- 48,210 flows
Would be blocked · no rule yet
Why an agent
Agentless sees less.
Flow logs and cloud mirrors sample traffic and stop at the IP address. A host agent sees the whole picture — and is the only thing that can enforce on the host itself afterwards.
- Every TCP and UDP flow, captured at the kernel rather than sampled
- The owning process and user, not an address you have to go and identify
- Listening ports inventoried on demand, per host
- Segmentation travels with the host — on-prem, in cloud, or off-site
Observed flows · SRV-APP-01
last 7 days
→ SRV-SQL-01 tcp/1433 w3wp.exe → sqlservr.exe3,596,077
→ SRV-DC-01 udp/53 svchost.exe1,204,882
→ SRV-DC-01 tcp/389 lsass.exe884,301
→ SRV-BKP-01 tcp/902 vsphere-agent98,140
→ 13.107.42.14 tcp/443 chrome.exe44,905
Every row carries the process that opened it
What the map shows
Live truth, not a diagram someone drew.
The map is built from traffic observed in the last window you chose. If a dependency stopped being used, it stops being on the map.
Grouped by application
Hosts are grouped into the applications they serve, so the map reads as your estate rather than as a hairball of addresses.
Coloured by coverage
Each edge is classified against live policy: allowed, blocked, waiting on a draft, or would-be-blocked under enforcement.
Containers as their own nodes
A container is a peer on the map with its own flows, rather than being folded into the host it happens to run on.
Noise held back
Scans, probes and one-off background chatter are separated from the dependencies that matter, so the signal survives.
What teams use it for
Replace the stale diagram with live truth.
The dependency map is drawn from actual traffic, not a CMDB export someone last touched two years ago.
After an incident
See exactly which paths were reachable from the host that was compromised — and close them, rather than guessing at a blast radius after the fact.
Questions
About the map.
How the picture is built, and what it costs to build it.
How much does the agent cost in resources?
It is built to sit on production servers: a small resident footprint, flow capture batched rather than streamed per packet, and collection work bounded so a slow host does not stall the agent.
Does it capture packet contents?
No. Segmenta records connection metadata — source, destination, port, protocol, the owning process, and counts. It is not a packet capture tool and does not read payloads.
How far back does the map go?
You choose the window. The map is drawn from traffic observed inside it, so a dependency that has genuinely stopped disappears rather than lingering forever.
What about hosts without an agent?
They appear on the map as seen by the managed hosts talking to them. You get the flows in and out, without the process detail that only an agent on the host itself can provide.
See your real dependencies this week.
Start a trial, install on a handful of servers, and watch the map draw itself from live traffic.