How the Sensor Works
What a host watches, what leaves it, and where the verdict on a destination actually comes from.
On this page (4)
How the Sensor Works Documentation
The sensor is one static user-space binary. There is no kernel module and no driver, so the machine keeps booting and keeps working whatever the sensor does.
What it watches
It collects four kinds of event and raises a fifth of its own.
| Kind | What it records |
|---|---|
exec | a process starting, with its command line, image path, parent and user |
file | a file created, modified or deleted, and a hash once a new executable settles |
conn | an established socket, in either address family, with its direction |
dns | a name the host asked for, attributed back to the process that asked |
detection | a finding one of the detectors raised over the events above |
Collection is forward-first. An event is handed downstream before any detector sees a copy, so a detector cannot delay or drop telemetry. The full stream lands in a local file that only its owner can read, and that file stays on the machine.
What leaves the machine
Each window the sensor ships a digest of what is new, not the stream. The first digest goes out within seconds of a start and then on a steady cadence, and whisper sensor flush ships the current window on demand. Every digest is carried under the address the host is bound to, which is why binding comes before the service starts.
The journal prints the proof:
journalctl -u whisper-sensor -n 3
whisper: sensor: reporting as 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478
Where the verdict comes from
The host knows which process opened a socket. It does not know who runs the other end. The digest's destinations are joined to the Whisper graph, which answers what that address and that name are: who announces the prefix, who registered the domain, which feeds list it. Read Coverage before you trust a clean answer, because a thin plane returns nothing rather than nothing-to-find.
Observing is not acting
On-host detectors observe. A finding is held, not contained: the sensor recorded it and did not act on it. Acting is a separate, deliberate step, and it can happen on either of two planes, which is what the response ladder sets out. The detections reference lists the families that raise findings in the first place.