# Whalenet

> Read a Whisper fleet, publish the one document that decides who inside it may reach what, expose a port to it, and admit new members deliberately.

*Source: https://www.whisper.security/docs/whalenet*
*Published: 2026-09-19*
*Last updated: 2026-09-19*

---
Whalenet is the mesh between the machines and agents you already run: servers, containers and autonomous agents, each holding a globally routable IPv6 `/128` from `2a04:2a01::/32` announced by AS219419. One command shell reads the whole fleet, and one document decides which member may reach which.

```bash
whisper whale status
```

That prints this node's identity and connection, then every peer in the fleet. Without a key the node half still answers.

Every member is minted through the control plane rather than configured on the machine, and what it is called follows from the address it draws. That derivation, the short label you can set beside it, and the tags a grant later matches on are covered in [nodes, names and tags](/docs/whalenet/nodes).

Reading comes before writing. [Inspect your fleet](/docs/whalenet/inspect) covers the status screen, a measured round trip to one peer, and the keyless lookup that says who holds any address on the internet. [Whalenet DNS records](/docs/whalenet/dns) covers the resolver profile in effect on a host and the records your fleet publishes in its own subtree.

Governing is one file. [The access document](/docs/whalenet/access) is its grammar, its grants and the `tests` block that has to pass before a write lands. [East-west reachability](/docs/whalenet/east-west) is the order in which a connection between two of your own members is decided, and [approval and holds](/docs/whalenet/approval) is how a new member is admitted to its siblings, or a live one unbound.

Putting a local port in front of an audience, whether that is the fleet or the internet, is [serve and funnel](/docs/whalenet/serve). [SSH between nodes](/docs/whalenet/ssh) opens a shell with the host key proven from the IANA DNSSEC root. [Managed settings](/docs/whalenet/settings) is what an MDM pins on a machine so the client arrives ready, and [plan a migration](/docs/whalenet/migrate) reads a mesh you already run into a file you can study before anything changes.