Modular protocol analyzer

See your protocols.
Understand. Decode.

Trace captures serial byte streams in real time and turns them into structured, readable messages — RS232, RS485, USB serial, CAN. Define your own protocols declaratively in TrIML — without writing a single line of code.

One click, no sign-up: start with demo data or your own USB adapter (Chrome/Edge) – nothing to install. Guest access lasts two hours. What is stored

Real-time capture · timestamp on every byte 36 protocol definitions in the store Windows & Linux · C99 + .NET
36
Protocol definitions in the store
16
Probes feeding one session
0×
Lines of code for a TrIML protocol
2
Platforms: Windows and Linux
From raw bytes to messages

Raw data in. Structure out.

Trace takes the raw byte stream off the wire and delivers fully interpreted messages — with fields, enums, checksums and hierarchical descriptions. Live, persisted and searchable.

// Input · byte stream
02 01 05 48 45 4C 4C 4F 03  02 02 03 9A 1B 04 03
02 01 03 4F 4B 21 03  02 01 05 57 4F 52 4C 44 03
A4 C1 02 01 … // continuous, multiple ports
// Output · structured frame
▾ Status message ✓ matched
STX 0x02
Type Status (0x01)
Length 5
Payload "HELLO"
ETX 0x03
See it run

Real UI. Real protocol. Real speed.

Four short clips of the TraceUI at work: a fleet of drones sends MAVLink telemetry, Trace decodes every frame on arrival — and finding the one that matters takes a keystroke.

TraceUI · MAVLink · drones

Recorded in the browser against a running Trace server. The drone telemetry is simulated with the public MAVLink protocol and decoded by the MAVLink interpreter from the protocol library.

Features

One tool for everything on the wire.

Capture, decode, search, trigger, record — and do it all remotely through the hub. All in a single interface.

Declarative · TrIML

Interpreters without code

Fields, branches, checksums and enums in XML — the engine evaluates them at runtime; every new version is ready for the next session.

Real-time capture

Lock-free SPSC ring buffer in the hot path. Every byte gets a millisecond timestamp taken in one atomic call — no errors at second boundaries.

Search & filter

Full-text search across all messages with O(log n) navigation, combinable port filters and live matches — directly in the live stream.

Triggers

Declarative predicates evaluate every frame — with its own hit list per trigger.

Self-contained sessions

Every recording lives entirely in a single .msf file — including the finished interpretation. No interpreter needed to open it.

Remote access via the hub

Secure access to probes and nodes behind NAT and firewalls — Ed25519-signed, no inbound port forwarding, with a live dashboard.

TrIML · Trace Interpreter Markup Language

Write the protocol. Not the parser.

A complete TrIML definition — and the frame the engine builds from it at runtime. Safe to try out via POST /api/interpreters/dryrun.

my-interpreter.triml.xml
<?xml version="1.0" encoding="utf-8"?>
<Trace-Interpreter-Definition>

  <interpreter name="My-Interpreter" type="FrameOriented" />

  <definition>
    <!-- Value table (enum) -->
    <valuedescriptor type="byte" name="type-desc">
      <descriptor value="0x01" label="Status" />
      <descriptor value="0x02" label="Command" />
    </valuedescriptor>

    <!-- The message -->
    <message>
      <const type="byte" value="0x02" name="STX" />
      <byte  name="Type" valuedescriptor="type-desc" />
      <byte  name="Length" />
      <array sizeRef="Length" name="Payload" />
      <const type="byte" value="0x03" name="ETX" />
      <match label="Frame" />
    </message>
  </definition>
</Trace-Interpreter-Definition>
▸ dryrun · 02 01 05 48 45 4C 4C 4F 03
Frame matched
STX 0x02
Type Status (0x01)
Length 5
Payload48 45 4C 4C 4F → "HELLO"
ETX 0x03
In the hub, every saved change becomes a new version with rollback — the next session decodes with it.
Architecture

One pipeline, from wire to browser.

Native C99 capture engine, .NET 10 server with interpreters, real-time push via SignalR — all the way into the WASM interface.

01 · HARDWARE

Serial · USB · CAN

Physical interfaces deliver the raw byte stream.

02 · BYTECAT (C99)

Capture engine

Plugins, SPSC pipes, timestamps, per-port buffer files.

03 · TSERVER (.NET 10)

Interpreters & REST

TrIML engine, 14 REST controllers, SignalR hub, sessions.

04 · CLIENTS

TraceUI

Canvas-rendered WASM interface in the browser, delivered by the hub.

Topology

Many measurement sites, several nodes — one hub in the middle.

Measure where the wire is. Compute where the machine is. Manage everything in one place: probes at the measurement sites deliver bytes, nodes run the workers, and the hub sits above both and ties them together.

Trace topology: remote probes, remote nodes and the central hub On the left are three probes at different measurement sites — two TraceProbes and a Mini-Probe. Each opens an outbound connection to the hub in the middle and delivers bytes. On the right are three compute nodes: a cloud node run by the operator and two Bring Your Own nodes on customer premises. The hub reaches them through the tunnel the node opened and starts one worker per session there. Below the hub sits the TraceUI in the browser, which reaches its worker exclusively through the hub's proxy paths. SITE · CUSTOMER LAN CENTRAL · TOP LEVEL NODES · COMPUTE HTTPS · via hub paths only TraceProbe Plant North · Hall 3 RS232 · USB serial TraceProbe Test bench 2 · mobile CAN · RS485 Mini-Probe Embedded firmware TCP · no SignalR up to 16 probes per session outbound connections only Cloud node Operator · container Quota · auto-stop BYO node Customer hardware Worker + MSF local BYO node Plant South · service no open port one worker process per session the .msf stays on the node TRACE HUB CONTROL PLANE Sessions, tenants, plans Pairing and trust (Ed25519) Routing into the live session The single clock in the system never processes trace data itself Bytes · outbound Node tunnel TraceUI in the browser Blazor WASM · on canvas
PROBE → HUB

The probe dials the hub, never the other way around. Both its connections, control and bytes, are outbound — so no port has to be opened behind NAT or firewalls.

HUB → NODE

The node also opens its tunnel outbound. The hub uses it in the opposite direction: it starts one worker per session there and passes the bytes through.

HUB → BROWSER

The interface never talks to a worker directly. Every request goes through the hub's proxy paths, which check ownership and the session token.

Remote · at the measurement site

Probes

A standalone process right at the hardware. It keeps the native capture engine running, gives every byte a gap-free index and timestamp, and pushes the stream outbound. Several probes at different sites can feed one session at the same time — the common time base comes from the hub.

  • Ed25519
  • Device-code pairing
  • RS232 · USB · CAN
  • 16 per session
Remote · where compute runs

Nodes

A node is the machine the workers run on — a dedicated process per session that detects frames, writes them to the session file and serves them. With Bring Your Own Node this machine belongs to the customer: compute and recordings stay in-house — without opening a single inbound port.

  • 1 worker per session
  • Cloud or BYO
  • no inbound port
  • .msf stays local
Central · top level

The hub

The layer above everything: accounts and tenants, probe and node pairing, the start and end of every session, routing from the browser into exactly the right worker. It never processes trace data itself — it only brokers it. And it is the single clock source, so timestamps stay comparable across all measurement sites.

  • Sessions & quotas
  • Reverse proxy
  • Clock source
  • Browser UI

Describe your first protocol.

The TrIML reference takes you from your first message to the complete element reference — with patterns, examples and live testing.