What PathMRI is
PathMRI is end-to-end path verification, from source to destination, across your hybrid environment. It reads the policy on every device in the way, sends a real packet, and reports the disagreement.
The story doesn't end here. A blocked port and a tunnel are two of the questions PathMRI answers. It also reads NAT and routing, resolves DNS where the application does, maps containers and Kubernetes, watches for drift, flags rogue listeners — and hands you the fix.
See every capabilityDeep scan. Complete picture. Zero footprint.
Three promises the console opens with — and three the product keeps.
Deep scan
Real packets, host to host — sent from inside the source machine, not from a scanner box on another network. It tests the path your application actually takes.
Complete picture
Every host, container, pod, exposure and flow on one live map — with the firewalls, routes and NAT between them drawn in, not left as a guess.
Zero footprint
Run it agentless over SSH, or let the agent deploy itself, do the work and remove itself completely. Nothing is left behind on the hosts you tested.
Application-aware checks
PathMRI knows every port it needs.
Check a port, or check the whole application with one rule. PathMRI already knows what 72 applications need: 124 components, 328 ports, each with its direction. Pick the role each side plays and every port loads by itself, before the install and on a schedule after it. A smooth rollout in a restricted environment, and easy maintenance once it is running: when a change breaks a path, you are told. Not in the library? Add your own custom application, with its components and ports, and check it the same way.
Databases, directory services, remote access, virtualization, security agents, CI/CD — 15 categories built in.
See it run
Two minutes through the console: picking a source and a destination on the map and checking ports between them, the full verify dialog, the map scaled to ten thousand nodes, a shell opened inside a running Kubernetes pod, that cluster scaling up and back down live, and Docker.
The hours this gives back
A blocked port is rarely one person's problem. It becomes a ticket that moves between teams, each able to prove only that it is not their fault — and none of them able to see the whole path. That is the time PathMRI is built to remove.
Without it
Days, across four teams.
- ·A developer reports the application cannot reach the database.
- ·The network team checks the firewall and says the rule is there.
- ·The platform team checks the security group and says it is open.
- ·Someone finds a host firewall, or a route, or a NAT nobody was looking at.
- ·The answer arrives after the deployment window has closed.
With it
One check, one answer, in minutes.
- →Run the path from the real source to the real destination.
- →Get the device and the rule that stopped it, named.
- →Get the remediation tip with it, from an offline knowledge base.
- →Share a result nobody has to take on trust — it is a measured packet, not an opinion.
- →Nothing to argue about, because the evidence names the owner.
Network engineers
Stop proving a negative. A verified path shows the rule that matched, so "the firewall is fine" becomes a result rather than an assertion.
DevOps and platform
Check connectivity before the deployment, not during the incident. The whole path is reachable on the ports the application actually needs, or it is not — and you know which.
NOC and sysadmins
Triage without escalating. The report already says where the packet stopped, so the ticket goes to the right team the first time.
Developers
Find out it is the network — or that it is not — without waiting on anyone. A failing path names its own cause.
Twelve things it checks. One answer.
The short version here, the whole story a click away — every one of them has a page of its own.
Path verification
Predict the verdict from policy, probe it with a real packet, then compare. Agreement is a verified path; disagreement is the finding nothing else looks for.
Firewall & cloud policy
Thirteen policy sources, each read through its own API or CLI — and the deciding rule quoted by name, not a guess about which one it was.
NAT, declared and observed
Thirteen sources modelled, and the two kept rigorously apart. See the address the far end actually saw — not the one you dialled.
VPN & tunnels
Is this flow really in the tunnel, and is the tunnel really carrying it? Phase 1 and phase 2 stay separate, counters are watched moving, and a bypass is named.
Routing & asymmetry
Does the answer come back the way it went out? Both legs are traced and compared — the two-ended check a single-ended tool cannot make.
DNS from the source host
The name is resolved where the application would resolve it, so a hosts-file override or a split-horizon answer stops hiding behind a green result.
The Unified Map
The whole estate on one screen, with firewalls drawn in as first-class things. Click a source, click a destination, add the ports. No form, no syntax.
Kubernetes & Docker
Cluster map, path analyzer, reachability matrix and exposure scan — all over SSH, leaving nothing on the nodes. NetworkPolicy, plus ordered Calico and Cilium.
Application-aware checks
Check a port, or the whole application with one rule — 72 applications and 328 ports with direction, already catalogued. Your own custom applications go into the same library.
Drift detection
Snapshot the estate, then answer the only question that matters after a change: what moved, and what did it break?
Rogue ports
Every listener a host never asked for, triaged against the applications actually assigned to it. Learn a baseline once, then watch for what is new.
The fix, not just the fault
Every finding carries a remediation write-up from an offline knowledge base of 89 entries — and a printable report when someone else has to sign it off.
Every vendor, read its own way
Eight firewall vendors, five cloud policy engines and two container platforms — supported today, each through its own API or CLI.
Free, on-premise, and nothing to sign up for
One self-contained application. Nothing is installed on the machines you test unless you choose the agent — and even then it can remove itself.