Product
What GURDN actually does
Six surfaces of the Windows connectivity layer, read continuously, compared against what this network looked like before, and judged together rather than one at a time. Two of them GURDN can change, with your authorisation and under verification.
StatusEverything described here is implemented. Validation on a clean Windows machine is part of release qualification and has not been completed.
01Scope
The layer, and GURDN across it
Figure 1, conceptual architecture
The internet, your provider and the local network. Outside the machine, and outside what GURDN can change.
- DNS
- Routing
- Adapters
- Wi-Fi
- Firewall
- VPN state
Observes the whole layer, not one part of it
Compares what it reads with what this network looked like before, and correlates changes that happen together. Acts only where Windows allows it, only when authorised, and verifies by reading the machine back.
Windows
Owns the configuration. Where it exposes no capability, GURDN reports that the capability is not supported.
02Surfaces
What is watched, and what can be changed
Each surface says plainly whether GURDN only reads it or can also act on it. The distinction is the difference between a claim and a promise.
Observes and acts
Which resolvers each interface is configured to use, and whether they changed from what GURDN last recorded.
Can set interface resolvers to a configuration you choose, then read them back to confirm.
GURDN does not recommend a resolver. Each one is operated by someone, and none lets GURDN verify that an answer is authentic.
Observes
The routing table, joined to the interface list, to name the path traffic actually takes.
Observation only.
Where several interfaces carry a default route, GURDN reports the ambiguity rather than guessing which one is in use.
Observes
Which interfaces exist, their type and status, their addresses, prefix lengths, DHCP origin, gateways and MTU.
Observation only.
An adapter hidden by a filter driver is not visible to the Windows IP Helper API, and so is not visible to GURDN.
Observes
The associated network, its security type, and how that compares with previous associations of the same network.
Observation only.
Without a resolvable gateway the network fingerprint rests on signals a nearby attacker can forge, and GURDN reports the identity as weak rather than claiming recognition.
Observes and acts
The host firewall profile in force and whether it is enabled, read from the local firewall policy store.
Can enable a profile, and can add and remove its own filters through the Windows Filtering Platform, inside a transaction.
A profile set by Group Policy is refused rather than written locally, because a local value the policy would override reads back unchanged.
Observes
Whether a VPN interface is present and carrying traffic.
Observation only.
GURDN reports presence. It is not a VPN, it does not provide one, and it does not vouch for any provider.
03Judgement
Baselines, detection and trust
A reading is only useful compared with something. GURDN compares against this network, as it was, rather than against a general idea of normal.
Where the gateway cannot be resolved, the fingerprint rests on forgeable signals and GURDN reports the identity as weak rather than claiming recognition.
No rule concludes that an attack is under way, because no local observation establishes that.
04Lifecycle
How a change happens
The same seven stages every time, with authorisation and verification as separate steps rather than implied ones.
Observe
Read the actual state from Windows.
Interfaces, addresses, routes, resolvers, Wi-Fi association, VPN presence and firewall profile, read through the Windows APIs that own them. GURDN does not probe the network or inspect traffic.
Understand
Compare against the baseline and the other observations.
Observations are normalised and diffed against what was recorded before. Each result carries whether it was collected, partly collected or unavailable, and why.
Decide
Judge whether the change is meaningful.
Rules evaluate the change against the baseline, the network trust level and what else changed at the same time. Every decision records which inputs it used and which were missing.
Authorise
Require the right authority before anything changes.
Nothing is applied because a rule fired. The required level of authority depends on the operation, consent is recorded, and the interface cannot grant itself more than it has.
Act
Make only the supported change, through the privileged service.
Operations are a defined set, not arbitrary commands. Where the platform supports it the change applies as one transaction, so a partial result cannot be left behind.
Verify
Read the machine back.
The change is confirmed against the same source GURDN reports state from. A call that returned success without a matching read back is treated as a failure.
Recover
Undo rather than leave the machine half changed.
Every step records its undo before it is attempted. On failure the completed steps are walked back in reverse, and a step whose current state no longer matches is refused rather than forced.
05Reporting
Every answer carries its own confidence
An observation records whether it was collected, partly collected or unavailable, and why. A decision records which inputs it used and which were missing.
06Record
A local record of what happened
Observations, decisions, authorisations and actions are recorded on the machine, so a question asked tomorrow has an answer.
The record is chained: each entry digest covers the one before it, so a removed or edited entry breaks the chain and GURDN reports the first entry that fails to verify rather than condemning the whole record. Retention is bounded by size and age, and the record never leaves the machine on its own.
The security model covers audit integrity and what it does and does not prove.