DocumentationInfrastructure
Infrastructure Sentinel

Tunnel Monitoring

The **Tunnelight Engine** enables high-fidelity monitoring of encrypted network tunnels, including WireGuard, SSH, and OpenVPN.

The Silent Failure Problem

Network tunnels often fail "silently" - the process remains active, but data flow is obstructed due to stale handshakes or routing loops. Replaysafe Sentinel monitors the **Pulse** of the tunnel, not just the process status.

Handshake Telemetry

Real-time tracking of the last successful cryptographic handshake.

Latency Pulses

Millisecond-precision tracking of network RTT within the tunnel.

Configuration

To monitor a tunnel, you must provide the sentinel with your tunnel's public endpoint and the expected handshake threshold.

# Example: Monitoring a WireGuard Tunnel
Replaysafe monitor add \
  --type tunnel \
  --name "HQ-Office-VPN" \
  --endpoint "vpn.hq.example.com:51820" \
  --threshold 180s

Alerting Thresholds

  • Degraded State: Triggered when latency exceeds 200ms or handshake age exceeds 3 minutes.
  • Down State: Triggered when no handshake is detected for more than 5 minutes.