Request a demoDemo
Menu

Prove · Rewind

A signed answer about any past moment.

What was on port Gi1/0/14 at 2:14 PM last August, who approved it, and was the switch being read? Ask, and hand the examiner an answer they can verify offline.

Request a demoTechnical detail
Status
Available
Screens
Designed, not built yet
Command line
appliance rewind

The problem

Switch MAC tables forget in minutes, and most tools keep only last-seen values.

A past-tense question from an examiner, an auditor or an incident responder takes days, and the answer rests on someone’s word.

How it works, illustrated

Rewind: what was on SW-B3 Gi1/0/14 at a past momentA day on one switch port, with who was connected, the coverage gap, and the signed answer for the chosen moment.SW-B3 · Gi1/0/14 · VLAN 20Branch 3 · Aug 14, 2026empty2:14 PMPrinter · 00:00:5E:00:53:2A · 10.3.20.41ApprovedNeeds decisionNothing connectedNot monitoredOn the portCoverage8 AM10 AM12 PM2 PM4 PM6 PMLaptop LT-0412, approvedPrinter, nobody approvedSwitch not readSigned answerQuestionWhat was on Gi1/0/14 at 2:14 PM?Verdictdevices_presentDevicePrinter · 00:00:5E:00:53:2A · 10.3.20.41Status at that momentNeeds decision: nobody had approved itCoverageMonitored · 2m30s apart (limit 5m)Full reads at 2:13:01 PM and 2:15:31 PMquestion 2a70…43df · answer 3112…d981appliance verify -trust <key-id>-answer answer.zipResult: PASSRewind: what was on SW-B3 Gi1/0/14 at a past momentA day on one switch port, with who was connected, the coverage gap, and the signed answer for the chosen moment.SW-B3 · Gi1/0/14 · VLAN 20Branch 3 · Aug 14, 20262:14 PMApprovedNeeds decisionNothing connectedNot monitoredOn portCoverage8 AM12 PM6 PMapprovednobody approvednot readSigned answerQuestionWhat was on Gi1/0/14 at 2:14 PM?Verdictdevices_presentDevicePrinter · 00:00:5E:00:53:2A · 10.3.20.41Status at that momentNeeds decision: nobody had approved itCoverageMonitored · 2m30s apart (limit 5m)Full reads at 2:13:01 PM and 2:15:31 PMquestion 2a70…43dfanswer 3112…d981appliance verify -trust <key-id>-answer answer.zipResult: PASS
Rewind. Ask what was on a port at any past moment, and get an answer an examiner can verify offline. Illustration with fictional data.
What this shows

A timeline of one switch port, SW-B3 Gi1/0/14 on VLAN 20 at Branch 3, on Aug 14, 2026 from 8 AM to 6 PM. Laptop LT-0412, approved by Dana Mercer on Jul 2, was connected from 8 AM to 11:40 AM and again from 3:20 PM. A printer nobody had approved was connected from 1:58 PM to 3:20 PM. The switch was not being read from 12:10 PM to 1:02 PM. A slider picks a moment. At 2:14 PM the answer is: devices_present; Printer · 00:00:5E:00:53:2A · 10.3.20.41; Needs decision: nobody had approved it; Monitored · 2m30s apart (limit 5m). The answer is signed and can be checked offline with appliance verify -trust <key-id> -answer answer.zip. For a moment in the gap, the answer is unknown, never "nothing there".

appliance rewind -data-dir /var/lib/appliance -at 2026-08-14T14:14 \    -gear SW-B3 -port Gi1/0/14# replays the log, read-only: what was on the port, who approved it,# and whether the switch was being read at that momentappliance verify -trust <key-id> -answer answer.zip# checks a signed answer offline: the pack checks, then a replay# of the log that must give the same answer
Command-line usage from the appliance’s reference.

Today Rewind runs on the command line and through the data routes, and the appliance issues signed answers.

Its page, with a question bar, a time slider and a coverage strip per switch, is designed and arrives with the new interface.

How it works

  • The answer is computed from log entries, not from a separate database, so anyone holding the entries can compute it again. The offline verifier runs the same code.
  • Three verdicts: devices present; nothing present, only when every switch in scope was being read; or unknown.
  • Each device comes with its maker, name, place, IP, arrival time, its status at that moment and the decision behind it: who, how they signed in, the scope and the reason.
  • Coverage for every switch in scope, such as “monitored: full reads at 14:12:31 and 14:14:52” or “NOT MONITORED: no full read from 13:02 to 14:30”.
  • Compare two moments: which devices joined, left, moved or changed status.
  • A question answered from snapshots took about 13 ms on a synthetic log of a million entries (benchmark on an Apple M4 Pro).

What it proves

It turns “let me get back to you” into a signed answer that can be checked offline, and that says plainly when the switch was not being read: “not monitored”, never “nothing there”.

What it records

Entries this feature writes to the tamper-evident audit log. Each one is in the evidence packs that cover its date.

  • answer_issuedThe moment, the question and answer hashes, the range replayed, the checkpoint and the verdict.
  • checkpoint_signedSigned before each answer is handed out.

Limits

What it does not do yet, stated plainly. The technical page lists every known gap.

  • The page is not built yet.
  • For an answer that starts from a stored snapshot, the verifier cannot prove the snapshot is complete: someone holding the real key could leave a device out. The answer says so. On logs under 20,000 entries, answers replay from the start and carry no such caveat.
  • One answer covers at most 5,000 devices and 1,000 switches.
  • Questions about an IP address over a window, and a MAC address’s full history, are not built yet.

Technical detail

Docs · Feature referenceRewind: how it is builtWhat it does, how it works, what it records, security notes, limits and known gaps, the command line, data routes and the review summary.

Also in Prove

Tamper-evident audit log

Every sign-in, decision and change is an entry in an append-only Merkle log with signed checkpoints, and polling is recorded as hourly roll-ups plus every change in a poll’s result. Editing an old entry breaks every checkpoint after it.

Evidence packs

One signed ZIP for any date range. An examiner verifies it offline, with the verifier or by hand, without trusting the appliance.

Signed board report

A quarterly report for the board, with the evidence pack inside. The verifier recomputes every number from the signed log.

Early access: now taking pilot customers.

See it on your own network.

A live demo with the engineers who built it. We bring a simulated network; you bring your questions.

Request a demoDocumentation