About PacketGarden

What is this?

PacketGarden turns real, observed network activity into a small living terrarium. Incoming connections become plants; aggregate traffic becomes weather. The garden changes as plants age, grass spreads, storms pass, and tiny creatures appear.

This is meant to be watched, not managed. It is not a packet-capture tool, intrusion detector or security dashboard. You do not need to water plants, fight enemies or earn points.

Browser support

PacketGarden uses PixiJS/WebGL to display the garden. Use a browser with WebGL enabled. The legacy Canvas 2D garden has been retired; old bookmarks redirect to the homepage.

How does it work?

Two independent sources feed the garden. Your browser receives both over a single Server-Sent Events (SSE) connection to PacketGarden.

Individual connections → plants

TCPNoise sensors observe incoming connections to listening ports. The backend receives tcpnoise.connection summaries through NATS, validates them, chooses an artistic species based on the listening port and a rarity roll, and converts the reported seen count to a visual vigor value. It sends only the sanitized growth event to the browser. Each browser attempts to grow one specimen for that event.

Not every accepted event results in a plant. If the garden is full and no weaker eligible specimen can be replaced, it remains a no growth entry in Recent activity.

Aggregate traffic → weather

Separately, PacketGarden checks Noise Observatory's aggregate snapshot about every 10 seconds. The Observatory supplies the current weather category and traffic counts. Those totals do not create additional plants. The browser connects only to PacketGarden, not directly to the sensors or NATS.

What do the plants mean?

The listening port sets a starting plant family. These are the current real TCPNoise mappings, not claims about which application or protocol ran:

Except for exact port 22, a rarity roll can swap the starting species for a weed or one of three rarities: ghostbloom, crystal fungus, or blackthorn. Unknown ports have slightly higher rarity odds; IPv6, DN42 or Yggdrasil traits can nudge them too. Ports 420 and 42069 are two exact port numbers, not a range.

Plants aren't threat classifications. A redbloom says a connection reached listening port 22. It does not prove SSH negotiation, credentials, authentication or an attack. Weeds and rare species are artistic variations, not evidence of malicious activity.

Click a plant

Click a living specimen to inspect its species, sensor label, listening port, valid exact seenCount, vigor, color and age. Counts are displayed as exact text to avoid rounding large integers. Fake development specimens identify themselves as simulated instead of inventing network provenance.

Inspection is read-only. Click empty soil, press Escape or use the close button to dismiss it. Clicking a temporary collectible instead collects it. Recent activity shows only the newest three safe events, including events marked no growth at saturation. It is not a durable log.

Vigor, rarity, and weird colors

The collector's seen count is converted into a coarse vigor value: 0 for 0–1 or missing/unusable counts, 1 for 2–3, 2 for 4–9, and 3 for 10 or more. Higher vigor makes plants a little fuller. It is not a threat score, and it does not affect species rarity or lifetime.

The garden has 32 × 20 cells (640 maximum specimens), one specimen per cell. New plants tend to cluster near others of their species. When full, an incoming plant can only displace a strictly weaker eligible resident, starting with the weakest and oldest. Ghostbloom, crystal fungus and blackthorn are protected from forced displacement but still die naturally.

Rarity is decided by the backend per connection. Color variation is a separate browser-only visual choice: a rainbow broadleaf or unusual vine doesn't mean anything special happened on the network.

Grass and ecology

Species grow through stages, then wilt, fade and expire, freeing their cell. A redbloom lasts about 30 seconds; most plants last a few minutes, and some vines and rare blackthorns last longer. The garden is a changing picture, not a permanent record of all past connections.

Grass has its own ecology state and uses no specimen slots. Successful plant growth or replacement clears grass from its cell by default, leaving nearby tufts alone. Allow grass under plants lets grass naturally establish and remain beneath plants. It starts off on reload; turning it on does not instantly fill cells, and turning it off removes only overlapping grass. Grass spreads, ages, expires and recovers through its own ecology. Real TCPNoise growth does not directly seed or refresh it. Wild grass has dense leafy tufts and quieter shading beneath plants. Click or tap a grass-covered empty tile to see its state. Grass is background ecology, not a collectible specimen; a plant in the tile takes priority.

All specimen and ambient state currently lives in each visitor's browser memory. Reloading starts a new garden; there is no saved planting history.

What is the weather?

Weather reflects overall activity reported by Noise Observatory, not the species or threat level of any particular connection. Its levels range from quiet and drizzle through rain, heavy rain, botnet_thunderstorm, and botnet_hurricane. Busier conditions change rain, wind and darkness. Heavy rain and the two strongest storms can also leave temporary puddles that slowly evaporate. Weather does not damage plants or change the network events.

The homepage's Observatory traffic counters are separate from successful garden growth:

• Events/min (5-min avg) is the Observatory's five-minute event count divided by five, not an instantaneous rate.
• Last hour is the actual reported one-hour count, not events/min multiplied by 60.

The Observatory retains up to 5,000 events in memory. Under heavy traffic its window counts may undercount evicted events; a source restart also resets that history. Waiting… means no valid snapshot has arrived; Unavailable means no usable hourly count was supplied. Neither counter is a count of plants grown.

And the gnomes?

The default Pixi garden does have gnomes and optional sound. With at least 30 living specimens, one check every 45 seconds has a 2% chance to start The Gnome Incident. Two red-hat and two green-hat gnomes approach, argue, fight, pick a random winner, and leave after 12 seconds. They consume no cells and do not alter network traffic, plants or weather.

Browser-only surprises include a ladybug, snail, moth or shiny pebble near a successfully grown live specimen with exact seen count 1; an occasional Amanita muscaria near a live mushroom; and a rare collectible weed mutation of an actual port-22 redbloom. They are short-lived, optional collectibles, not extra sensor events.

Collection gives you +0 points. The displayed Score: 0 never changes. That's intentional. Growth, rare plants, collection and gnome events have small synthesized sounds, Off by default. You must click Sound On to enable them; the volume slider starts at 12%.

The gnomes mean absolutely nothing.

Privacy

Browser growth events contain only the normalized plant type, listening port, coarse vigor, optional bounded sensor label and optional valid exact TCPNoise seen count. The count travels as text so large values are not rounded by JavaScript. Aggregate weather and counters arrive in a separate SSE event.

Remote IP addresses, remote source ports, packet contents, credentials, banners and raw collector payloads are not sent to the browser. The page doesn't know who made a connection or what they transmitted. Each visitor sees a separate, temporary browser garden.

PacketGarden is not an IDS, SIEM, packet inspector or forensic record. If something looks ominous, that's because the garden is dramatic, not because it identified an attacker.

Why?

Because the public internet produces an endless amount of unsolicited background noise, and watching it grow mushrooms is more fun than staring at another dashboard.

Want the detailed rules? Read the port and rarity mappings or the real-data documentation.