**Core Value:** Network traffic patterns are instantly recognizable as distinct sounds — a ping sounds different from HTTPS noise, which sounds different from a port scan.
## v1 Requirements
Requirements for initial release. Each maps to roadmap phases.
### Packet Capture
- [ ]**CAPT-01**: User can specify network interface via `-i` flag
- [ ]**CAPT-02**: User can list available network interfaces via `--list-interfaces`
- [ ]**CAPT-03**: Capture runs until user presses Ctrl+C, then gracefully flushes and saves MP3
- [ ]**CAPT-04**: User sees a clear actionable error message when lacking capture privileges (sudo/CAP_NET_RAW hint)
- [ ]**CAPT-05**: User can filter captured traffic using BPF syntax via `--filter` flag
- [ ]**CAPT-06**: User can sonify a pcap file instead of live traffic via `--read` flag
### Traffic Classification
- [ ]**CLAS-01**: Known protocols (ICMP, DNS, TCP/443, TCP/other, UDP, SSH) each produce a distinct recognizable sound
- [ ]**CLAS-02**: Unrecognized traffic is auto-clustered and assigned unique tones automatically
- [ ]**CLAS-03**: On exit, user sees a summary of packet counts and protocol breakdown (printed to stderr)
- [ ]**CLAS-04**: User can enable per-window protocol activity log via `--verbose` flag
### Audio Synthesis
- [ ]**SYNTH-01**: Each traffic class generates a distinct ambient/drone layer (layered sine/harmonic waves)
- [ ]**SYNTH-02**: Drone layer amplitudes evolve over time windows based on traffic volume per class
- [ ]**SYNTH-03**: Multiple drone layers are mixed into a single coherent audio stream without distortion
### Output
- [ ]**OUT-01**: User can specify output file path via `-o` flag (defaults to `netsynth-<timestamp>.mp3`)
- [ ]**OUT-02**: Output is encoded as a valid MP3 file
- [ ]**OUT-03**: Empty captures (zero packets) produce a clear error instead of a corrupt file
## v2 Requirements
Deferred to future release. Tracked but not in current roadmap.
### Audio Tuning
- **TUNE-01**: User can configure time window duration via `--window` flag
- **TUNE-02**: User can configure output duration when reading pcap files via `--duration` flag
- **TUNE-03**: User can customize sound mappings via configuration file
### Distribution
- **DIST-01**: Single static binary with no runtime dependencies
## Out of Scope
| Feature | Reason |
|---------|--------|
| Real-time audio playback | Platform audio API complexity triples scope; users can pipe MP3 to mpv/afplay |
| GUI or web dashboard | Negates single-binary CLI value; doubles scope |
| Rhythmic/percussive output | Ambient/drone is the deliberate differentiator |
| Deep packet inspection | Massive complexity; header-level classification sufficient for audio fingerprint |
| Anomaly detection/alerting | Different user job; stick to audio fingerprint |
