NetWatch: The All-in-One Network Monitoring Tool for Your Terminal — Packet Capture and Diagnostics Combined

Troubleshooting networks from the command line has long meant constantly switching between netstat, tcpdump, and Wireshark. The open-source tool NetWatch aims to consolidate all of these capabilities into a single terminal interface — ten functional tabs, each just a keypress away. It supports macOS, Linux, and Windows, and runs as a single binary with zero configuration required.

From Sockets to Packet Capture: Unified Observability

NetWatch's core value proposition is bringing multiple layers of network observation into a single collection pipeline. In the connections view, it lists every socket along with its associated process, PID, TCP state, GeoIP attribution, RTT, and retransmission details. This "process attribution" isn't simply reading from system tables — it combines platform-level socket polling, PKTAP on macOS, and optional eBPF kprobes on Linux to map traffic back to the originating program as accurately as possible.

At the packet level, NetWatch offers real-time decoding, display filters, stream tracking, JA4 fingerprinting, and PCAP export. JA4 is a fingerprinting scheme that has seen widespread adoption in traffic analysis and threat detection in recent years. Its presence in a terminal tool signals that the author's intent goes beyond simply "viewing traffic" — this is designed for real security and troubleshooting workflows.

eBPF (Extended Berkeley Packet Filter) is a programmable mechanism in the Linux kernel that allows sandboxed code to run safely in kernel space without modifying kernel source code or loading kernel modules. kprobe is one of eBPF's most commonly used attachment points, enabling probes to be inserted at the entry or return of nearly any kernel function to capture arguments, return values, and call context. NetWatch uses this mechanism on Linux to trace socket system calls, enabling precise process-level attribution of traffic at the packet layer — more real-time and accurate than polling system files like /proc/net/tcp, and notably better at attributing short-lived connections. PKTAP is a similar packet capture interface on macOS that simultaneously captures packets and process metadata at the network stack level, serving as the platform primitive for "process attribution" on macOS.

JA4 is a next-generation TLS fingerprinting scheme introduced by FoxIO in 2023, designed to replace the widely used JA3. It generates a short string that identifies the characteristics of a client's TLS implementation by structurally hashing fields from the TLS ClientHello handshake message — including cipher suites, extension types, elliptic curves, and more. Compared to JA3, JA4 introduces finer-grained field ordering and segmentation rules, making it insensitive to extension ordering and reducing fingerprint drift caused by randomization. In threat detection, even when attackers rotate IPs or domain names, the TLS fingerprint of a C2 framework often remains consistent — which is why JA4 has been widely integrated into security tools like Suricata and Zeek for identifying malware communication patterns.

TLS Decryption: The Same Mechanism as Wireshark

For encrypted traffic, NetWatch supports decryption of TLS 1.3 and 1.2 — provided you have the session keys. The approach is identical to Wireshark: point the client's SSLKEYLOGFILE to NetWatch, and plaintext will be decoded directly in the Packets tab. This is particularly useful for developers debugging their own services' encrypted communications — no need to open Wireshark separately and load a key file. Capture and decryption happen in the same interface.

SSLKEYLOGFILE is an environment variable originally introduced by NSS (Mozilla's Network Security Services) and later widely supported by mainstream TLS implementations. When a client program (such as Chrome, Firefox, curl, or openssl) detects that this variable points to a file path, it appends session keys in NSS Key Log format to that file after each TLS handshake completes. These keys include CLIENT_RANDOM and the corresponding master or traffic keys, which Wireshark and NetWatch can read to decrypt captured encrypted traffic in real time or offline. It's worth noting that this mechanism relies on the client program's active cooperation — server-side traffic or scenarios using Hardware Security Modules (HSMs) cannot be decrypted this way, and the key file itself constitutes sensitive credentials that should be stored securely or deleted immediately after debugging.

A Model-Free Diagnostic Engine

NetWatch includes a built-in diagnostic engine, and the author explicitly emphasizes that it involves "no models whatsoever." The way it works: it learns a baseline for each individual metric, opens an issue when a metric crosses a threshold, ranks possible root causes by "checks that can distinguish between different causes," and only closes an issue after a fix has remained effective over time.

This logic is closer to traditional rule-based anomaly detection and root cause analysis than to the AI-driven inference that's currently in vogue. In network troubleshooting scenarios, explainability is often more valuable than cleverness — an engine that can clearly tell you "which check distinguishes this cause from that one" is far easier for engineers to trust than a black-box prediction.

Security-Oriented Behavioral Detection

On the security side, NetWatch offers several noteworthy capabilities:

• Egress drift: It learns which hosts, autonomous systems (ASes), and ports each process typically accesses. You can promote these learned patterns into rules, after which any new destination will be flagged. Note that it only observes — it never blocks.
• Background threat detection: Runs background detection for C2 beaconing, port scanning, and DNS tunneling. When a critical alert triggers, it freezes the "flight recorder," ensuring that the relevant packets are already saved before you begin your investigation.

The design philosophy of "preserve evidence first, then let you investigate" directly addresses the classic problem of "the scene has already disappeared" when responding to sudden incidents — a genuinely valuable feature for incident response.

C2 beaconing (Command and Control Beaconing) is a common way for malware to maintain contact with an attacker's control server: the implant initiates outbound connections at fixed or randomly jittered intervals to receive commands or exfiltrate data. This periodic outbound traffic pattern is statistically distinct from normal human-driven traffic. DNS tunneling encodes arbitrary data into the subdomain fields of DNS queries, relaying data out through recursive DNS resolution — commonly used to bypass firewalls that only allow outbound DNS traffic. Both techniques are extremely common in real-world intrusions, and the ability to perform heuristic detection of these at the terminal tool level positions NetWatch functionally closer to a lightweight NDR (Network Detection and Response) tool than a simple traffic viewer.

Full-Spectrum Metrics and Three Layout Modes

Beyond the above features, NetWatch also covers throughput, network interfaces, protocol distribution, traceroute topology, per-process bandwidth, and a connection timeline organized by TCP state — essentially a comprehensive view of everything you need for day-to-day network monitoring.

On the interface side, the same captured data can be presented in three layouts, cycled at runtime by pressing V: the full ten-tab view, a --lite compact mode optimized for 80x24 terminals, and a dense view via --view dense that provides four borderless boxes with braille-rendered throughput graphs. The ability to freely switch display density without changing what's being collected is quite handy for anyone working in small windows or remote terminals.

Installation

NetWatch supports macOS, Linux, and Windows. The Linux build is a static binary with libpcap bundled in, eliminating dependency configuration. Installation is straightforward:

brew install netwatch
cargo install netwatch-tui

The project is hosted on GitHub: https://github.com/matthart1983/netwatch

Summary

NetWatch's approach is to compress capabilities that typically live across multiple tools — connection attribution, deep packet inspection, TLS decryption, rule-based diagnostics, and security detection — into a single zero-configuration terminal application. Rather than chasing AI trends, it deliberately chooses an explainable baseline-driven approach for its diagnostic engine, which is a pragmatic tradeoff in operations and security contexts where trustworthiness matters. For developers, SREs, and security engineers who live in the terminal, it's well worth trying.