NetWatch
An open-source terminal-based network monitoring tool that consolidates packet capture, connection analysis, diagnostics, and other network troubleshooting capabilities into a single terminal interface. It supports macOS, Linux, and Windows and operates as a single binary requiring no configuration.
Timeline (last 90 days)
NetWatch is an open-source terminal network monitoring tool that supports macOS, Linux, and Windows, runs as a single binary with zero configuration, and provides ten functional tabs.
NetWatch's connection view lists each socket along with its associated process, PID, TCP state, GeoIP attribution, RTT, and retransmission information.
NetWatch's process attribution is achieved by combining platform-level socket polling, PKTAP on macOS, and optional eBPF kprobes on Linux.
NetWatch provides real-time decoding, display filters, flow tracking, JA4 fingerprinting, and PCAP export at the packet level.
NetWatch supports decryption of TLS 1.3 and 1.2, provided that session keys are available, by pointing the client's SSLKEYLOGFILE to NetWatch, whereupon the plaintext is decoded in the Packets tab.
NetWatch's built-in diagnostic engine does not use any models; it works by learning a baseline for each metric, opening an issue when a metric goes out of bounds, ranking root causes by checks that can distinguish different causes, and only closing the issue after a fix has proven persistently effective.
NetWatch's egress drift feature learns the hosts, autonomous systems, and ports that each process typically accesses, can promote the learned results into rules, and thereafter flags any new destinations, but it only observes and never blocks.
NetWatch performs background detection of C2 beacon communications, port scans, and DNS tunneling, and freezes the flight recorder to preserve relevant packets when a critical alert is triggered.
The same NetWatch capture can be rendered in three layouts, cycling through them by pressing V: a full ten-tab view, a --lite compact mode adapted for 80x24, and a --view dense dense view.
NetWatch's Linux build is a static binary with libpcap bundled in, and installation methods include brew install netwatch and cargo install netwatch-tui.
1 more timeline events
All Facts (11)
NetWatch is an open-source terminal network monitoring tool that supports macOS, Linux, and Windows, runs as a single binary with zero configuration, and provides ten functional tabs.
50%UnverifiedNetWatch's connection view lists each socket along with its associated process, PID, TCP state, GeoIP attribution, RTT, and retransmission information.
50%UnverifiedNetWatch's process attribution is achieved by combining platform-level socket polling, PKTAP on macOS, and optional eBPF kprobes on Linux.
50%UnverifiedNetWatch provides real-time decoding, display filters, flow tracking, JA4 fingerprinting, and PCAP export at the packet level.
50%UnverifiedNetWatch supports decryption of TLS 1.3 and 1.2, provided that session keys are available, by pointing the client's SSLKEYLOGFILE to NetWatch, whereupon the plaintext is decoded in the Packets tab.
50%UnverifiedNetWatch's built-in diagnostic engine does not use any models; it works by learning a baseline for each metric, opening an issue when a metric goes out of bounds, ranking root causes by checks that can distinguish different causes, and only closing the issue after a fix has proven persistently effective.
50%UnverifiedNetWatch's egress drift feature learns the hosts, autonomous systems, and ports that each process typically accesses, can promote the learned results into rules, and thereafter flags any new destinations, but it only observes and never blocks.
50%UnverifiedNetWatch performs background detection of C2 beacon communications, port scans, and DNS tunneling, and freezes the flight recorder to preserve relevant packets when a critical alert is triggered.
50%UnverifiedThe same NetWatch capture can be rendered in three layouts, cycling through them by pressing V: a full ten-tab view, a --lite compact mode adapted for 80x24, and a --view dense dense view.
50%UnverifiedNetWatch's Linux build is a static binary with libpcap bundled in, and installation methods include brew install netwatch and cargo install netwatch-tui.
50%UnverifiedThe NetWatch project is hosted on GitHub at https://github.com/matthart1983/netwatch.
50%