A network monitor for the terminal that names the process behind every connection, reads TLS you hold the keys to, and tells you what is wrong and how to fix it.

• crates.io
• downloads
• Release
• Packaging status
• Platform
• License

netwatch --view dense. Four boxes, no chrome, every keybind on a border. Download grows up from the axis, upload grows down.

One binary, no config. sudo netwatch and you have live capture with L7 decode, the program behind each socket, and a diagnostic engine that opens an issue when a learned baseline breaks and closes it when the fix holds.

brew install netwatch                 # macOS / Linux
nix-shell -p netwatch                 # NixOS / Nix
paru -S netwatch-tui-bin              # Arch
scoop install netwatch                # Windows (needs Npcap)
cargo install netwatch-tui            # anywhere with Rust and libpcap headers

Prebuilt binaries, including static Linux builds with libpcap bundled, are on the releases page. Windows needs Npcap installed first; building from source needs libpcap-dev (Debian), libpcap-devel (Fedora) or libpcap (Arch). Details in the install reference.

netwatch              # interfaces, connections, config. No privileges.
sudo netwatch         # adds packet capture and health probes
netwatch --lite       # one 80x24 screen
netwatch --view dense # four boxes, 130x44 or larger

1 to 9 and 0 switch tabs, V cycles the three views, ? shows every key. To run without sudo on Linux, grant the capabilities once: sudo setcap 'cap_net_raw,cap_bpf,cap_perfmon+eip' "$(which netwatch)" (why and when to repeat it).

Diagnose (tab 9). Per-metric baselines learned over 30 minutes and scoped to the network that taught them. 25 rules, all active as of 0.30.3, with a suppression graph so a dead gateway is one finding with its consequences underneath. Each cause is ranked by the checks that separated it from the others. Fixes are key-bound, journal before they write, and revert on the next start if the process died mid-write. An issue closes only when the rule's own success condition has held. No model involved. How it works, the design.

Decrypt TLS you control. Point any client's SSLKEYLOGFILE at NetWatch and the plaintext of its TLS 1.3 sessions decodes in the Packets tab. Same mechanism as Wireshark, so it only works for traffic you hold the keys to. TLS decryption.

sudo netwatch                                              # open Packets (4)
SSLKEYLOGFILE=/tmp/keys curl https://example.com           # any client that exports keys
# filter the tab with:  decrypted:true

Egress drift. The Egress tab (0) learns which hosts, autonomous systems and ports each process reaches. Enter promotes that baseline to a rule; the next new destination arrives as drift with an alert. It observes and never blocks. Verdicts are sni, ip, asn, ech, drift, no rule and undeclared under strict = true, because "matched by AS" admits everything a hyperscaler runs and the table should say so. Rule language and export schema.

Process attribution. ss/lsof on every platform, PKTAP on macOS, and an optional eBPF kprobe on Linux (ebpf feature) that catches flows too short for polling. Permissions.

Threat detection. C2 beaconing, port scans and DNS tunnelling run in the background. A critical alert freezes the flight recorder so the bundle exists before you look. JA4 fingerprints each TLS and QUIC handshake so you can pivot to every flow from the same client. Security and forensics, flight recorder, JA4.

Sandboxed. After setup, NetWatch drops privileges and confines itself to a Landlock allow-list on Linux. It parses hostile traffic and cannot read your SSH keys.

Every keybinding, display filters, decoders, themes, configuration.

V cycles between them without a restart; the collectors keep running.

Full is the ten tabs above.

Lite (--lite) fits 80x24: throughput, gateway/DNS/internet reachability, top talkers, six keys. For an SSH session to a Pi or a tmux split.

Dense (--view dense) is the hero image. It needs 130x44 and grows into anything larger. Throughput is braille at two samples per cell, coloured by height so a spike reads before you check the axis. The connection table hoists the selected row's detail, including kernel cwnd, ssthresh, mss and rwnd, into the top of its own box. 1 to 4 zoom a box to the whole screen. Dense and Lite.

SysWatch and DiskWatch share the chrome. ESSH is a Rust SSH client with the same look. NetWatch Cloud is hosted fleet monitoring built on the MIT agent, SDK and dashboard.

I packaged none of this. Dominiquini and kemelzaidan maintain netwatch-tui and netwatch-tui-bin on the AUR, tomasrivera the nixpkgs package, scillidan the Scoop entry, and the Homebrew maintainers took the formula into core. File packaging problems with them and netwatch bugs here.

@lamchau, @fdncred and @PeteE sent patches. Everyone who opened an issue with a repro or argued with a design decision is the reason the output is right on more terminals than mine.

Discussions, issues, CONTRIBUTING.md.

MIT