[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-74679":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":10,"totalLinesOfCode":10,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":16,"subscribersCount":16,"size":16,"stars1d":17,"stars7d":18,"stars30d":19,"stars90d":16,"forks30d":16,"starsTrendScore":20,"compositeScore":21,"rankGlobal":10,"rankLanguage":10,"license":22,"archived":23,"fork":23,"defaultBranch":24,"hasWiki":25,"hasPages":25,"topics":26,"createdAt":10,"pushedAt":10,"updatedAt":27,"readmeContent":28,"aiSummary":29,"trendingCount":16,"starSnapshotCount":16,"syncStatus":30,"lastSyncTime":31,"discoverSource":32},74679,"netwatch","matthart1983\u002Fnetwatch","matthart1983","Real-time network diagnostics in your terminal. One command, zero config, instant visibility.","https:\u002F\u002Fnetwatchlabs.com",null,"Rust",2012,77,13,1,0,74,114,266,222,27.68,"MIT License",false,"main",true,[],"2026-06-12 02:03:26","\u003Cp align=\"center\">\n  \u003Ch1 align=\"center\">NetWatch\u003C\u002Fh1>\n  \u003Cp align=\"center\">\n    \u003Cstrong>Real-time network diagnostics in your terminal. One command, zero config, instant visibility.\u003C\u002Fstrong>\n  \u003C\u002Fp>\n  \u003Cp align=\"center\">\n    \u003Ca href=\"https:\u002F\u002Fcrates.io\u002Fcrates\u002Fnetwatch-tui\">\u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fcrates\u002Fv\u002Fnetwatch-tui.svg\" alt=\"crates.io\">\u003C\u002Fa>\n    \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fmatthart1983\u002Fnetwatch\u002Freleases\">\u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fgithub\u002Fv\u002Frelease\u002Fmatthart1983\u002Fnetwatch\" alt=\"Release\">\u003C\u002Fa>\n    \u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Fplatform-macOS%20%7C%20Linux-blue\" alt=\"Platform\">\n    \u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Flicense-MIT-green\" alt=\"License\">\n    \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fmatthart1983\u002Fnetwatch\u002Fwiki\">\u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Fdocs-Wiki-blue?logo=github\" alt=\"Wiki\">\u003C\u002Fa>\n  \u003C\u002Fp>\n  \u003Cp align=\"center\">\n    \u003Ca title=\"Tool of The Week on Terminal Trove\" href=\"https:\u002F\u002Fterminaltrove.com\u002Fnetwatch\u002F\">\u003Cimg src=\"terminal_trove_totw_badge.svg\" alt=\"Terminal Trove Tool of The Week\" height=\"54\" \u002F>\u003C\u002Fa>\n  \u003C\u002Fp>\n\u003C\u002Fp>\n\n\u003Cp align=\"center\">\n  \u003Cimg src=\"demo.gif\" alt=\"NetWatch — Dashboard, Connections, Topology, Processes, Timeline\" width=\"800\">\n\u003C\u002Fp>\n\n\u003Cp align=\"center\">\n  \u003Cem>Launch → see every interface, connection, and health probe instantly. Arm the flight recorder before an incident disappears.\u003C\u002Fem>\n\u003C\u002Fp>\n\n\u003Cp align=\"center\">\n  \u003Cem>Siblings: \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fmatthart1983\u002Fsyswatch\">SysWatch\u003C\u002Fa> (system) and \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fmatthart1983\u002Fdiskwatch\">DiskWatch\u003C\u002Fa> (disk). Same chrome. Different surface.\u003C\u002Fem>\n\u003C\u002Fp>\n\n---\n\n## Install\n\n```bash\n# Homebrew (macOS \u002F Linux)\nbrew install matthart1983\u002Ftap\u002Fnetwatch\n\n# Cargo\ncargo install netwatch-tui\n\n# Pre-built binaries — see Releases\n```\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>All platforms & options\u003C\u002Fstrong>\u003C\u002Fsummary>\n\n| Platform | Download |\n|----------|----------|\n| Linux (x86_64, Debian\u002FUbuntu) | [`netwatch-linux-x86_64.tar.gz`](https:\u002F\u002Fgithub.com\u002Fmatthart1983\u002Fnetwatch\u002Freleases\u002Flatest) |\n| Linux (aarch64, Debian\u002FUbuntu) | [`netwatch-linux-aarch64.tar.gz`](https:\u002F\u002Fgithub.com\u002Fmatthart1983\u002Fnetwatch\u002Freleases\u002Flatest) |\n| Linux (x86_64, static — Arch\u002FFedora\u002FAlpine\u002Fany distro) | [`netwatch-linux-x86_64-static.tar.gz`](https:\u002F\u002Fgithub.com\u002Fmatthart1983\u002Fnetwatch\u002Freleases\u002Flatest) |\n| Linux (aarch64, static — Arch\u002FFedora\u002FAlpine\u002Fany distro) | [`netwatch-linux-aarch64-static.tar.gz`](https:\u002F\u002Fgithub.com\u002Fmatthart1983\u002Fnetwatch\u002Freleases\u002Flatest) |\n| macOS (Intel) | [`netwatch-macos-x86_64.tar.gz`](https:\u002F\u002Fgithub.com\u002Fmatthart1983\u002Fnetwatch\u002Freleases\u002Flatest) |\n| macOS (Apple Silicon) | [`netwatch-macos-aarch64.tar.gz`](https:\u002F\u002Fgithub.com\u002Fmatthart1983\u002Fnetwatch\u002Freleases\u002Flatest) |\n\nThe `-static` Linux builds bundle libpcap and have no runtime dependencies — use these on Arch, Fedora, Alpine, or any distro where the default builds report `libpcap.so.0.8: cannot open shared object file`.\n\n**From source:**\n\n```bash\ngit clone https:\u002F\u002Fgithub.com\u002Fmatthart1983\u002Fnetwatch.git && cd netwatch\ncargo build --release\n```\n\n**Prerequisites:** Rust 1.70+, libpcap (`sudo apt install libpcap-dev` on Linux, included on macOS)\n\n\u003C\u002Fdetails>\n\n## Quick Start\n\n```bash\nnetwatch            # Interface stats, connections, config\nsudo netwatch       # Full mode — adds health probes + packet capture\nnetwatch --generate-config\n```\n\n### Running without sudo (Linux)\n\nPacket capture and eBPF process attribution need elevated capabilities, but\nyou don't have to run the whole TUI as root. Grant them once to the binary\nand `netwatch` works for your normal user thereafter:\n\n```bash\nsudo setcap 'cap_net_raw,cap_bpf,cap_perfmon+eip' \"$(which netwatch)\"\nnetwatch\n```\n\n| Capability       | What it unlocks                                                                |\n|------------------|--------------------------------------------------------------------------------|\n| `cap_net_raw`    | Opening packet capture on a live interface (libpcap)                           |\n| `cap_bpf`        | Loading the kernel-level process-attribution kprobe (kernel ≥ 5.10)            |\n| `cap_perfmon`    | Reading the BPF ring buffer the kprobe writes to                               |\n\nWithout them netwatch still runs — it falls back to `ss`\u002F`lsof`-style polling\nfor process attribution and skips packet capture. The Connections tab's\nheader surfaces the active source (`attribution: ebpf`, `attribution: pktap`,\nor `attribution: lsof — ebpf unavailable: …`) so you can tell at a glance\nwhich path is live.\n\n### Flight Recorder\n\nCatch transient failures that vanish before you can inspect them:\n\n```text\nShift+R   Arm a rolling 5-minute recorder\nShift+F   Freeze the current incident window\nShift+E   Export an incident bundle to ~\u002Fnetwatch_incident_YYYYMMDD_HHMMSS\u002F\n```\n\nEach bundle includes `summary.md`, `connections.json`, `health.json`, `bandwidth.json`, `dns.json`, `alerts.json`, `manifest.json`, and `packets.pcap` when capture data is available.\n\n---\n\n## Why NetWatch?\n\nMost network tools make you choose: **see what's happening** (iftop, bandwhich) or **inspect packets** (Wireshark, tshark). NetWatch does both in a single terminal — from a 10,000-foot dashboard view down to individual packet bytes.\n\n| What you get | How fast |\n|---|---|\n| Every interface with live RX\u002FTX sparklines | **Instant** |\n| Every connection with process name + PID | **Instant** |\n| Gateway & DNS health with latency heatmap | **Instant** |\n| Wireshark-style packet capture + decode | One keypress |\n| Rolling incident capture + frozen export bundle | One keypress |\n| Network topology map with traceroute | One keypress |\n| PCAP export for offline analysis | One keypress |\n| AI-analyzed network insights (opt-in, local or cloud LLM) | One setting |\n\n**No config files. No setup. No flags required.**\n\n---\n\n## Features\n\n### 🖥️ Dashboard\nEverything at a glance — interfaces, aggregate bandwidth graph, top connections, gateway\u002FDNS health probes, and a color-coded latency heatmap. Useful in 5 seconds.\n\n### 🔌 Connections\nEvery open socket with **process name**, PID, protocol, state, remote address, GeoIP location, and per-connection **latency sparklines**. Sort by any column, jump to filtered packet view.\n\n### 📡 Interfaces\nPer-interface detail: IPv4\u002FIPv6 addresses, MAC, MTU, total RX\u002FTX with individual sparkline history, errors, and drops.\n\n### 📦 Packet Capture\nLive capture with deep protocol decoding — **DNS** (queries, types, response codes), **TLS** (version, SNI), **HTTP** (method, path, status), **ICMP**, **ARP**, **DHCP**, **NTP**, **mDNS**, and 25+ service labels. TCP stream reassembly, handshake timing, display filters, BPF capture filters, bookmarks, and PCAP export.\n\n### 📈 Processes\nPer-process bandwidth ranking with live RX\u002FTX rates, totals, and connection counts. Useful for spotting the process behind a noisy host or bandwidth spike.\n\n### 🎥 Flight Recorder\nArm a rolling 5-minute capture window, then freeze it manually or when a critical network-intel alert fires. Export a self-contained incident bundle with a human-readable summary, `.pcap`, connection\u002Fprocess context, health samples, DNS analytics, and alert history.\n\n### 🗺️ Topology\nASCII network map showing your machine, gateway, DNS servers, and top remote hosts with connection counts and color-coded health indicators. Built-in **traceroute** from any host.\n\n### 📊 Stats\nProtocol hierarchy table with packet counts, byte totals, and distribution bars. TCP handshake histogram with min\u002Favg\u002Fmedian\u002Fp95\u002Fmax.\n\n### ⏱️ Timeline\nGantt-style connection timeline — when each connection was active, color-coded by TCP state. Adjustable windows from 1 minute to 1 hour.\n\n### 🤖 AI Insights (opt-in)\nFeed a live snapshot of your network — protocol mix, top talkers, DNS queries, connection states, health probes, expert warnings — to an LLM every 15 seconds and get bullet-point analysis rendered in the TUI. Surfaces anomalies, beaconing patterns, suspicious DNS, and health regressions you might miss scrolling through raw data.\n\n**Off by default.** Enable via Settings (`,`) → AI Insights: on. Supports local [Ollama](https:\u002F\u002Follama.com) (default), a remote Ollama host on your network, or Ollama **cloud models** — point the AI Endpoint setting at the cloud URL and skip local setup entirely. No API keys in netwatch. See [INSIGHTS.md](INSIGHTS.md) for full setup.\n\n### ⚙️ Settings\nBuilt-in settings overlay for theme, default tab, refresh rate, capture interface, packet-follow mode, GeoIP paths, BPF filter, AI Insights, and alert thresholds. Use `,` to open it and `S` to persist changes.\n\n---\n\n## Display Filters\n\nWireshark-style filter syntax in the Packets tab:\n\n```\ntcp                        # Protocol\n192.168.1.42               # IP address (src or dst)\nip.src == 10.0.0.1         # Directional\nport 443                   # Port\nstream 7                   # Stream index\ncontains \"hello\"           # Text search\ntcp and port 443           # Combinators\n!dns                       # Negation\ngoogle                     # Bare word → contains \"google\"\n```\n\n---\n\n## Keyboard Controls\n\n| Key | Action |\n|-----|--------|\n| `1`–`9` | Switch tabs (tab `9` Insights appears when AI Insights is enabled) |\n| `↑` `↓` | Navigate |\n| `p` | Pause \u002F resume |\n| `r` | Force refresh |\n| `R` | Arm \u002F reset flight recorder |\n| `F` | Freeze current incident window |\n| `E` | Export incident bundle |\n| `\u002F` | Filter (Packets) |\n| `c` | Start\u002Fstop capture (Packets) |\n| `s` | Sort \u002F stream view |\n| `w` | Export to .pcap |\n| `T` | Traceroute |\n| `W` | Whois lookup |\n| `t` | Cycle theme |\n| `,` | Settings |\n| `?` | Help |\n| `q` | Quit |\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>Full keybinding reference\u003C\u002Fstrong>\u003C\u002Fsummary>\n\n### Connections\n| Key | Action |\n|-----|--------|\n| `s` | Cycle sort column |\n| `Enter` | Jump to Packets with connection filter |\n| `T` | Traceroute to remote IP |\n| `W` | Whois lookup |\n| `e` | Export connections to JSON + CSV |\n| `g` | Toggle GeoIP column |\n\n### Packets\n| Key | Action |\n|-----|--------|\n| `c` | Start\u002Fstop capture |\n| `R` | Arm \u002F disarm flight recorder |\n| `F` | Freeze incident window |\n| `E` | Export incident bundle |\n| `i` | Cycle capture interface |\n| `b` | Set BPF capture filter |\n| `\u002F` | Display filter |\n| `s` | Stream view |\n| `w` | Export .pcap |\n| `x` | Clear packets |\n| `m` | Bookmark packet |\n| `n`\u002F`N` | Next\u002Fprev bookmark |\n| `f` | Auto-follow |\n| `W` | Whois lookup for selected packet IPs |\n\n### Stream View\n| Key | Action |\n|-----|--------|\n| `→` `←` | Filter A→B \u002F B→A |\n| `a` | Both directions |\n| `h` | Toggle hex\u002Ftext |\n| `Esc` | Close |\n\n### Topology\n| Key | Action |\n|-----|--------|\n| `T` | Traceroute to selected host |\n| `Enter` | Jump to Connections for host |\n| `Esc` | Close traceroute overlay |\n\n### Timeline\n| Key | Action |\n|-----|--------|\n| `t` | Cycle time window (1m–1h) |\n| `Enter` | Jump to Connections |\n\n### Processes\n| Key | Action |\n|-----|--------|\n| `↑` `↓` | Navigate |\n| `e` | Export connections to JSON + CSV |\n\n### Settings\n| Key | Action |\n|-----|--------|\n| `↑` `↓` | Navigate settings |\n| `Enter` | Edit selected setting |\n| `←` `→` | Cycle theme |\n| `S` | Save config |\n| `Esc` | Close |\n\n\u003C\u002Fdetails>\n\n---\n\n## Incident Bundle\n\nWhen the Flight Recorder is armed, NetWatch keeps a bounded rolling window of evidence. On freeze or export, it writes:\n\n```text\nnetwatch_incident_20260403_103501\u002F\n  summary.md\n  manifest.json\n  connections.json\n  health.json\n  bandwidth.json\n  dns.json\n  alerts.json\n  packets.pcap   # present when packets were captured\n```\n\nThis makes bug reports, incident reviews, and demos much easier: you keep the packet evidence and the operational context that explains it.\n\n---\n\n## Permissions\n\n| Feature | `netwatch` | `sudo netwatch` |\n|---------|:---:|:---:|\n| Interface stats & rates | ✅ | ✅ |\n| Active connections | ✅ | ✅ |\n| Network configuration | ✅ | ✅ |\n| Health probes (ICMP) | ❌ | ✅ |\n| Packet capture | ❌ | ✅ |\n\nDegrades gracefully — features that need root show a clear message, never crash.\n\n---\n\n## Themes\n\n5 built-in themes with instant switching via `t`:\n\n**Dark** (default) · **Light** · **Solarized** · **Dracula** · **Nord**\n\nTheme changes apply immediately. Persist them from the Settings overlay with `S`.\n\n---\n\n## Configuration\n\nNetWatch runs well with zero setup, but you can persist preferences for theme, default tab, refresh rate, capture interface, GeoIP database paths, packet-follow behavior, BPF filter, and alert thresholds.\n\n```bash\nnetwatch --generate-config\n```\n\nThat writes a starter config file to your platform config directory. You can also edit settings live in the app with `,` and save with `S`.\n\n---\n\n## How It Works\n\n| Collector | Interval | macOS | Linux |\n|-----------|:--------:|-------|-------|\n| Interface stats | 1s | `netstat -ib` | `\u002Fsys\u002Fclass\u002Fnet\u002F*\u002Fstatistics` |\n| Connections | 2s | `lsof -i -n -P` | `\u002Fproc\u002Fnet\u002Ftcp` + `\u002Fproc\u002F*\u002Ffd` |\n| Health probes | 5s | `ping` | `ping` |\n| Packets | Real-time | libpcap (BPF) | libpcap |\n| GeoIP | On-demand | MaxMind .mmdb \u002F ip-api.com | MaxMind .mmdb \u002F ip-api.com |\n\n```\nRaw bytes → Ethernet → IPv4\u002FIPv6\u002FARP → TCP\u002FUDP\u002FICMP → DNS\u002FTLS\u002FHTTP\u002FDHCP\u002FNTP\n                                             ↓\n                               Stream tracking · Handshake timing\n                               Expert info · Payload extraction\n```\n\n---\n\n## Related\n\n**[ESSH](https:\u002F\u002Fgithub.com\u002Fmatthart1983\u002Fessh)** — If you manage the hosts you monitor, ESSH is built for the same workflow. Same TUI aesthetic, pure-Rust SSH client with concurrent sessions, live remote host diagnostics (CPU, memory, disk, processes — no agent install), fleet management, file transfer, and port forwarding. Connects where NetWatch observes.\n\n**[NetWatch Cloud](https:\u002F\u002Fwww.netwatchlabs.com)** — Hosted fleet monitoring for the servers you run NetWatch against. Tiny Rust agent on each Linux host, real-time dashboard, email + Slack alerts on latency, packet loss, or hosts going offline. **Free while we grow.**\n\nNetWatch Cloud is a separate codebase with its own open-source ecosystem (this TUI is intentionally independent — same author, different philosophy):\n\n- [`netwatch-sdk`](https:\u002F\u002Fgithub.com\u002Fmatthart1983\u002Fnetwatch-sdk) — shared Rust wire format + headless collectors ([crates.io](https:\u002F\u002Fcrates.io\u002Fcrates\u002Fnetwatch-sdk))\n- [`netwatch-agent`](https:\u002F\u002Fgithub.com\u002Fmatthart1983\u002Fnetwatch-agent) — audit-able Rust binary that runs on your hosts and reports to NetWatch Cloud\n- [`netwatch-dashboard`](https:\u002F\u002Fgithub.com\u002Fmatthart1983\u002Fnetwatch-dashboard) — Next.js web UI for the hosted backend\n\nThe hosted backend is proprietary; the agent, SDK, and dashboard that talk to it are MIT.\n\n---\n\n## Contributing\n\nContributions welcome! See [CONTRIBUTING.md](CONTRIBUTING.md) for coding conventions and [WIKI.md](WIKI.md) for a current architecture guide.\n\n## License\n\nMIT\n","NetWatch 是一个用于实时网络诊断的终端工具。它通过一条命令即可启动，无需配置，能够即时显示网络接口、连接状态及健康检查信息。基于 Rust 语言开发，确保了高性能与低资源消耗。该工具特别适用于需要快速排查网络问题或持续监控网络状况的场景，如系统管理员日常运维、开发人员调试网络相关应用等。支持 macOS 和 Linux 平台，并提供多种安装方式以适应不同用户需求。",2,"2026-06-11 03:50:23","high_star"]