netwatch
Network diagnostics in your terminal.
Inspect connections, capture packets and investigate network problems. Available on Linux, macOS and Windows; capture access and diagnostic coverage vary by platform.
Diagnose ranks possible causes, suggests checks and tracks observed recovery. TLS decryption requires session keys exported by a client you control.
brew install netwatchInstall
brew install netwatchHomebrew must be installed; no tap required.
scoop install netwatchRequires Scoop and Npcap. Install Npcap before capturing packets.
cargo binstall netwatch-tuiRequires cargo-binstall. Downloads a release binary instead of compiling.
Choose your OS and architecture. Linux release binaries bundle libpcap; Windows requires Npcap. Checksums are included.
cargo install netwatch-tui --lockedRequires a current Rust toolchain, a C build toolchain and libpcap headers: libpcap-dev on Debian/Ubuntu, libpcap-devel on Fedora, or libpcap on Arch. Windows source builds also require the Npcap SDK.
git clone https://github.com/matthart1983/netwatch.git && cd netwatch && cargo build --release --lockedRun ./target/release/netwatch after building, or copy it to a directory on your PATH.
Quick start
- 1Start with interface and connection visibility$
netwatch - 2Check setup and unavailable capabilities$
netwatch doctor - 3Enable capture where elevated access is required (macOS / Linux)$
sudo netwatch - 4Use a compact terminal$
netwatch --lite - 5Open the dense view$
netwatch --view dense
Process attribution and TCP metrics depend on the platform, permissions and available measurements. Windows has no kernel TCP metrics collector. A quiet Diagnose screen does not establish that the host is healthy.
The tabs
V cycles Full, Lite and Dense; ? opens help; q quits. In Diagnose, e exports report.md and report.json. AI commentary is optional within Diagnose and off by default.
| Key | View |
|---|---|
| 1 | Dashboard |
| 2 | Connections |
| 3 | Interfaces |
| 4 | Packets |
| 5 | Stats |
| 6 | Topology |
| 7 | Timeline |
| 8 | Processes |
| 9 | Diagnose |
| 0 | Egress |
Decrypt traffic you control
Set tls_keylog_path in NetWatch’s config to /tmp/netwatch-keys.log. Start capture, then launch a client that supports session-key logging with SSLKEYLOGFILE=/tmp/netwatch-keys.log. Capture the handshake; use decrypted:true in Packets. Key export depends on the client and its TLS backend.
- 1Generate a config if you do not already have one$
netwatch --generate-config - 2Create the key log before starting capture$
touch /tmp/netwatch-keys.log
Egress learns outbound destinations and reports policy violations. It warns; it does not block traffic.
Grant cap_net_raw to the executable with sudo setcap cap_net_raw+eip "$(which netwatch)". Reapply after replacing the binary. Optional eBPF has additional kernel and capability requirements and is disabled in sandboxed runs; a capability grant does not prove attribution is available.
Linux worker filesystem restrictions do not provide network isolation. macOS and Windows do not have the same sandbox backend. See the upstream capability matrix before relying on a protection.