Tool Open source
NetWatch is a real-time network diagnostics tool that runs in the terminal as a single, configuration-free binary. It captures network activity, attributes connections to processes where available, decodes application-layer protocols, fingerprints clients with JA4, tracks streams, and displays connections, interfaces, packets, protocol statistics, topology, timelines, per-process bandwidth, and egress destinations.
Its diagnostic engine learns baselines, applies diagnostic rules, ranks possible causes, and records issues through verified closure. Egress linting observes destinations, promotes policies, and alerts when activity drifts from them; the tool also supports TLS 1.3 decryption for user traffic, PCAP export, display filters, beaconing and DNS-tunneling analysis, and Prometheus metrics.
NetWatch provides full, lite, and dense terminal views and can run without elevated privileges for basic information, while capture features may require sudo or Linux capabilities. It is distributed for macOS, Linux, Windows, and other platforms through package managers, binaries, and a container. The repository is MIT-licensed; optional LLM commentary in the Diagnose view is disabled by default.
1 use taken from transcripts — each links to the moment in the video.
Monitors network connections, maps them to the processes that opened them, decodes several protocols, fingerprints clients, and detects unusual egress activity.
1 in the library.