u/Potential-Access-595

NetWatch is a terminal network monitor in Rust. v0.29.0 adds a third view for when you have a big terminal.

Dense view — netwatch --view dense

• Four boxes filling the terminal. No header bar, no menu bar, no status bar — identity, sort state, paging and every keybind live inside the box borders, so every row carries data.
• Mirrored throughput graph: download grows up from a shared time axis, upload grows down from it. Traffic symmetry is a shape you recognise before you read a number. Braille at two samples per character cell, and colour encodes magnitude, not which series it belongs to.
• Per-interface rates withr-hop latency budgets (gateway / DNS / internet / slowest peer), and a connection table whose selected row expands in
• Wants 130×44 and grows into whatever you give it; falls back to 80×24.

Kernel TCP state per connection — cwnd, ssthresh, mss, rwnd read straight from the kernel (list64` on macOS) and normalised so the numbers mean the same thing on both. Throughput tells you what happened; cwnd agains.

**Saturation against real e negotiated link rate (sysfs on Linux, getifaddrs on macOS) instead of guessing.

Most terminal net tools stop at "what's eating my bandwidth." NetWatch goes into the traffic itself.

Live TLS 1.3 decryption — point a cooperating client's SSLKEYLOGFILE at it, read the plaintext inline. Same trick as Wireshark, no MITM. QUIC 1-RTT + HTTP/3 too.

JA4 / JA4Q fingerprinting — TLS and QUIC. Filter live with ja4:<fp>.

17 L7 decoders — TLS, QUIC, HTTP, DNS, SSH, MQTT, SNMP, BitTorrent, more — with stream reassembly.

Detection built in — port scans, C2 beaconing, DNS tunneling. Critical alert auto-freezes the recorder.

Flight Recorder — freeze any incident to a portable .pcap + context bundle.

eBPF process attribution — which process opened the socket, not lsof polling.

Landlock-sandboxed — parses hostile traffic but can't touch your SSH keys.

Rust, 500+ tests, MIT, macOS + Linux. Demo GIF decrypts a live TLS 1.3 session in the repo:

github.com/matthart1983/netwatch

Alpha — don't expect too much. Sharing early for feedback.

AgentWatch is a single-host TUI for driving and observing agentic AI workflows: one prompt drives the agents, a full instrument panel shows what they're doing. Front-end to a separate runtime (neo); Rust, one static binary, no daemon/sudo.

Features

• 🧙 Setup wizard — define your environment, drop in keys (stored 0600, injected at launch), build a team, align a model per agent
• 🎭 Agent personas + ASCII avatars — each agent gets a name, a persona (injected into the run), and a customizable avatar; the pipeline reads like a cast of characters
• 🛠️ Team builder — assemble agents, set parallel counts, live per-task cost preview
• 📊 10 observer tabs — Agents · Plans · Sessions · Tools · Models · Cost · Overview · Insights
• 🔌 Multi-provider — Anthropic / OpenAI / OpenRouter / Ollama (local) / Copilot

Caveats: driver tabs need neo running; some cost numbers still read $0 (computed upstream); key validation is presence-based for now. macOS/Linux.

Demo gif + repo (MIT): https://github.com/matthart1983/agentwatch

Feedback welcome

SysWatch is a single-host diagnostics TUI — one terminal for when a box feels off, instead of htop + iostat + nettop + powermetrics in five panes.

Twelve tabs, all live:

• CPU / Memory / Disks / FS — aggregate + per-core sparklines, top consumers
• GPU (new in v0.7.0) — utilization + VRAM as ~120s time-series, renderer/tiler engine split, temp/power — no sudo
• Procs — sortable, filterable process table
• Power — battery, throttle, per-rail draw, fans
• Services — launchctl / systemctl at a glance
• Net — per-interface throughput
• Timeline — scrub back through the whole session
• Insights — plain-English anomaly cards ("runaway process: … sustained 100% CPU")

Rust + ratatui. macOS + Linux, MIT. Sibling to netwatch (network) and diskwatch (disk).

Repo: https://github.com/matthart1983/syswatch

SysWatch is a single-host diagnostics TUI — one terminal for when a box feels off, instead of htop + iostat + nettop + powermetrics in five panes.

Twelve tabs, all live:

• CPU / Memory / Disks / FS — aggregate + per-core sparklines, top consumers
• GPU (new in v0.7.0) — utilization + VRAM as ~120s time-series, renderer/tiler engine split, temp/power — no sudo
• Procs — sortable, filterable process table
• Power — battery, throttle, per-rail draw, fans
• Services — launchctl / systemctl at a glance
• Net — per-interface throughput
• Timeline — scrub back through the whole session
• Insights — plain-English anomaly cards ("runaway process: … sustained 100% CPU")

Rust + ratatui. macOS + Linux, MIT. Sibling to netwatch (network) and diskwatch (disk).

Repo: https://github.com/matthart1983/syswatch

SysWatch is a single-host diagnostics TUI — one terminal for when a box feels off, instead of htop + iostat + nettop + powermetrics in five panes.

Twelve tabs, all live:

• CPU / Memory / Disks / FS — aggregate + per-core sparklines, top consumers
• GPU (new in v0.7.0) — utilization + VRAM as ~120s time-series, renderer/tiler engine split, temp/power — no sudo
• Procs — sortable, filterable process table
• Power — battery, throttle, per-rail draw, fans
• Services — launchctl / systemctl at a glance
• Net — per-interface throughput
• Timeline — scrub back through the whole session
• Insights — plain-English anomaly cards ("runaway process: … sustained 100% CPU")

Rust + ratatui. macOS + Linux, MIT. Sibling to netwatch (network) and diskwatch (disk).

Repo: https://github.com/matthart1983/syswatch

- Linux security sandbox (Landlock filesystem allow-list + capability drop) — applied after pcap/eBPF are up, three modes (off / best-effort / strict)

- Native DGRAM ICMP ping — works under sandbox without CAP_NET_RAW; replaces subprocess /usr/bin/ping

- Native UDP+TTL traceroute via IP_RECVERR / MSG_ERRQUEUE — replaces subprocess traceroute

- TCP retransmit + out-of-order analytics per stream; shown inline on Connections (`ESTAB ↻3`) and broken out per-direction in Stream View

- 8 new DPI classifiers: MQTT, STUN, BitTorrent, NetBIOS, SNMP, SSDP, FTP, LLMNR — plus IGMP message-type decode at the IP layer

- Full QUIC Initial decryption (RFC 9001 / 9369) with cross-packet ClientHello reassembly — extracts SNI from Chrome's fragmented QUIC handshakes

- btop-style fade + faint grid as a Settings toggle — applies to all charts (right-bright/left-dim columns) AND all tables (top-bright/bottom-dim rows)

- Process attribution via eBPF kprobe on Linux, PKTAP on macOS; falls back to lsof/ss when unprivileged

- Topology view with auto-traceroute + ISP detection

- Flight Recorder — rolling 5-minute incident bundle (pcap + JSON dumps + summary.md) on Shift+R/F/E

- Network intelligence detectors: port scan, beaconing, DNS tunneling, bandwidth threshold

- Health probing with latency heatmap; inline WHOIS on Connections tab

- 13 DPI classifiers total now: TLS/SNI, QUIC, DNS, HTTP, SSH, MQTT, STUN, BitTorrent, NetBIOS, SNMP, SSDP, FTP, LLMNR

- Filter prefixes on Packets + Connections: app:tls, sni:reddit.com, host:api.example.com

- 8 themes, btop/bars graph styles, per-tab sort picker

https://github.com/matthart1983/netwatch

Shipped v0.16.0 with end-to-end Deep Packet Inspection.

- **Packets tab:** INFO column is L7-aware and color-coded. Filter syntax: `app:quic`, `sni:reddit`, `host:github`.

- **Dashboard top-talkers:** real hostnames in the bandwidth panel.

- **Packets detail pane:** decodes QUIC v1/v2 Initial packets and shows the inner CRYPTO/PADDING/PING frame structure.

Full RFC 9001 / 9369 QUIC Initial decryption — HKDF-Expand-Label keys, AES-128 header protection, AES-128-GCM AEAD,

cross-packet ClientHello reassembly. Most peer tools just tag flows as `QUIC`; this one tells you the hostname.

cargo install netwatch-tui

# or

brew install matthart1983/tap/netwatch

Rust + ratatui, MIT. https://github.com/matthart1983/netwatch

- Real read/write byte split + per-direction service time per device (IOKit Statistics on macOS, `/proc/diskstats` on Linux). Most TUIs only show combined throughput.

- p50 / p99 latency over a rolling 60s window, per direction, color-thresholded.

- APFS container tree on macOS — containers, volumes, roles, FileVault state, mount points — in one view.

- mdraid arrays on Linux with member health (`[UUUU]`), failed/spare/write-mostly flags, and resync progress bars when active.

- Hot Files watcher — live event-rate per path via FSEvents (macOS) / inotify (Linux). No privileges required.

- Plain-English insights: capacity warnings, SMART failures, NVMe wear and spare-block depletion, drive temperature, p99 latency outliers, hot-file runaway, removable drives.

- Custom baseline-aware sparkline so charts stay visually grounded during idle.

- Single 130×36 character grid, responsive reflow ≥ 110×30. JetBrains Mono, terminal-green accent, MIT.

**Install**

cargo install diskwatch

Or `git clone` and `cargo run --release`. Rust 1.75+, no system deps. Optional `smartctl` unlocks full SMART attribute tables; without it the tab degrades cleanly.

Links:

- https://github.com/matthart1983/diskwatch

- https://crates.io/crates/diskwatch

Built with AI coding Assistance.

Shipped SysWatch — a single-host system diagnostics TUI. Sibling to netwatch.

Twelve tabs covering everything that runs on one box: CPU, memory, disks, FS, procs, GPU, power, services, network — plus a Timeline scrubber that rewinds the entire app and an Insights tab that calls out swap thrash, runaway procs, disk full, etc. in plain English.

macOS + Linux. Read-only by design.

https://github.com/matthart1983/syswatch

▎ v0.14 just shipped. netwatch is a one-binary, zero-config network TUI built

▎ with ratatui — drops you straight into a live picture of what your box is

▎ talking to.

What's new in 0.14:

- Topology view — local peers on the left, public Internet on the right, with

router and ISP as the spine. Health dots pinned to the trunks make link status

legible at a glance.

- Auto-traceroute on launch — the ISP gateway hop populates without pressing a

key.

- Real RTT + CPU on Processes — per-process kernel RTT (min across that

process's TCP connections) and CPU%, with rolling history sparklines.

- Timeline detectors — RTT spikes and interface flaps surface as discrete

events instead of disappearing into the chart.

5.6 MB static binary. Linux/macOS/Windows, x86_64 + ARM.

Install: cargo install netwatch-tui or brew install matthart1983/tap/netwatch

Repo: https://github.com/matthart1983/netwatch

This software's code is partially AI-generated.

▎ v0.14 just shipped. netwatch is a one-binary, zero-config network TUI built

▎ with ratatui — drops you straight into a live picture of what your box is

▎ talking to.

What's new in 0.14:

- Topology view — local peers on the left, public Internet on the right, with

router and ISP as the spine. Health dots pinned to the trunks make link status

legible at a glance.

- Auto-traceroute on launch — the ISP gateway hop populates without pressing a

key.

- Real RTT + CPU on Processes — per-process kernel RTT (min across that

process's TCP connections) and CPU%, with rolling history sparklines.

- Timeline detectors — RTT spikes and interface flaps surface as discrete

events instead of disappearing into the chart.

5.6 MB static binary. Linux/macOS/Windows, x86_64 + ARM.

Install: cargo install netwatch-tui or brew install matthart1983/tap/netwatch

Repo: https://github.com/matthart1983/netwatch

▎ v0.14 just shipped. netwatch is a one-binary, zero-config network TUI built

▎ with ratatui — drops you straight into a live picture of what your box is

▎ talking to.

What's new in 0.14:

- Topology view — local peers on the left, public Internet on the right, with

router and ISP as the spine. Health dots pinned to the trunks make link status

legible at a glance.

- Auto-traceroute on launch — the ISP gateway hop populates without pressing a

key.

- Real RTT + CPU on Processes — per-process kernel RTT (min across that

process's TCP connections) and CPU%, with rolling history sparklines.

- Timeline detectors — RTT spikes and interface flaps surface as discrete

events instead of disappearing into the chart.

5.6 MB static binary. Linux/macOS/Windows, x86_64 + ARM.

Install: cargo install netwatch-tui or brew install matthart1983/tap/netwatch

Repo: https://github.com/matthart1983/netwatch

Sharing v0.14-rc of **netwatch** — single static binary, no agents, no config, live network picture in your terminal.


What's new:


- **Topology view** — local peers (SELF + LAN) on the left, public peers on the right, ROUTER → ISP spine in the middle, status dots on the trunks
- **Auto-traceroute** to `1.1.1.1` on launch so the ISP hop populates without pressing T
- **Throughput chart** now fills wide terminals (no more leading dead space)
- Processes / Timeline tabs wired to real RTT + CPU data


Install:
```
cargo install netwatch-tui --version 0.14.0-rc.3
```
Or grab a prebuilt binary: https://github.com/matthart1983/netwatch/releases/tag/v0.14.0-rc.3


Repo: https://github.com/matthart1983/netwatch


Feedback welcome

Cut 0.13.0 last week. Two things from it that might be of interest here.

Sort picker. Every list tab (connections, interfaces, processes, dashboard)

now opens a popup picker on s. Filter columns by name with /, j/k or arrows to

navigate, Enter applies, capital S flips direction. Each tab remembers its

own sort state, so jumping between tabs doesn't reset where you were. Kept it

as a popup rather than baking sort indicators into headers — didn't want to

eat row space on narrow terminals.

Vim keys. h/j/k/l now alias arrow keys across the tabs. Took longer than it

should have because there were ~10 separate key handlers spread across help /

settings / stream view / main, and I kept second-guessing whether to gate it

behind a setting. Ended up just aliasing them as KeyCode::Up |

KeyCode::Char('k') in the existing match arms. Felt cleaner than building a

whole keybinding-config system for two letters.

One carve-out: inside the packet stream view, h was already bound to toggle

hex/text mode. Didn't want to break muscle memory for existing users, so

h-as-left isn't quite universal — it doesn't apply in that one modal. Small

inconsistency but felt better than renaming hex toggle to x.

cargo install netwatch-tui or brew install matthart1983/tap/netwatch if you

want to poke at it. Source: github.com/matthart1983/netwatch