Projects sharing features with Bandwhich

Portmaster is a host-based network firewall and privacy tool that monitors and controls all system network traffic. It operates by intercepting data packets at the operating system level, allowing it to observe and manage every connection made by local software in real time. The software distinguishes itself through process-aware connection mapping, which correlates active network sockets with specific local applications to provide visibility into data transfers. It utilizes a user-space policy engine to enforce granular security rules, enabling users to restrict internet access, block specif

gping is a terminal-based network latency grapher and performance monitor. It functions as a cross-platform ping client that visualizes ICMP response times as real-time line graphs directly within the command line. The tool distinguishes itself by operating as a command execution time plotter, allowing the duration of any shell command to be graphed over time to analyze performance fluctuations. It supports multi-host latency plotting and provides shorthand identifiers for monitoring connectivity across different cloud infrastructure regions. The utility covers network diagnostics and observ

Kyanos is a diagnostic toolset for network analysis that uses eBPF to measure packet latency and trace traffic from the network card to the application. It functions as a kernel latency profiler and network performance monitor, providing capabilities to map external dependencies and capture network traffic. The project is distinguished by its ability to perform automatic SSL traffic decryption, converting encrypted requests and responses into plaintext for analysis. It further isolates bottlenecks by attributing latency across multiple stages, specifically tracing the time packets spend withi

Bottom is a cross-platform system monitoring tool that provides real-time visibility into hardware performance and process activity within a terminal-based interface. Built as a command-line utility, it tracks metrics for processor, memory, storage, and network usage while offering tools to inspect, organize, and terminate active system processes. The application utilizes a modular layout engine that allows users to arrange independent data-visualization widgets into a custom grid. This interface is powered by an immediate-mode rendering approach and an event-driven input loop, ensuring the d

🕵️‍♂️ TUI for sniffing network traffic using eBPF on Linux

Trippy is a network diagnostic tool and terminal user interface that combines ping and traceroute functionality to analyze network paths and performance. It provides a network packet parser and path analyzer to detect packet loss, jitter, and multipath routing through continuous network probing. The project is distinguished by its support for specialized tracing strategies, including Paris and Dublin, to ensure consistent path discovery. It identifies network address translation devices and utilizes heuristic analysis to distinguish genuine packet loss from rate-limiting. Broad capability ar

TrafficMonitor is a system performance monitor that provides a floating desktop window and taskbar overlay to track real-time CPU, memory, and network speed metrics. It functions as a customizable system overlay and hardware resource tracker, displaying live statistics and user-defined data through transparent desktop widgets. The project uses a plugin-based system and dynamic-link libraries to extend data sources and add new hardware tracking capabilities. It includes a theme engine that reads external configuration files to apply custom skins, fonts, and background colors to the interface.

Maltrail is a malicious traffic detection system used for network intrusion detection. It consists of a network intrusion sensor for monitoring interfaces, a threat intelligence aggregator for syncing blacklists, and a detection engine that identifies security threats through signature matching and heuristic attack patterns. The system distinguishes itself through a distributed sensor architecture that collects traffic data from multiple remote probes and forwards events to a central analysis server. It employs heuristic behavioral analysis to identify unknown threats, such as port scanning o

BCC is an eBPF development toolkit and tracing framework used for monitoring and analyzing the Linux kernel. It functions as a performance analysis tool and debugging utility to capture system events, measure kernel latency, and provide network observability. The project distinguishes itself by providing a build system that integrates with LLVM to compile C-like code into BPF bytecode at runtime. It utilizes BPF Type Format data for relocations to maintain cross-kernel compatibility and extracts kernel headers to ensure the generated programs match the specific kernel version. The toolkit co

Somo is a command line network utility and connection monitor used for filtering, sorting, and formatting network connection lists. It functions as an interactive process killer, allowing users to identify and terminate network processes based on their active connection data. The tool provides specialized network monitoring capabilities, including active socket and port tracking with port-to-service name resolution. It enables the administration of system sockets by sending termination signals to close specific network connections. Data management is handled through predicate-based filtering

AdguardFilters is a collection of curated adblock filter lists, content blocking rulesets, and DNS blocklists. Its primary purpose is to provide the rules necessary to identify and remove advertisements, tracking scripts, and intrusive elements across web browsers and applications. The project includes specialized rules for cosmetic filtering to hide layout gaps and a malware domain database to block phishing and spyware destinations. It provides distinct filtering sets for different regions and purposes, such as social media blocking. The repository covers broad capability areas including m

Mizu is a suite of tools for capturing, indexing, and visualizing cloud-native network traffic and decrypted payloads for cluster-wide diagnostics. It provides Kubernetes network observability by using eBPF to index and visualize layer 4 and layer 7 traffic with full cluster context, allowing for the mapping of workload dependencies and the diagnosis of network failures. The project distinguishes itself by using kernel-level hooks to decrypt TLS traffic in plain text without requiring private keys. It further integrates a standardized context protocol to expose indexed network telemetry to AI

This project is an Android RPA framework designed for automating user interfaces and system tasks on rooted Android devices using Python and ADB. It provides a suite of tools for rooted device management, allowing for programmatic control of system settings, application lifecycles, and shell command execution via a remote API. The framework distinguishes itself through a combination of dynamic instrumentation and AI integration. It can inject scripts into running processes to hook Java interfaces and modifies application behavior in real time. Additionally, it supports large language model in

This project provides a containerized DNS sinkhole and network-wide traffic filtering solution. It functions as a central network resolver that intercepts domain queries, allowing users to block advertisements, trackers, and malicious domains by returning null responses to connected devices. The platform distinguishes itself through its integrated DHCP server and comprehensive management capabilities, which allow for automated IP address allocation and granular control over network traffic. It supports complex filtering through regular expression matching, hierarchical rule prioritization, an

Arkime is a distributed packet analysis platform and full packet capture system designed for recording raw network traffic, indexing metadata, and performing network forensics. It functions as a network traffic indexer and security tool that enables the monitoring, querying, and browsing of large-scale network traffic across multi-cluster architectures. The platform distinguishes itself through its ability to manage distributed capture clusters from a centralized administrative dashboard. It integrates external data feeds with internal traffic logs to identify known threats and provides a pro

Moloch is a full packet capture system and network forensics platform designed for large scale network traffic recording and indexing. It functions as a distributed packet indexer that stores raw data in PCAP format for deep packet analysis and security investigations. The system distinguishes itself through a decentralized architecture that distributes capture and viewing components across multiple nodes to handle high volumes of network traffic. It utilizes a web-based management interface for browsing network sessions and provides a programmable API for exporting captured traffic and metad

bpytop is a cross-platform terminal system monitor and resource dashboard for Unix-like operating systems. It provides a real-time interface for tracking processor, memory, disk, and network usage across Linux, macOS, and FreeBSD. The tool functions as a process manager, allowing users to filter, sort, and terminate system processes using a tree-view layout. It also serves as a hardware health monitor by tracking battery status and system temperatures. The interface is highly customizable, featuring a theme engine for adjusting color schemes and a layout system to toggle specific resource bo

Stats is a system performance monitor that tracks real-time hardware metrics and resource usage directly from the operating system menu bar. It functions as a hardware control interface, allowing users to adjust fan speeds and thermal settings to maintain optimal performance levels for computing hardware. The application distinguishes itself through kernel-level sensor polling, which retrieves telemetry by interfacing directly with low-level system drivers and power management APIs. It provides remote infrastructure oversight via a web-based telemetry dashboard, enabling users to view live pe

Wireshark is a network protocol analyzer and traffic inspector used for capturing and inspecting network traffic. It functions as a packet capture tool that intercepts live data from network interfaces and a TCP/IP dissector that decodes network protocol layers to translate raw binary packets into human-readable fields. The system provides capabilities for protocol stream reconstruction, grouping related packets into cohesive conversations between endpoints. It also operates as a packet file converter, allowing for the reading, modification, and conversion of network capture files across vari

🌐 Elegant UniFi network management CLI & TUI - for humans and agents

bandwidth monitor and rate estimator

Terminal Network scanner & diagnostic tool with modern TUI

🛡️ Terminal-based, real-time traffic monitoring and statistics for your AdGuard Home instance

Glances is a cross-platform system monitoring tool designed to track real-time resource usage and hardware health metrics across diverse computing environments. It functions as a command-line utility that provides a unified view of system performance, identifying bottlenecks and maintaining infrastructure stability through a consistent abstraction layer that translates kernel calls into actionable data. The project distinguishes itself through its distributed capabilities, offering a web-based interface that enables remote access to live performance metrics from any device without requiring d

Btop is a terminal-based system monitor that tracks and displays real-time hardware performance metrics. It functions as a resource usage dashboard, providing visibility into processor, memory, disk, network, and active process activity directly within a text-based interface. The application utilizes ANSI escape sequences to render complex graphical interfaces and data visualizations within standard terminal emulators. It is designed as a cross-platform performance tool, maintaining consistent monitoring capabilities across various Unix-like operating systems through a platform-agnostic build

Kubeshark is a network observability platform designed for Kubernetes environments, functioning as an eBPF-powered engine for cluster-wide traffic analysis. It captures, indexes, and visualizes network activity and API calls directly from the kernel, providing deep visibility into service-to-service communication without requiring sidecar proxies or manual code instrumentation. The platform distinguishes itself through its ability to perform protocol-aware traffic dissection and user-space cryptographic hooking, which allows for the inspection of encrypted traffic and the reconstruction of ap

This project is a comprehensive, curated directory of cybersecurity resources, software, and documentation designed to support system and network protection. It serves as a centralized knowledge base and index for security professionals, aggregating industry-standard practices and open-source tools across a wide range of technical domains. The repository distinguishes itself by providing a structured collection of methodologies and frameworks for security operations. It covers critical areas including threat intelligence, digital forensics, infrastructure auditing, and vulnerability assessmen