NETWATCH(1)

📦
version 1.2 · 2 versions
  • 1.2 · debian bookworm, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking (latest)
  • 1.3.1_2 · arch rolling
, in debian bookworm, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

👑 NETWATCH — the manual page, but make it a group chat 👑

okay bestie, welcome to NETWATCH — yes that's the manual name, that's the page, we're here, we're doing this. It's an Ethernet Internet Protocol Monitor and it's lowkey iconic. Sit down, grab a boba, let's get into it. 🧋✨

🌸 SYNOPSIS 🌸

netwatch [ -h ] [-b] [-i dd.dd.dd.dd] [-m dd.dd.dd.dd] [-n] [ - t] [ -e
ethnum ] [ -c netconfigfile ]

that's the whole vibe right there, no notes 💅

💖 DESCRIPTION 💖

So. Netwatch examines all the packets travelling on an ethernet and analyses the IP packets. Every single one. It's watching. It's always watching. 👀

The information is tallied according to the source and destination hosts. Then an ncurses display shows you a dual-list status for all hosts, and it goes like this:

  • the left display = LOCAL hosts 🏠
  • the right list = REMOTE hosts 🌍

And it is possible to examine statistics (counts) on:

  • number of packets
  • bytes
  • IP service type
  • last communication host

...for each host. Fr fr, per host. Use the arrow keys (left and right) to change the display. That's the whole interaction model, slay.

✨ OPTIONS ✨

  • -e ethnum — ethnum is the name of the ethernet device to attempt to run with netwatch. (e.g. -e eth1 selects the eth1 device rather than the default eth0 device. — yes the parenthesis in the original is unbalanced and we are NOT fixing it, we are respecting the lore 💀)
  • -c confignetfile — selects the name of the file which contains the ifconfig information. Note that this is not necessary since netwatch will use the route information from /proc/net to build all the information needed (without using ANY configuration file). So like... optional bestie, truly optional. 🫶
  • -b — For a transparent bridge, ignore every other packet... (older kernels) 👵
  • -i dd.dd.dd.dd — Fake a local internet address for "this" machine... (useful in making fake local net for monitoring when combined with the -m option ) 🎭
  • -m dd.dd.dd.dd — Fake the netmask which is used for the local net evaluation 🎭
  • -n — Do not resolve names (just display addresses) 🔢
  • -h — Simple help information 🙋
  • -t — Start Netwatch in TOP Mode (30 sec. startup delay) ⏳

🎀 USER COMMANDS 🎀

The following description will attempt to clarify what keys netwatch understands. It is important to know that the program is mode dependent. This means commands may change depending on the current mode. The primary mode is dual-list mode. In this mode use:

  • <tab> key — switch scroll display to the other list (dual-lists). Look for KEY. 🔑
  • <left> key — Change display options (moving left through the options) ⬅️
  • <right> key — Change display options (moving right through the options) ➡️
  • <up> key — Scroll to previous host page on the current list (see KEY) Change display options (moving right through the options) ⬆️ (yes, that's what it says, we're keeping it, no we don't know either)
  • <down> key — Scroll to next host page on the current list (see KEY) ⬇️
  • h key — gives help screen 🆘
  • t key — Toggle TOP mode (where 30 sec update on busiest hosts) 🔥
  • c key — Clear counts for all hosts 🧹
  • n key — Clean the remote & local host tables 🧼
  • N key — Clean the remote OR local host tables (depends on which is current) 🧼
  • L key — Produce LOG of current display entries (REMOTE or LOCAL) 📝
  • b key — Toggle display of BLUE entries (OLD) 💙
  • d key — Toggle display of DOMAIN entries (Name Server Queries) 🌐
  • w key — Enter WATCH mode for viewing ROUTING stats and HOST packets 👁️
  • <F10>, <END> or q key — Exits the program 👋
note: uppercase and lowercase are NOT the same key, bestie. n and N are different little guys doing different little jobs. iykyk 💅

🦋 AUTHOR 🦋

Gordon MacKay mackay@gmml.slctech.org

the founder, the moment, the legend 👑

Copyright (c) Gordon MacKay 1997, under GPL. periodt. 💖

💀 BUGS 💀

Yes, but hopefully the program is better than it was...

genuinely the most honest BUGS section in the history of Unix and I am obsessed with it 😭

okay and that's the whole page bestie!! the manual is literally just called NETWATCH (that's the title up top, that's the footer down bottom, it's giving symmetry ✨), and the version/date situation is just... the plain NETWATCH() footer with no version and no date stamped on it, so there's nothing else to tell you there. it's 1997 core, it's GPL, it's Gordon's, and it's been out here monitoring ethernet since before you were born. go forth and watch some packets. 🎀🦋💜

📦 where this page comes from