One zero-config binary that does the job of a bandwidth meter, Wireshark's triage view, and a lightweight IDS — without leaving the terminal.

- Reads encrypted traffic you control — point an app's SSLKEYLOGFILE at netwatch and its TLS 1.3 plaintext decodes live, the way Wireshark does it. Same for QUIC 1-RTT, including HTTP/3 body decompression. No proxy, no certificates, nothing in the middle.

- Egress drift — learns which destinations each process reaches (SNI, ASN, port), one keypress promotes that observed baseline to a policy, then it warns when a program starts talking somewhere new. curl used to reach only api.github.com, and today it reached something else. Observe-only, never blocks.

- JA4 fingerprinting — every TLS/QUIC handshake becomes a stable fingerprint, so you can recognise a specific client or a specific piece of malware while the traffic stays encrypted. Pivot on a fingerprint to find every other flow from the same software.

- Threat detection — C2 beaconing (regular, low-jitter check-ins), port scans, DNS tunneling. Runs in the background, zero setup. A critical alert auto-freezes the recorder.

- Per-process attribution — every socket mapped to the program that opened it, with an optional eBPF kprobe on Linux that catches short-lived flows polling misses.

- Real L7 decode — TLS, QUIC, HTTP, DNS, SSH and a dozen more, with per-flow stream tracking and handshake timing. You see api.github.com, not "port 443."

- Flight recorder — arm a rolling capture, freeze an incident into a portable bundle: packets plus the connections, DNS, health and alerts that explain them.

- Landlock-sandboxed on Linux — drops privileges after setup and locks itself into a filesystem allow-list. A tool that parses hostile traffic can't read your SSH keys or /etc/shadow.

- Scales both ways — --lite is one 80×24 screen for a Pi over SSH; --view dense fills a big terminal with four zero-chrome boxes; the full ten-tab view is one keypress away with collectors already warm.

650+ tests. macOS, Linux, Windows.

brew install netwatch

cargo install netwatch-tui

https://github.com/matthart1983/netwatch

MIT.

Hi everyone! 👋

As a side project, I wanted a clean, fast, and no-bloat way to check real-time latency fluctuations, packet loss, and public IP routing directly from the browser without needing heavy installations.

I ended up building Global Network Latency Benchmark — a single-file HTML utility that tests connection health across 15 global AWS nodes simultaneously using asynchronous requests and Chart.js for real-time visualization.

What it includes:

• 15 Global Regions: Real-time ping testing across Europe (Milan, Frankfurt, Warsaw, London, Paris, Stockholm), US (Virginia, Oregon), South America (São Paulo), Asia (Tokyo, Singapore, Sydney), Africa, and the UAE.
• Live Analytics & Charts: Tracks sent packets, packet loss percentages, and rolling average pings with visual graphs.
• IP Inspector & DNS Tool: Built-in IP/ISP inspector and a Cloudflare DoH (DNS over HTTPS) lookup tool.
• Lightweight Architecture: Completely built into a single, clean file with zero unnecessary dependencies.

I'm currently getting everything ready for review and polishing the last details. If you have a few minutes, I would love for you to check it out and let me know your thoughts on the UI, performance, or anything I could improve!

🔗 Live Tool: https://www.latencybenchmark.com/

ADD @ BOOKMARKS.

Any feedback or suggestions are heavily appreciated! Thanks!

I've been using nornir (with netmiko) for a few years as my go-to for automating network tasks, but have never used it for an upgrade/reboot. Could anyone share what logic would work please? I'm mostly concerned about losing the SSH during the process.

def upgradeswitch( task, sUpgCmd, iBootWait=120, iMaxReboot=600):
    try:
        # 'install' command eventually ends with prompt then auto reboot
        mRes = task.run(task:netmiko_send_command, command_string=sUpgCmd, read_timeout=900)
    except Exception as e:
        print(f"Info: SSH dropped during upgrade: {e}"

    # Purge Netmiko cached connections:
    try:
        task.host.close_connections()
    except Exception:
        pass
    [...]

I think there's no need for use_timing (Cisco ends the upgrade with a prompt), but what about that error handling and call on close_conections() ?

Is nornir_netmiko the right tool for this or should I be looking at scrapli?

Many thanks for any insights.

I've been building Network Doctor, a terminal tool for figuring out why a connection isn't working.

One of the features that got a little out of hand is Challenge Mode.

It drops you into a simulated broken network, gives you the symptoms, and asks you to diagnose what is actually wrong.

The same diagnostic engine that Network Doctor normally uses is available to you, but the idea is to see whether you can interpret the evidence correctly.

The scenarios include things like DNS failures, blocked ports, routing problems, connection refusals, dual-stack IPv4/IPv6 issues, and other network faults.

You make your diagnosis, submit it, and the simulator knows the actual fault so it can score the answer.

I originally built the simulator for testing Network Doctor itself. At some point I realized it was basically generating networking troubleshooting puzzles, so I made them playable.

It's written in Go and runs entirely in the terminal.

GitHub: https://github.com/heymaikol/network-doctor
Simulator Documentation: https://heymaikol.github.io/network-doctor/wiki/Simulator-Overview/
Challenge Mode Documentation: https://heymaikol.github.io/network-doctor/wiki/Challenge-Mode/

I'd love ideas for network failures that would make particularly nasty troubleshooting challenges.

Hey everyone i just finished networking fundamentals and routing , switching please guide me where to start to learn network automation

Hi everyone,

I would like to introduce Portivo Control Center, an independent, open-source and self-hosted network operations platform designed for compatible Alcatel-Lucent Enterprise OmniSwitch environments.

Portivo brings everyday switch management, troubleshooting and controlled automation into a single web-based workspace.

Key capabilities include:

• Centralized switch inventory and live operational visibility
• Logical port-panel views with VLAN, PoE, media and link-state information
• Endpoint discovery using MAC, IP, hostname, UNP and VLAN evidence
• Integrated browser-based SSH terminal
• Controlled command preview and execution
• Multi-device jobs and reusable automation runbooks
• Fleet-wide read-only operational audits
• Role-based access control with Site and Group scope
• Audit history, reports and operational evidence
• SNMPv3 UPS monitoring and power-aware infrastructure visibility
• Backup, restore and administration tools
• Windows and Linux deployment support

Portivo is intended to complement native CLI expertise, not replace it. The objective is to provide network operators with a safer and more consistent workflow for discovering, diagnosing, executing and documenting network changes.

The platform is self-hosted, does not require agents on managed switches and can operate inside a protected management network. Switch operations use SSH, while supported UPS monitoring uses SNMPv3.

The project is licensed under AGPL-3.0-only.

Website:
https://portivo.org/

Documentation:
https://portivo.org/docs/

Roadmap and changelog:
https://portivo.org/roadmap.html

Source code:
https://github.com/Donacgreece/Portivo

I would genuinely appreciate feedback from network engineers, system administrators and anyone operating ALE OmniSwitch infrastructure. I am particularly interested in feedback about operational workflows, documentation, deployment and features that would be useful in real environments.

Thank you for taking a look.

[https://apps.apple.com/us/app/netsight-wifi-tools/id6775736000\](https://apps.apple.com/us/app/netsight-wifi-tools/id6775736000)

I built [Netsight](https://apps.apple.com/us/app/netsight-wifi-tools/id6775736000) to scan every device on any WiFi network, access hidden web servers or admin panels, find network vulnerabilities, see everyone on a network, and much more professional network tools

The app will become paid in September, so get it free while you can!

Disclosure: I'm the creator of NetAudit.

Hey folks,

I've been using various network scanning tools (nmap, ping, etc.) but wanted something more structured, vendor-aware, and easily automatable. So I wrote NetAudit – a Python CLI toolkit for network auditing and diagnostics.

**Key features from a DevOps perspective:**
- All commands produce structured output (JSON/CSV) and use stdout for results, stderr for logs – perfect for pipelines
- Exit codes are meaningful, so you can integrate it into monitoring or alerting
- Configuration via YAML + environment variables (`NETAUDIT_*`)
- Supports Cisco, Juniper, Arista over SSH – read-only, so safe for production
- Snapshots and `diff` let you track changes over time (great for change management)
- Health checks (`doctor`) cover not just ping, but also interface errors, BGP/OSPF, NTP, etc.

**Example – schedule a daily audit and generate HTML report:**
```bash
netaudit doctor 10.0.0.1 --device --device-type cisco_ios --json > daily_health.json
netaudit report daily_health.json --format html --output /var/www/audit_report.html

I'd be happy to hear how you'd use it in your workflows – feature requests and PRs are very welcome.

Repo: https://github.com/netforge201/netaudit

If you like it, please consider giving it a ⭐ – it really helps with visibility!

Thanks!**Disclosure: I'm the creator of NetAudit.**

Hey folks,

I've been using various network scanning tools (nmap, ping, etc.) but wanted something more structured, vendor-aware, and easily automatable. So I wrote NetAudit – a Python CLI toolkit for network auditing and diagnostics.

**Key features from a DevOps perspective:**
- All commands produce structured output (JSON/CSV) and use stdout for results, stderr for logs – perfect for pipelines
- Exit codes are meaningful, so you can integrate it into monitoring or alerting
- Configuration via YAML + environment variables (`NETAUDIT_*`)
- Supports Cisco, Juniper, Arista over SSH – read-only, so safe for production
- Snapshots and `diff` let you track changes over time (great for change management)
- Health checks (`doctor`) cover not just ping, but also interface errors, BGP/OSPF, NTP, etc.

In the vein of Headscale, Netbird, and Zerotier, I present Gravinet.

- Open source, GPLv3 licensed
- An easy to use web GUI
- A CLI equivalent to the web GUI
- Mesh peers can be configured to be centrally managed by other mesh peers
- AES-256 encryption
- Easy key management and rotation
- Works on Windows, MacOS, Linux, FreeBSD, and OpenBSD
- Full mesh or partial mesh
- Encrypted relaying through other peers when direct connectivity isn't available.
- Firewalling
- QoS
- Traffic Shaping
- Push static hosts and DNS configuration to all mesh peers
- Push static routes to all mesh peers
- BGP and BFD support through FRR integration
- LLDP and CDP support through LLDPD
- Live metrics between all mesh peers
- Speedtesting between all mesh peers
- Tested to 5Gbps+ between peers
- Configuration versioning, diffing, backup, and restore
- SNMP integration
- Full mesh troubleshooting tools like support bundle downloads and packet captures
- All features support for both IPv4 and IPv6
- NAT
- Small memory footprint (< 65MB) suitable for use in resource constrained environments
- Much more

All the other mesh apps I've used never really met all my needs, so I created something that did. Give it a try. It may work out for you.

Full disclosure, I used Claude to help code it. If that's not your thing just carry on.

https://github.com/micush/gravinet

any help with this class or advice how to ... its one of those classes with little instruction or misleading information...

I've been working on an open-source network diagnostic tool called Network Doctor, and I recently built a challenge mode to test whether its diagnoses actually hold up against a human troubleshooting the same broken network.

The idea is pretty simple.

netdoc-sim creates an isolated Linux network with a deliberately introduced fault. You get dropped into a shell without being told what's wrong.

You can investigate it normally with things like:

ip
ping
dig
curl
ss
traceroute
nc

Once you think you know the problem, you submit your diagnosis.

Then Network Doctor diagnoses the exact same network.

The simulator has its own independently observed ground truth, so Network Doctor does not know what the correct answer is.

There is also a daily challenge so everyone gets the same scenario.

Try today's challenge

If you have Docker (which should work in theory):

docker run --rm -it --cap-add SYS_ADMIN ghcr.io/heymaikol/netdoc-sim:latest challenge -daily

On Linux with netdoc-sim installed (definitely works):

netdoc-sim challenge -daily

The result tells you whether you won, Network Doctor won, both got it, or both missed it.

If anyone here feels like trying to break it, I'd be very interested in the results, especially cases where:

• you diagnose it correctly and Network Doctor doesn't
• the simulated failure doesn't behave like you'd expect on a real Linux network
• the available evidence makes the answer ambiguous
• you find a way to fool the judge
• the challenge UX gets in your way

Please don't post the actual answer to today's challenge so other people can try it blind.

Source code:

https://github.com/heymaikol/network-doctor

Large network labs eventually reach the limits of a laptop or homelab. Keeping cloud compute running between sessions can also become expensive.

HybridOps.Core is an open-source MIT-0 workflow that deploys a private EVE-NG or GNS3 environment using your own Google Cloud account or Proxmox capacity.

For learners without suitable local hardware, eligible new Google Cloud users can receive $300 of trial credit. Cost visibility and teardown between sessions keep more of that credit for active lab time.

It preserves lab definitions, QEMU overlays and each node-to-base-image map. On rebuild, declared bases are restored and overlays remapped; a committed overlay becomes the next base image.

The workflow includes:

• readiness and health checks
• deployment and private access
• lab images and guest networking
• archive and restoration
• cost-aware teardown

This allows cloud resources to be removed after a session without treating a large lab as one enormous backup file.

I am looking for EVE-NG and GNS3 users willing to test it with real topologies.

How large is your current lab, and how much is reusable base imagery versus changing node state?

EVE-NG workflow:
https://docs.hybridops.tech/ops/runbooks/platform/blueprints/hyops-blueprint-eve-ng/

GNS3 workflow:
https://docs.hybridops.tech/ops/runbooks/platform/blueprints/hyops-blueprint-gns3/

Hey guys im a networking professional that want to share my personal build out of my home cyberlab utilizing IaC tools Packer (Image Template Builder), Terraform for infrastructure provisioning and Ansible for configuration management. With 4 years of experience backed by the CompTIA trifecta and CCNA, I am excited about adding these tools to my arsenal due to the benefits of having baseline configured artifacts to maximize on labbing and building scenarios versus spending hours provisioning a machine for a specific use case. Please review and let me know any feedback.🙏

so i got sick of manually drawing topology diagrams every time i needed to document

something. like i'd have the LLDP/CDP neighbor output right in front of me and still

end up dragging boxes around in draw.io for 20 mins.

ended up building a small tool that just takes the neighbor table output and spits out

a topology diagram (mermaid). also threw in a drag and drop canvas thing similar to

packet tracer if you want to sketch something from scratch instead.

been using it for lab docs and quick client proposals, saves me a decent chunk of time

tbh. it's part of a bigger set of tools i've been building (vlsm planner, bgp prefix

stuff, cisco/mikrotik/juniper config builders etc) but the diagram ones are what i

actually use weekly

no login wall, nothing gets uploaded anywhere, just runs in the browser

opsbench.xyz/tools/lldp-cdp-mermaid - if anyone tries it lmk what's broken or missing,

still actively working on it