NetWatch v0.16.0 — DPI in the terminal: HTTPS/QUIC hostnames, packet decode

Posted by Potential-Access-595@reddit | linuxadmin | View on Reddit | 9 comments

NetWatch v0.16.0 — DPI in the terminal: HTTPS/QUIC hostnames, packet decode

Shipped v0.16.0 with end-to-end Deep Packet Inspection.

- **Packets tab:** INFO column is L7-aware and color-coded. Filter syntax: `app:quic`, `sni:reddit`, `host:github`.

- **Dashboard top-talkers:** real hostnames in the bandwidth panel.

- **Packets detail pane:** decodes QUIC v1/v2 Initial packets and shows the inner CRYPTO/PADDING/PING frame structure.

Full RFC 9001 / 9369 QUIC Initial decryption — HKDF-Expand-Label keys, AES-128 header protection, AES-128-GCM AEAD,

cross-packet ClientHello reassembly. Most peer tools just tag flows as `QUIC`; this one tells you the hostname.

cargo install netwatch-tui

# or

brew install matthart1983/tap/netwatch

Rust + ratatui, MIT. https://github.com/matthart1983/netwatch