wirewatch_

Zero-Dependency Python + Zeek

One command for real-time, human-readable network intelligence on macOS and Linux. See which local app is talking, the real domain behind shared CDN IPs, first-seen destinations, encrypted-DNS bypasses, and heavy uploads as they happen.

Quick Start (macOS & Debian/Ubuntu Linux) Or run directly: python3 wirewatch.py
$curl -fsSL https://wirewatch.net/install.sh | bash
wirewatch — en0 (Wi-Fi, 10.1.2.111)
09:43:12 [DNS ] Brave ↗ :53 api.openai.com [A ] → 104.18.1.2, 104.18.2.2 (18ms) ★ NEW [AI] 09:43:12 [DNS ] Cursor ↗ :53 events.data.microsoft.com [AAAA] → 2620:1ec:c11::200 [slow:245ms] ★ NEW [TELEM] 09:43:13 [DNS ] mDNS ↗ :5353 _companion-link._tcp.local [PTR ] → (PTR data) [Apple Continuity] 09:43:13 [TLS ] Cursor ↗ :443 api.openai.com [TLSv13] (Let's Encrypt) [AI] 104.18.1.2 09:43:14 [TLS ] Brave ↗ :443 secret-blog.example.com [TLSv13] [No-DNS/DoH] ★ NEW 104.18.1.2 09:43:14 [TLS ] curl ↗ :443 cert:legacy.internal.corp [TLSv11] [EXPIRED-CERT] [DIRECT-IP] 185.220.101.7 09:43:15 [QUIC ] Cursor ↗ :443 events.data.microsoft.com [h3] [TELEM] 2620:1ec..:200 09:43:16 [CONN ] Cursor ↗ tcp/443 api.openai.com ↑1.4KB ↓47.1KB SF(ok) 4.2s [AI] 09:43:18 [CONN ] Brave ↗ tcp/443 secret-blog.example.com ↑2.5MB ↓13.7KB SF(ok) 12.8s [↑ UPLOAD 2.5MB] 09:43:19 [CONN ] IN ↙ tcp/22 45.33.32.156 0B REJ(rejected) 0.0s [DIRECT-IP]
Columns: TIME | PROTOCOL | LOCAL APP & DIRECTION | TARGET DOMAIN / IP | INSIGHTS & TELEMETRY Click the buttons above to preview live filters

What makes Wirewatch different

Local App Attribution Brave ↗ :443

Maps active TCP/UDP sockets to local processes (Brave, Cursor, Opera, curl, iCloud) without slow lsof calls, while flagging unsolicited inbound packets with IN ↙.

Per-UID CDN Correlation uid → SNI

Correlates TLS SNI, QUIC, HTTP, and conn.log by Zeek's connection uid first. Two apps talking to different sites on the same Cloudflare/Fastly IP never overwrite each other's domain label.

DoH & Direct-IP Detection [No-DNS/DoH]

Spots when an app or browser connects to a domain via TLS SNI without ever making a local DNS query ([No-DNS/DoH]), or connects to a bare public IP with neither DNS nor SNI ([DIRECT-IP]).

First-Seen Domain Novelty ★ NEW

Remembers registrable base domains across sessions in .wirewatch-known.json and badges brand-new destinations with ★ NEW. Press n or pass --only-new to watch only new/anomalous activity.

Intent & Bonjour Decoder [AI] [TELEM]

Automatically tags [AI], [TELEM], and [OS/SYNC] endpoints and translates cryptic Bonjour/mDNS queries like _companion-link._tcp.local into [Apple Continuity] or [AirPlay].

Volume, Hygiene & Folding [↑ UPLOAD]

Shows ↑sent ↓rcvd bytes on every connection, flags heavy outbound uploads, folds noisy certificate chains into [TLS] (alerting on [EXPIRED-CERT]), and collapses parallel browser socket bursts.

Interactive Live Hotkeys

Space
Pause / ResumeFreeze scroll while buffering in background
Enter
Drop BookmarkPrint divider with Δ events & ↑↓ bytes
s
Live SnapshotTop talkers, apps & categories on demand
n
Toggle Only-NewFilter live to ★ NEW domains & alerts

Common CLI Options

--only-newOnly show ★ NEW domains, alerts & heavy uploads
--hide-lanSuppress unnamed LAN/mDNS/local chatter
--only dns,ssl,connShow specific Zeek protocol logs exclusively
--match TEXTCase-insensitive substring filter across rows
--min-bytes NHide connections transferring fewer than N bytes
--watchlist FILEFlag domains, IPs, or CIDRs with [WATCH]
--pcap FILEAnalyze an existing capture file (no sudo needed)
--verboseShow all raw X.509 & parallel handshake rows

What happens when you run it

  1. Detects your OS & active interface — macOS (Homebrew) or Debian/Ubuntu Linux (apt/Docker).
  2. Installs Zeek automatically if it isn't already on your system.
  3. Creates a clean wirewatch/ folder so Zeek logs and `.wirewatch-known.json` stay contained.
  4. Prompts once for sudo to start packet capture with Zeek's output isolated from your terminal.
  5. Streams enriched traffic until you press q or Ctrl+C, then prints a full session summary.
Auditable & 100% local: Wirewatch is a single zero-dependency Python 3 script and a plain shell installer. Inspect install.sh · wirewatch.py · or browse the source on GitHub. No network data ever leaves your computer.