wirewatch_

One command. Live, enriched, color-coded visibility of everything talking on your network — powered by Zeek.

$ curl -fsSL https://wirewatch.net/install.sh | bash

What happens when you run it

Detects your OS — macOS (Homebrew) or Debian-family Linux (apt).
Installs prerequisites if missing: Homebrew/apt, Python 3, and Zeek.
Downloads the latest wirewatch.py from this site.
Detects your active network interface (your default route) automatically.
Starts the capture — you'll be asked for your sudo password once, then live traffic streams into your terminal.

You'll see

DNS queries, TLS SNI names, HTTP requests, SSH, DHCP, NTP, file transfers
Raw IPs cross-referenced with domains seen on the wire in real time
Zeek notice alerts highlighted, protocol anomalies deduplicated

Requirements

macOS (Apple Silicon or Intel), or Ubuntu/Debian-family Linux
A terminal and an internet connection
Sudo access — packet capture needs it (this is standard for any sniffer, Zeek included)

Prefer to read before you run? The installer is a single plain shell script and Wirewatch itself is a single plain Python file. Review either one: install.sh · wirewatch.py · source on GitHub. Stop anytime with Ctrl+C.

Wirewatch runs zeek locally on your machine. No data leaves your computer.