Version 0.3.3 BETA // Stable Prerelease
A portable network exploration workstation built for system administrators, technical operators, OSINT researchers, developers, incident responders, and anyone who needs to see which processes are talking, where they are connecting, what protocols they are using, and how the activity changes over time.
Deep Signal Operations
NET brings packet-aware observation, process attribution, host intelligence, persistent storage, and exportable reporting into one desktop interface. It is designed to remain useful whether you are examining a single workstation, validating application behavior, mapping outbound dependencies, investigating unexpected traffic, or building a repeatable reconnaissance record.
Observe active network conversations as they emerge, including local and remote addresses, ports, transport protocols, timestamps, and process attribution.
Aggregate repeated flows into host-centric records so a noisy stream of sockets becomes a readable map of external systems and recurring destinations.
Prioritize activity through operational scoring and contextual indicators rather than treating every connection as equally important.
Separate traffic by protocol and service behavior to understand whether a connection represents browsing, name resolution, encrypted transport, or another network function.
Keep application state, observed data, DNS intelligence, logs, and generated reports beside the portable executable in a predictable release directory.
Move from live observation to durable documentation with machine-readable and human-readable export formats suitable for review, archiving, and later analysis.
Release Access
Use the official portable beta when you want a ready-to-run release folder. Use the source package when you want to inspect the code, run from a Python virtual environment, modify the application, or build your own PyInstaller distribution.
The prepared release folder contains the executable, bundled runtime components, and writable application directories. Keep the folder intact and run NET from inside it.
Download Official BetaComplete source code for virtual-environment operation, auditing, development, theme customization, and local PyInstaller builds. Dependencies are installed through the supplied requirements file.
Download Source FilesPacket Capture Rules
NET can display ordinary socket information as a normal user, but packet capture requires permission
to open raw sockets and inspect network interfaces. On Linux, the supported beta procedure is to launch
the application with sudo.
Linux restricts packet capture because raw packets can expose traffic beyond a single application. NET does not bypass this model. It asks the operating system for legitimate capture access and must be started with the corresponding privileges.
$ cd /path/to/NET_0.3.3_BETA $ sudo ./NET
$ cd /path/to/NET_0.3.3_Source $ sudo python3 -m venv .venv $ sudo .venv/bin/python -m pip install -r requirements.txt $ sudo .venv/bin/python app.py
$ sudo .venv/bin/python -m pip install pyinstaller $ sudo .venv/bin/python -m PyInstaller --clean --noconfirm NET.spec # Result: dist/NET/NET $ cd dist/NET $ sudo ./NET
Operator Workflow
NET is intended to be explored interactively. Begin with a quiet baseline, start capture, generate or observe known activity, and then pivot between flows, hosts, process details, DNS information, and reports.
Launch the portable binary or source entry point using sudo. Confirm that the main window opens and the expected network interface is available.
Choose the interface carrying the traffic you want to observe. On many workstations this will be an Ethernet or Wi-Fi interface rather than loopback.
Let NET observe the system before launching additional software. This exposes background services, update checks, name resolution, and persistent outbound behavior.
Open a browser, run a network-aware application, perform a DNS lookup, or connect to a known service. Compare the expected behavior with the observed flows.
Use the flow table for connection-level details, then move to Remote Hosts to review aggregated destinations, hostnames, process associations, ports, and risk context.
Allow automatic reverse DNS or trigger manual resolution for selected hosts. A missing PTR record is normal and should not be treated as proof of malicious behavior.
Identify which executable initiated a connection, which local port was used, which remote service answered, and whether the same relationship repeats over time.
Create HTML reports for human review or export CSV and JSON datasets for archival, scripting, comparison, and additional analysis.
Interface Map
Each view answers a different operational question. Use them together rather than expecting one table to tell the entire story of a network event.
| Workspace | Primary Question | Typical Data | Operator Use |
|---|---|---|---|
| Live Flows | What is communicating right now? | Process, protocol, local IP/port, remote IP/port, hostname, timestamps | Immediate observation and event correlation |
| Remote Hosts | Which external systems recur? | Remote IP, hostname, DNS status, flow count, processes, ports, risk | Destination profiling and dependency mapping |
| Flow Details | What happened in this connection? | Expanded endpoint, process, timing, and protocol metadata | Focused review of a selected event |
| DNS Intelligence | Does this address publish a PTR hostname? | Resolved hostname, status, cache age, lookup outcome | Context enrichment and host labeling |
| Reports | How do I preserve or share the findings? | HTML, CSV, JSON | Documentation, archiving, and downstream analysis |
| Settings | How should NET behave? | Theme, refresh behavior, DNS options, cache lifetime, interface choices | Operational configuration |
Portable Runtime
The PyInstaller one-folder release keeps writable state beside the executable instead of hiding it in a temporary extraction directory. Archive the folder and you archive the working application state with it.
NET/ ├── NET ├── _internal/ ├── config/ │ └── ui.json ├── data/ │ └── net.sqlite ├── exports/ ├── logs/ │ └── net.log ├── README.md └── LICENSE
data/ before major upgrades.config/ when retaining user settings.logs/ during troubleshooting.exports/ separately when reports are evidence._internal/ unless rebuilding the release.Visual Presets
NET includes purpose-built visual presets rather than superficial color swaps. Each theme changes the operating atmosphere while retaining the same information architecture and control placement.
Network intelligence // deep signal operations. Black, steel, controlled red, and subdued command-blue accents.
Field intelligence // sand table operations. Warm tactical neutrals, muted green, and low-glare gold indicators.
Blue water recon // signal surface operations. Deep teal panels, cyan instrumentation, and cool blue telemetry.
Responsible Operation
NET is an administrative and diagnostic instrument. Packet and process data can be sensitive. Operate only within your authorization, minimize unnecessary capture, and handle reports as system records.
Capture traffic only on systems and networks you own, administer, or have explicit permission to inspect.
Capture long enough to answer the operational question. Avoid retaining unrelated traffic indefinitely.
Preserve original exports, record collection times, and avoid altering reports that may be used for later comparison.
Troubleshooting
Most startup problems come from missing privileges, incomplete extraction, selecting the wrong interface, or running the executable outside its release folder.
Close the application and relaunch it with sudo. Confirm the selected interface is active and that traffic is actually passing through it. Loopback traffic will not appear on an Ethernet or Wi-Fi interface.
Keep the complete release folder intact. NET expects its writable data/, config/, logs/, and exports/ directories beside the executable.
Reverse DNS is optional infrastructure. Many legitimate systems do not publish PTR records. NET should preserve the IP address and report the lookup status rather than inventing a hostname.
Private addresses often depend on a local DNS server, router, hosts file, or enterprise naming system. Enable private-address resolution only when your network provides useful local PTR records.
Yes. Copy the entire release directory. A Linux binary must still match the target architecture and system compatibility expectations.
No. Extract the new release into its own directory, test it, then copy only the data or configuration you intentionally want to preserve. This prevents mixed-version modules and stale bundled files.
DarkMatter Software
Download the official NET 0.3.3 beta for portable operation, or take the source package into your own lab and build the next instrument in the stack.