Version 0.3.3 BETA // Internal Development Build
A portable network exploration workstation built for system administrators, technical operators, OSINT researchers, developers, incident responders, and anyone who needs to see which processes are talking, where they are connecting, what protocols they are using, and how the activity changes over time.
Deep Signal Operations
NET brings packet-aware observation, process attribution, host intelligence, persistent storage, and exportable reporting into one desktop interface. It is designed to remain useful whether you are examining a single workstation, validating application behavior, mapping outbound dependencies, investigating unexpected traffic, or building a repeatable reconnaissance record.
Observe active network conversations as they emerge, including local and remote addresses, ports, transport protocols, timestamps, and process attribution.
Aggregate repeated flows into host-centric records so a noisy stream of sockets becomes a readable map of external systems and recurring destinations.
Prioritize activity through operational scoring and contextual indicators rather than treating every connection as equally important.
Separate traffic by protocol and service behavior to understand whether a connection represents browsing, name resolution, encrypted transport, or another network function.
Keep application state, observed data, DNS intelligence, logs, and generated reports beside the portable executable in a predictable release directory.
Move from live observation to durable documentation with machine-readable and human-readable export formats suitable for review, archiving, and later analysis.
Release Availability
DarkMatter NET remains under active development and internal testing. Public binary and source packages are not currently being distributed. This section will provide official release access when a supported public build is ready.
The portable Linux build is currently reserved for development and controlled testing. No public binary package is available for download at this time.
The project source remains private while development, testing, documentation, and packaging work continue. No public source archive is available at this time.
Packet Capture Rules
NET can display ordinary socket information as a normal user, but packet capture requires permission
to open raw sockets and inspect network interfaces. On Linux, the supported beta procedure is to launch
the application with sudo.
Linux restricts packet capture because raw packets can expose traffic beyond a single application. NET does not bypass this model. It asks the operating system for legitimate capture access and must be started with the corresponding privileges.
$ cd /path/to/NET_0.3.3_BETA $ sudo ./NET
$ cd /path/to/NET_0.3.3_Source $ sudo python3 -m venv .venv $ sudo .venv/bin/python -m pip install -r requirements.txt $ sudo .venv/bin/python app.py
$ sudo .venv/bin/python -m pip install pyinstaller $ sudo .venv/bin/python -m PyInstaller --clean --noconfirm NET.spec # Result: dist/NET/NET $ cd dist/NET $ sudo ./NET
Operator Workflow
NET is intended to be explored interactively. Begin with a quiet baseline, start capture, generate or observe known activity, and then pivot between flows, hosts, process details, DNS information, and reports.
Launch the portable binary or source entry point using sudo. Confirm that the main window opens and the expected network interface is available.
Choose the interface carrying the traffic you want to observe. On many workstations this will be an Ethernet or Wi-Fi interface rather than loopback.
Let NET observe the system before launching additional software. This exposes background services, update checks, name resolution, and persistent outbound behavior.
Open a browser, run a network-aware application, perform a DNS lookup, or connect to a known service. Compare the expected behavior with the observed flows.
Use the flow table for connection-level details, then move to Remote Hosts to review aggregated destinations, hostnames, process associations, ports, and risk context.
Allow automatic reverse DNS or trigger manual resolution for selected hosts. A missing PTR record is normal and should not be treated as proof of malicious behavior.
Identify which executable initiated a connection, which local port was used, which remote service answered, and whether the same relationship repeats over time.
Create HTML reports for human review or export CSV and JSON datasets for archival, scripting, comparison, and additional analysis.
Interface Map
Each view answers a different operational question. Use them together rather than expecting one table to tell the entire story of a network event.
| Workspace | Primary Question | Typical Data | Operator Use |
|---|---|---|---|
| Live Flows | What is communicating right now? | Process, protocol, local IP/port, remote IP/port, hostname, timestamps | Immediate observation and event correlation |
| Remote Hosts | Which external systems recur? | Remote IP, hostname, DNS status, flow count, processes, ports, risk | Destination profiling and dependency mapping |
| Flow Details | What happened in this connection? | Expanded endpoint, process, timing, and protocol metadata | Focused review of a selected event |
| DNS Intelligence | Does this address publish a PTR hostname? | Resolved hostname, status, cache age, lookup outcome | Context enrichment and host labeling |
| Reports | How do I preserve or share the findings? | HTML, CSV, JSON | Documentation, archiving, and downstream analysis |
| Settings | How should NET behave? | Theme, refresh behavior, DNS options, cache lifetime, interface choices | Operational configuration |
Portable Runtime
The PyInstaller one-folder release keeps writable state beside the executable instead of hiding it in a temporary extraction directory. Archive the folder and you archive the working application state with it.
NET/ ├── NET ├── _internal/ ├── config/ │ └── ui.json ├── data/ │ └── net.sqlite ├── exports/ ├── logs/ │ └── net.log ├── README.md └── LICENSE
data/ before major upgrades.config/ when retaining user settings.logs/ during troubleshooting.exports/ separately when reports are evidence._internal/ unless rebuilding the release.Visual Presets
NET includes purpose-built visual presets rather than superficial color swaps. Each theme changes the operating atmosphere while retaining the same information architecture and control placement.
Network intelligence // deep signal operations. Black, steel, controlled red, and subdued command-blue accents.
Field intelligence // sand table operations. Warm tactical neutrals, muted green, and low-glare gold indicators.
Blue water recon // signal surface operations. Deep teal panels, cyan instrumentation, and cool blue telemetry.
Responsible Operation
NET is an administrative and diagnostic instrument. Packet and process data can be sensitive. Operate only within your authorization, minimize unnecessary capture, and handle reports as system records.
Capture traffic only on systems and networks you own, administer, or have explicit permission to inspect.
Capture long enough to answer the operational question. Avoid retaining unrelated traffic indefinitely.
Preserve original exports, record collection times, and avoid altering reports that may be used for later comparison.
Troubleshooting
Most startup problems come from missing privileges, incomplete extraction, selecting the wrong interface, or running the executable outside its release folder.
Close the application and relaunch it with sudo. Confirm the selected interface is active and that traffic is actually passing through it. Loopback traffic will not appear on an Ethernet or Wi-Fi interface.
Keep the complete release folder intact. NET expects its writable data/, config/, logs/, and exports/ directories beside the executable.
Reverse DNS is optional infrastructure. Many legitimate systems do not publish PTR records. NET should preserve the IP address and report the lookup status rather than inventing a hostname.
Private addresses often depend on a local DNS server, router, hosts file, or enterprise naming system. Enable private-address resolution only when your network provides useful local PTR records.
Yes. Copy the entire release directory. A Linux binary must still match the target architecture and system compatibility expectations.
No. Extract the new release into its own directory, test it, then copy only the data or configuration you intentionally want to preserve. This prevents mixed-version modules and stale bundled files.
DarkMatter Software
DarkMatter NET is still being refined behind the curtain. Public binary and source packages are not yet available, but this page will become the official release point when distribution begins.