netsent

a small monitor for linux that answers one question: what is this machine talking to right now, and which process opened it.

the mechanism is deliberately plain. psutil gives a snapshot of every tcp and udp connection, each one gets mapped to the process that owns it, and the new snapshot is diffed against the previous one. what comes out of that diff is a stream of NEW and CLOSED events rather than a wall of current state — a connection that stays open all day is mentioned once, not every second.

process names are cached by pid with the creation time kept alongside, because pids get reused: without that check a short-lived process can inherit the name of whatever died before it.

events go to the terminal and to sqlite. they used to be written one insert per event, which is a lot of disk chatter for a machine with a busy network — now they are batched.

needs root, because that is the only way to see which process owns a socket that isn't yours. it's a learning project and says so on the tin: there is no alerting, no daemon and no packet inspection, just an honest diff of the connection table.