netsent

a small monitor for linux that answers one question: what is this machine
talking to right now, and which process opened it.

the mechanism is deliberately plain. psutil gives a snapshot of every tcp and
udp connection, each one gets mapped to the process that owns it, and the new
snapshot is diffed against the previous one. what comes out of that diff is a
stream of NEW and CLOSED events rather than a wall of current state — a
connection that stays open all day is mentioned once, not every second.

process names are cached by pid with the creation time kept alongside, because
pids get reused: without that check a short-lived process can inherit the name
of whatever died before it.

events go to the terminal and to sqlite. they used to be written one insert per
event, which is a lot of disk chatter for a machine with a busy network — now
they are batched.

needs root, because that is the only way to see which process owns a socket
that isn't yours. it's a learning project and says so on the tin: there is no
alerting, no daemon and no packet inspection, just an honest diff of the
connection table.