nethawk — terminal network traffic analysis

Linux / Modern CLI Tools / nethawk.html

💬 "nethawk command"

nethawk is a real-time network traffic analysis tool for the terminal. It captures packets directly with libpcap and puts bandwidth, protocols, and remote hosts on a single screen, classifying traffic patterns in real time.

Written in Go as a single binary (about 5MB), it runs with no config files and no database. When packets per second exceed your threshold, it highlights the attack type — DNS or NTP amplification, SYN flood, and more — with color.

• Concept: Captures packets with libpcap and visualizes live traffic in the terminal.
• Main Feature: Shows bandwidth, protocol ratios, top source IPs, top destination ports, and attack detection on one screen.
• Advantage: Runs as a single zero-config binary, and -json output connects to other tools.
• Usage: Useful to see what traffic is hitting a server in front of the firewall.

Basic Usage

nethawk opens a full-screen realtime dashboard once launched. Start it and read the screen as follows.

1. List interfaces, then run

First find the network interface name, then run with root privileges.

nethawk -list        # list available interfaces (eth0, ens3, ...)
sudo nethawk         # start on auto-detected interface
sudo nethawk -i eth0 # specify an interface

2. How to read the screen

Several panels refresh in realtime.

• Bandwidth: current send/receive bitrate as a graph. A sudden spike against baseline is an attack signal.
• Protocol ratio: TCP/UDP/ICMP split. A sharp rise in UDP share can indicate an amplification attack.
• Top source IPs / destination ports: who sends the most and where traffic is aimed. A repeated IP is a block candidate.
• Attack banner: when PPS exceeds the threshold (-t), the attack type (DNS/NTP amplification, SYN flood, ...) is shown colored on top.

3. Quit

Press Ctrl+C to exit the dashboard. Capture happens in memory and leaves nothing behind.

Installation and Download

nethawk installs via the official script, building from source, or a release binary. libpcap is required for packet capture.

Verify the install with nethawk -list to see interfaces, and run with sudo nethawk (packet capture needs root).

Commonly Used Options

Three Essential Command Combinations

• sudo nethawk — auto-detect the interface and monitor all traffic
• sudo nethawk -i eth0 — monitor a specific interface
• sudo nethawk -json | jq '.severity' — extract just the severity from JSON output

💬 "Show me a real-world example of using nethawk on a server"

Situations you frequently meet on a production server, in order.

Step 1 · Check the install

Check whether libpcap and nethawk are installed.

nethawk -list 2>/dev/null || sudo sh -c 'curl -sSfL https://raw.githubusercontent.com/Flowtriq/nethawk/main/install.sh | sh'

Step 2 · Watch live traffic

Watch all incoming traffic in real time.

sudo nethawk -i eth0

Step 3 · Log anomalous traffic as JSON

Extract severity and pass it to another tool.

sudo nethawk -i eth0 -json | jq -c '{pps, severity, top_port: .top_ports[0].port}'

How It Is Used in Practice

1. Identify the attack type instantly

Situation — Check whether traffic has suddenly spiked.

sudo nethawk -i eth0 -t 50000

Result — When PPS crosses the threshold, the attack type (DNS amplification, SYN flood, etc.) is shown with color.

Key point — You can immediately see which service port is under attack.

2. Track the top source IPs

Situation — Find the IPs sending the most traffic.

sudo nethawk -json | jq '.top_sources[:5]'

Result — A list of top source IPs by packet count.

Key point — Use the data as evidence when writing firewall block rules.

Caveats

• Packet capture requires root (same as tcpdump or Wireshark).
• Attack detection is for live observation only — it does not auto-block (blocking needs a separate firewall or DDoS solution).
• Under very heavy traffic, source-IP tracking is capped to bound memory usage.
• This is a young project (low star count), so vet it against your trust and reliability needs before production use.