Your network, alive.
spectraNET measures every connection of every program and draws it as an animated 2.5D city, or as a 2D map: see which apps use the network, how much, with whom, and whether anything looks suspicious.
Every app you open talks to someone. spectraNET tells you who, how much and why, in plain words, in a 2.5D city you can explore or a 2D map seen from above. It reads the kernel's own counters, recognises video, calls and downloads without decrypting anything, and warns you when a program contacts a server known to be malicious. All of it measured locally, on macOS, Windows and Linux: the app, the snet command line and the snetd service.
The per-application network monitor.
snet brings the same measurement as the app, in the tradition of top, nettop and ntop, with man pages and JSON output.
snet top
Full-screen view: graphs, sortable table, details.
snet top → f
Press f: the Flow Inspector, one row per destination with kind, TLS and JA4.
snet list -c
Applications with their active connections.
snet inspect --name chrome
An application's network profile: kinds, protocols, TLS.
snet stream
What each connection carries, as it is recognised.
This computer sits at the centre. Around it, one tower per application, topped by its real icon: height is its speed right now, lit windows show how busy it is.
With the 2D | 2.5D switch, or the V key, you see the city from above. Every app is a tile with its icon inside a gauge: the arc running clockwise is its download, the one running anticlockwise its upload.
The camera frames the app, its destinations rise on the horizon and the inspector opens: what it is doing right now, in plain words, and who it is talking to.
Video, music, a call, web pages, a download or a game: spectraNET recognises it from the host, the pattern over the last half minute and the handshake sent in clear. Without reading the content.
Right-click a tower: pause an app, end it, close a single connection, or cut it off the network for 15 minutes, an hour, a day or until you unblock it.
Every alert says what happened, to which app and address, why it matters and what to do. The last 7 days stay on record, filterable by severity.
The snetd service counts every byte per application and per day. The last 7 or 30 days in one chart: total, busiest day, daily average and the apps that used the most.
spectraNET knows software-defined radio: receivers like SDR++ and GQRX, servers like rtl_tcp, decoders like SatDump and dump1090 get a district of their own, Radio & space.
The same city on macOS, Windows and Linux, each with its native graphics API. The numbers are the ones the kernel already keeps for every connection, not a guess from sniffed packets.
Pick the file for your system. Every download comes straight from the official releases on GitHub.
Open the DMG and drag spectraNET to Applications. The first time: right-click → Open, then Install service from the bar at the top.
Unpack the archive and run sudo ./snetd install: it installs the service, snet and the man pages.
Run the installer, in English or Italian: it installs the app and the service and can put snet on the PATH. No Run as administrator needed.
Unpack the archive; from an administrator PowerShell, .\snetd.exe install installs the service.
Make it executable and run it; sudo ./spectraNET-….AppImage snetd install adds the service. The same file runs snet.
sudo apt install ./spectranet_<version>_amd64.deb, then sudo snetd install for the systemd service.
Unpack the archive under /usr/local.
macOS 11 or later (Apple silicon and Intel), Windows 10/11 x64, Linux x86-64 with kernel 5.8+ and BTF (every current distribution).
Free. The snet command line and the snetd service are open source, under your choice of MIT or Apache-2.0.
Yes. The desktop app is free to download and use. The snet command line and the snetd service are open source, under your choice of MIT or Apache-2.0.
No. Everything is measured locally, and nothing is decrypted or uploaded. Hostnames come from DNS answers and the parts of TLS and QUIC handshakes sent in clear. The only things it downloads are public lists of malicious servers.
Open spectraNET: every tower in the city is an application using the network, and the taller it is, the more it is downloading or uploading right now. In a terminal, snet list shows the same apps, busiest first.
Yes. The 2D | 2.5D switch at the top of the city, or the V key, shows the same districts from above: every app is a tile with its icon inside a gauge, download running clockwise and upload anticlockwise. Bigger tiles are busier apps.
It measures continuously, learns more hostnames, keeps the history, raises alerts and carries out actions such as blocking. Without it the app still works, with fewer hostnames and no history or alerts. To just look around, run spectranet --demo.
Yes. snet follows the tradition of top, nettop and ntop: snet top for the full-screen view, snet stream for the kind of traffic, snet inspect for a process's profile, with JSON output and a man page for every command.
Yes, for 15 minutes, an hour, a day or until you unblock it. Linux and Windows block the program at once; macOS blocks the addresses the app uses as soon as they are seen. Blocks live in the service: remove it and they vanish, so nothing stays blocked by accident.
Yes. The app is not notarised by Apple yet: the first time, right-click spectraNET and choose Open. You only need to do it once.
spectraNET reads the byte counters the kernel already keeps for every connection, and every second compares them with the network adapters' own counters. In the tests published in the README, downloads, uploads and short connections come out exact on macOS, Linux and Windows.
spectraNET is free, and its command line and service are open source. If it showed you who uses your network, you can support its development: donations pay for code signing, test machines for the three systems and time for new features.
