Screenshots — proc-trace-net

CMD MODE · -ct FLAGS

Tracing a single command's network connections

Pass a command after the flags to trace only its network connections. The -t flag adds close timing — showing how long each connection was open before it was torn down.

$ sudo proc-trace-net -ct curl https://github.com

SYSTEM-WIDE MODE · -ctu FLAGS

Watching all connections machine-wide with user context

Run without a command to trace every TCP/UDP connection on the machine. The -u flag shows the owning user — root in red, normal users in green. Direction arrows immediately show whether a connection is inbound or outbound.

$ sudo proc-trace-net -ctu

STATE UPDATES · -cU FLAG

TCP state machine — every transition visible

The -U flag exposes every TCP state transition from the conntrack stream. Useful for debugging connection teardown issues, TIME_WAIT accumulation, or half-open connections.

$ sudo proc-trace-net -cUt

proc-trace-net — state updates

 3892 curl         TCP  10.0.2.15:54321           →  93.184.216.34:443
 3892 curl         TCP  10.0.2.15:54321           ⇒  93.184.216.34:443   ESTABLISHED
 3892 curl         TCP  10.0.2.15:54321           ⇒  93.184.216.34:443   FIN_WAIT
 3892 curl         TCP  10.0.2.15:54321           ⇒  93.184.216.34:443   TIME_WAIT
 3892 curl         TCP  10.0.2.15:54321           ×  93.184.216.34:443   0.342s

SECURITY AUDIT · -ctu FLAGS

Auditing what an install script actually contacts

Watch a package installer or untrusted script to see every network connection it makes — before you decide to trust it. Each outbound connection shows the destination IP and port in real time.

$ sudo proc-trace-net -ctu bash install.sh

proc-trace-net — install audit

 9001 bash        <root>  TCP  10.0.2.15:52100           →  52.1.0.1:443
 9002 curl        <root>  TCP  10.0.2.15:52101           →  releases.example.com:443
 9002 curl        <root>  TCP  10.0.2.15:52101           ×  releases.example.com:443  1.204s
 9003 systemctl   <root>  TCP  127.0.0.1:52200           →  127.0.0.1:1-systemd
 9003 systemctl   <root>  TCP  127.0.0.1:52200           ×  127.0.0.1:1-systemd      0.043s

CONTAINER INSPECTION · CMD MODE

Tracing docker pull network activity

Watch every registry endpoint and CDN contacted during a docker pull — from the host, without modifying the container.

$ sudo proc-trace-net -ct docker pull ubuntu:24.04

proc-trace-net — docker pull

 4401 dockerd      TCP  10.0.2.15:55001           →  52.1.0.1:443
 4401 dockerd      TCP  10.0.2.15:55001           ×  52.1.0.1:443            0.182s
 4401 dockerd      TCP  10.0.2.15:55011           →  18.64.12.99:443
 4401 dockerd      TCP  10.0.2.15:55011           ×  18.64.12.99:443         3.441s
 4401 dockerd      TCP  10.0.2.15:55021           →  18.64.12.99:443
 4401 dockerd      TCP  10.0.2.15:55021           ×  18.64.12.99:443         1.229s