A terminal UI (TUI) for conntrack on Linux: realtime network metrics for one Linux machine, in the terminal.
Realtime network metrics for one Linux machine, in the terminal. Three screens, refreshed every second, and every number on them comes from a file the kernel already exports.
Interfaces is throughput per interface: RX and TX in bytes per second and packets per second, a sparkline over the last minute, the link state, and the errors and drops the counters have accumulated. It is /proc/net/dev read twice a second apart, which is what a rate actually is.
Connections summarises the conntrack table: how many connections there are, what states they are in, split by protocol, and the busiest talkers by bytes when the kernel is counting them. Byte accounting (net.netfilter.nf_conntrack_acct) is off by default on most kernels, and when it is off this screen says so rather than inventing figures. On a machine with no conntrack at all it counts sockets instead and names the source it used.
Sockets is what is listening and what is established, from /proc/net/tcp, tcp6, udp and udp6.
It changes nothing: no action key, no confirm dialog, and no privilege beyond the sudo -n that reading the conntrack table needs.
| Key | Action |
|---|---|
| 1 / 2 / 3 | Interfaces, connections, sockets |
| tab | Next screen |
| p | Pause and resume the one-second refresh |
| / | Filter the rows |
| r | Sample now, without waiting for the tick |
| ? | Help |
| q | Quit |
Press ? inside the tool for the full help screen, which is generated from the same action table as the key map.
This tool is a face on the program below, so its version matters.Tested is not a claim: a version lands there only after the tool's own suite passed against it on a real machine in the lab, and the run is kept as evidence in the repository. At startup the tool probes the backend once and says what it found in its header — a version nobody has run against is shown as(untested) in the warning colour, one older than the minimum as (below minimum) in the error colour. Neither stops it: the backend still refuses what it cannot do, in its own words.
conntrack1.4.0conntrack --versionconntrack <1.4.0conntrack -L -o extended prints a layout this parser does not read, so the connections screen falls back to /proc/net/nf_conntrack or to counting sockets, and says which it used
Once per machine, then every tool in the family is one pacman away.
$ curl -fsSL https://pkgs.tui.tools/install.sh | shA family whose whole promise is preview before you run is not going to insist you pipe a script into a shell. These are the commands that script runs.
$ curl -fsSL -o /tmp/tui-tools.asc https://pkgs.tui.tools/pubkey.asc
sudo pacman-key --add /tmp/tui-tools.asc
sudo pacman-key --lsign-key \
"$(gpg --show-keys --with-colons /tmp/tui-tools.asc | awk -F: '/^fpr:/{print $10; exit}')"
printf '[tui-tools]\nServer = https://pkgs.tui.tools/arch/$arch\n' \
| sudo tee -a /etc/pacman.conf
sudo pacman -Sy$ sudo pacman -S tui-trafficNothing is published yet: tui-traffic is unreleased, and this channel turns available with its first release.
Once per machine, then every tool in the family is one apt away.
$ curl -fsSL https://pkgs.tui.tools/install.sh | shA family whose whole promise is preview before you run is not going to insist you pipe a script into a shell. These are the commands that script runs.
$ sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://pkgs.tui.tools/pubkey.asc \
| sudo gpg --dearmor -o /etc/apt/keyrings/tui-tools.gpg
echo "deb [signed-by=/etc/apt/keyrings/tui-tools.gpg] https://pkgs.tui.tools/deb stable main" \
| sudo tee /etc/apt/sources.list.d/tui-tools.list
sudo apt update$ sudo apt install tui-trafficNothing is published yet: tui-traffic is unreleased, and this channel turns available with its first release.
Once per machine, then every tool in the family is one dnf away.
$ curl -fsSL https://pkgs.tui.tools/install.sh | shA family whose whole promise is preview before you run is not going to insist you pipe a script into a shell. These are the commands that script runs.
$ sudo rpm --import https://pkgs.tui.tools/pubkey.asc
sudo curl -fsSL -o /etc/yum.repos.d/tui-tools.repo https://pkgs.tui.tools/rpm/tui-tools.repo
sudo dnf makecache$ sudo dnf install tui-trafficNothing is published yet: tui-traffic is unreleased, and this channel turns available with its first release.
$ curl -fsSL https://github.com/tui-tools/tui-traffic/releases/download/v0.1.1/tui-traffic_0.1.1_linux_amd64.tar.gz | tar -xz tui-traffic
sudo install -m0755 tui-traffic /usr/local/bin/tui-traffic$ curl -fsSL https://github.com/tui-tools/tui-traffic/releases/download/v0.1.1/tui-traffic_0.1.1_linux_arm64.tar.gz | tar -xz tui-traffic
sudo install -m0755 tui-traffic /usr/local/bin/tui-trafficThere is no release yet. Build from source in the meantime.
$ git clone https://github.com/tui-tools/tui-traffic
cd tui-traffic && make build
sudo install -m0755 bin/tui-traffic /usr/local/bin/tui-trafficNeeds Go 1.27 or newer. This is the only way to run it today.
Every change is shown as an exact command line and confirmed before it runs. The dialog and the runner receive the same value, so the preview cannot drift from what executes.
Only the conntrack table needs it. Everything else — /proc/net/dev, /proc/net/tcp and its siblings, /sys/class/net — is world-readable. Escalation is sudo -n, which never prompts: a machine where it does not work shows the socket-count fallback with the reason instead of asking for a password.
Nothing keeps running after you quit, and nothing is installed to run later. The system is the source of truth; the tool re-reads it after every change.
The tool opens no network connection of its own. No telemetry, no update check, no phone home.
Released statically linked, with no runtime dependencies to install.
checksums.txt carries a keyless cosign signature from this repository's release workflow, every archive has a CycloneDX SBOM, and every archive, package and the checksum file carry SLSA build provenance. The security page shows the three commands that check it.
Report a security issue privately, through GitHub's private vulnerability reporting on the repository's Security tab. The family-wide policy, and what counts as in scope, is on the security page.
| File | Size | SHA-256 |
|---|---|---|
| checksums.txt | 1 KB | — |
| checksums.txt.sigstore.json | 10 KB | — |
| provenance.intoto.jsonl | 12 KB | — |
| tui-traffic-0.1.1-1-aarch64.pkg.tar.zst | 1.7 MB | 2464147f3b24758713c34de78445fb7dcc5f427d54349ea5810269bf92a24a76 |
| tui-traffic-0.1.1-1-x86_64.pkg.tar.zst | 1.9 MB | 496faff8d6938080cddea9bc98ffa70acd15b840ecdc60d7a865ad855d91c937 |
| tui-traffic-0.1.1-1.aarch64.rpm | 1.7 MB | 617afacf095eafadec44a3893785271cc904ed036f11499dae31ac83630c5dc1 |
| tui-traffic-0.1.1-1.x86_64.rpm | 1.8 MB | 884fd76abd89f0a2cb0167d91806813076e23505478056fec3aaca63407dbc8b |
| tui-traffic_0.1.1_amd64.deb | 1.8 MB | c4a676a2052737663b225e5919a99a6a495112a6fe5b0327759622f5419908e3 |
| tui-traffic_0.1.1_arm64.deb | 1.7 MB | c63c791525be68ecf6f6e830e58ff3110266fd7a3e5d9cee1a1cf4da0935117f |
| tui-traffic_0.1.1_linux_amd64.tar.gz | 1.8 MB | 29a8e287128c9fe4e686978173fc070d960ef73f61a8aa5663efda54b2ecdf3b |
| tui-traffic_0.1.1_linux_amd64.tar.gz.cyclonedx.json | 24 KB | 8a3190d8bbee9c08ab3993b5ff1b18d89f1fb2ba82ec792ebb18156cc48a87d0 |
| tui-traffic_0.1.1_linux_arm64.tar.gz | 1.7 MB | 576c70b933a68663bd81e47f86dd73ef3a997cc9e7818071cc7c947e3597fe87 |
| tui-traffic_0.1.1_linux_arm64.tar.gz.cyclonedx.json | 24 KB | 3fb23c6433620ed694521c8566b95fb6e8883c09e9f194749b8d2a0731bf6641 |
Every release ships a checksums.txt. Download it next to the archive and run sha256sum -c checksums.txt --ignore-missing. See verifying a download.
## tui-traffic v0.1.1 tui-kit v0.3.0: the dialogs wrap and scroll instead of clipping the command preview, and the picker filters as you type. Built by this repository's CI on the tag itself. Each archive ships a CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and every file has SLSA build provenance — see the README's "Verify a download" for the two commands that check them. The commits in this release: ## Changelog * 5627c8bf458028450d4a178c583367e4a00e22fc Bump tui-kit to v0.3.0 (#7) * 32c4e58a6fed7d0ac64b017cd44097ea588b23bb tool.json: released (#6)
## tui-traffic v0.1.0 First validated release: the router-1.0 lab ran this tool against real VMs (tui-lab router topology). Built by this repository's CI on the tag itself. Each archive ships a CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and every file has SLSA build provenance — see the README's "Verify a download" for the two commands that check them. The commits in this release: ## Changelog * 180d7fc89f524ecd88849da53abf404b5807f918 Add internal/traffic: the read-only core and its three parsers (#3) * f8765574a4d43976b231524249aa2e54df0d5181 Add the smoke test and re-render the screenshots from the real binary (#5) * 8013ec0bab39f7aa2e227424a7c0179a24e8464d Bump anchore/sbom-action/download-syft (#2) * 2623d9568d26a94865f8289d8a5b96754d439e69 Initial commit * cad48b0983f748c2d75a69e0c9e099247d3a6276 Rename the template scaffold to tui-traffic (#1) * f78602a30599bd4022e738570fba73b8163eea20 Replace the template's sample with the three screens, --check and --report (#4)