The problem
Activity monitors show how much bandwidth a machine uses, not where it goes. With agents, editors, and background apps all making requests, the useful question is which process is talking to which domain, right now.
The approach
ByteFall captures packets with gopacket, reads the server name from each TLS ClientHello, and maps connections to their source processes. The terminal interface, built with Bubble Tea, shows traffic as falling character streams coloured by domain, next to a live leaderboard of destinations, a process map, per-domain sparklines, and a connection graph.
Other details
- Any panel can run on its own as a fullscreen widget, including a network speed display in five styles.
- Demo mode runs on simulated traffic, so the interface can be tried without root privileges.
- macOS only for now. Install with
brew install sanif/tap/bytefall, or withgo install.