---
name: "netwatch"
section: "1"
platform: "linux"
package: "netwatch"
version: "1.3.1_2-4"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/netwatch"
---

# netwatch(1)

Ethernet Internet Protocol Monitor

## NAME

Netwatch - Ethernet Internet Protocol Monitor

## SYNOPSIS

**netwatch** \[ -h \] \[-b\] \[-i dd.dd.dd.dd\] \[-m dd.dd.dd.dd\] \[-n\] \[ - t\] \[ -e ethnum \] \[ -c netconfigfile \]

## DESCRIPTION

*Netwatch* examines all the packets travelling on an ethernet and analyses the IP packets. The information is tallied according to the source and destination hosts. An  *ncurses* display indicates a dual-list status for all hosts. The left display refers to LOCAL hosts. The right list refers to REMOTE hosts.  It is possible to examine statistics (counts) on number of packets, bytes, IP service type and last communication host for each host. Use the arrow keys (left and right) to change the display.

-

  ## OPTIONS

- **-e ethnum**

  **ethnum** is the name of the ethernet device to attempt to run with **netwatch.** (e.g. **-e eth1** selects the  *eth1* device rather than the default *eth0* device.

- **-c confignetfile**

  selects the name of the file which contains the  *ifconfig* information. Note that this is not necessary since  **netwatch** will use the route information from **/proc/net** to build all the information needed (without using ANY configuration file).

- **-b**

  For a transparent bridge, ignore every other packet... (older kernels)

- **-i dd.dd.dd.dd**

  Fake a local internet address for "this" machine... (useful in making *fake local net* for monitoring when combined with the  *-m option* )

- **-m dd.dd.dd.dd**

  Fake the  *netmask* which is used for the local net evaluation

- **-n**

  Do not resolve names (just display addresses)

- **-h**

  Simple help information

- **-t**

  Start Netwatch in TOP Mode (30 sec. startup delay)

## USER COMMANDS

The following description will attempt to clarify what keys  **netwatch** understands. It is important to know that the program is  *mode* dependent. This means commands may change depending on the current mode. The primary mode is  **dual-list** mode. In this mode use

- **\<tab\>**

  key     - switch scroll display to the other list (dual-lists). Look for  **KEY.**

- **\<left\>**

  key     - Change display options (moving left through the options)

- **\<right\>**

  key     - Change display options (moving right through the options)

- **\<up\>**

  key     - Scroll to previous host page on the current list (see **KEY)** Change display options (moving right through the options)

- **\<down\>**

  key     - Scroll to next host page on the current list (see **KEY)**

- **h**

  key     - gives help screen

- **t**

  key     - Toggle TOP mode (where 30 sec update on busiest hosts)

- **c**

  key     - Clear counts for all hosts

- **n**

  key     - Clean the remote & local host tables

- **N**

  key     - Clean the remote OR local host tables (depends on which is current)

- **L**

  key     - Produce LOG of current display entries (REMOTE or LOCAL)

- **b**

  key     - Toggle display of BLUE entries (OLD)

- **d**

  key     - Toggle display of DOMAIN entries (Name Server Queries)

- **w**

  key     - Enter WATCH mode for viewing ROUTING stats and HOST packets

- **\<F10\>, \<END\>**

  or  **q** key     - Exits the program

## AUTHOR

*Gordon MacKay*

```
		mackay@gmml.slctech.org
```

## COPYRIGHT

Copyright (c) Gordon MacKay 1997, under GPL

## BUGS

Yes, but hopefully the program is better than it was...