---
title: nethawk — terminal network traffic analysis
date: 2026-10-19
time: 12:00
model: admin
category: programs
author_type: human
summary: Captures packets with libpcap and visualizes live traffic, protocols, and attacks in a terminal TUI (Go).
tags: program, Modern CLI Tools, nethawk
---

**💬 "nethawk command"**

nethawk is a **real-time network traffic analysis tool for the terminal**. It captures packets directly with libpcap and puts bandwidth, protocols, and remote hosts on a single screen, classifying traffic patterns in real time.

Written in Go as a single binary (about 5MB), it runs with no config files and no database. When packets per second exceed your threshold, it highlights the attack type — DNS or NTP amplification, SYN flood, and more — with color.

- **Concept**: Captures packets with libpcap and visualizes live traffic in the terminal.
- **Main Feature**: Shows bandwidth, protocol ratios, top source IPs, top destination ports, and attack detection on one screen.
- **Advantage**: Runs as a single zero-config binary, and `-json` output connects to other tools.
- **Usage**: Useful to see what traffic is hitting a server in front of the firewall.
## Basic Usage

nethawk opens a full-screen realtime dashboard once launched. Start it and read the screen as follows.

### 1. List interfaces, then run

First find the network interface name, then run with root privileges.

```
nethawk -list        # list available interfaces (eth0, ens3, ...)
sudo nethawk         # start on auto-detected interface
sudo nethawk -i eth0 # specify an interface
```

### 2. How to read the screen

Several panels refresh in realtime.

- **Bandwidth**: current send/receive bitrate as a graph. A sudden spike against baseline is an attack signal.
- **Protocol ratio**: TCP/UDP/ICMP split. A sharp rise in UDP share can indicate an amplification attack.
- **Top source IPs / destination ports**: who sends the most and where traffic is aimed. A repeated IP is a block candidate.
- **Attack banner**: when PPS exceeds the threshold (-t), the attack type (DNS/NTP amplification, SYN flood, ...) is shown colored on top.
### 3. Quit

Press `Ctrl+C` to exit the dashboard. Capture happens in memory and leaves nothing behind.

## Installation and Download

nethawk installs via the official script, building from source, or a release binary. libpcap is required for packet capture.

| Environment | Command |
| --- | --- |
| Official one-liner (Linux/macOS) | curl -sSfL https://raw.githubusercontent.com/Flowtriq/nethawk/main/install.sh | sudo sh |
| Go source build | go install github.com/Flowtriq/nethawk/cmd/nethawk@latest |
| Release binary | github.com/Flowtriq/nethawk/releases |
| Ubuntu/Debian (libpcap) | sudo apt install libpcap-dev |
| RHEL/CentOS (libpcap) | sudo yum install libpcap-devel |

Verify the install with `nethawk -list` to see interfaces, and run with `sudo nethawk` (packet capture needs root).

## Commonly Used Options

| Option | Description |
| --- | --- |
| -i eth0 | Specify the interface to monitor |
| -t 100000 | Set the attack-detection PPS threshold (omit to use default) |
| -json | Output structured JSON for piping to other tools |
| -list | List available interfaces |

## Three Essential Command Combinations

- `sudo nethawk` — auto-detect the interface and monitor all traffic
- `sudo nethawk -i eth0` — monitor a specific interface
- `sudo nethawk -json | jq '.severity'` — extract just the severity from JSON output
**💬 "Show me a real-world example of using nethawk on a server"**

Situations you frequently meet on a production server, in order.

### Step 1 · Check the install

Check whether libpcap and nethawk are installed.

```
nethawk -list 2>/dev/null || sudo sh -c 'curl -sSfL https://raw.githubusercontent.com/Flowtriq/nethawk/main/install.sh | sh'
```

### Step 2 · Watch live traffic

Watch all incoming traffic in real time.

```
sudo nethawk -i eth0
```

### Step 3 · Log anomalous traffic as JSON

Extract severity and pass it to another tool.

```
sudo nethawk -i eth0 -json | jq -c '{pps, severity, top_port: .top_ports[0].port}'
```

## How It Is Used in Practice

### 1. Identify the attack type instantly

**Situation** — Check whether traffic has suddenly spiked.

```
sudo nethawk -i eth0 -t 50000
```

**Result** — When PPS crosses the threshold, the attack type (DNS amplification, SYN flood, etc.) is shown with color.

**Key point** — You can immediately see which service port is under attack.

### 2. Track the top source IPs

**Situation** — Find the IPs sending the most traffic.

```
sudo nethawk -json | jq '.top_sources[:5]'
```

**Result** — A list of top source IPs by packet count.

**Key point** — Use the data as evidence when writing firewall block rules.

## Caveats

- Packet capture requires root (same as tcpdump or Wireshark).
- Attack detection is for live observation only — it does not auto-block (blocking needs a separate firewall or DDoS solution).
- Under very heavy traffic, source-IP tracking is capped to bound memory usage.
- This is a young project (low star count), so vet it against your trust and reliability needs before production use.

---
Source (HTML): https://games.aidebatehub.com/programs/linux/modern/nethawk.html
This file is an auto-generated Markdown twin of the DevHub document.