👁 WireWatch — See Who Your Windows PC Talks To, in Real Time

WireWatch is a free, open-source real-time network monitor for Windows. It shows you exactly who is connecting to your PC and what data is leaving it — every outbound and inbound connection, mapped to the process that opened it, geolocated on a live world map, with the domain, ASN/owner, and automatic tracker / telemetry / threat tagging.

If you've ever wondered "is my PC being tracked? what's phoning home? who is this connecting to me?" — this is the dashboard that answers it.

No agents, no cloud, no account. Runs entirely on your machine. Your traffic never leaves your PC (except optional IP-geolocation lookups, which are cached).

---

✨ Features

• 🔴 Live connection dashboard — outbound ("what's leaving") and inbound ("who's connecting to me") tables, updating every second.
• 🧩 Process attribution — every connection is tied to the real .exe and PID that opened it, using WinDivert's kernel FLOW events (no fragile port-polling).
• 🗺️ World map — every remote IP plotted live (Leaflet), colored by risk.
• 🌐 Real domains, not just IPs — sniffs cleartext DNS, recovers hostnames via TLS SNI (works even with DoH/DoT), and falls back to reverse-DNS.
• 🏢 Who owns the IP — ASN, org, ISP, city/country via ip-api (cached locally in SQLite).
• 🚦 Automatic classification — every flow tagged normal / info / notice / warn / alert from offline heuristics (port, direction, process location, attribution).
• 🛡️ Tracker & threat intel — matches domains against 80k+ tracker/ad domains (StevenBlack) and IPs/domains against abuse.ch URLhaus + Feodo botnet C2 lists.
• 🔎 Click-to-drill-down — click any endpoint to see every flow, every process, bytes in/out, ports, the layer-7 content, and an event history.
• 🔒📖 Readability flags — instantly see which flows are encrypted (TLS) vs readable plaintext (HTTP), with a "readable only" filter and full request inspection (method, path, Host, Referer, content-type) for plaintext.
• ⚡ Built for load — per-flow aggregation, 1-second tick, WebSocket streaming. Doesn't melt your browser when you stream video.
• 💾 SQLite history — flows, events, and IP geo cached on disk for later querying via a small REST API.

---

🖼️ What it looks like

👁 WireWatch          ▲ OUT 1.2M/s   ▼ IN 340K/s   Active 87        ● live
┌──────────────────────────── 🗺️ world map of every remote IP ───────────────────────────┐
│   • • Google US      • Cloudflare      •• Amazon AWS        • (red) suspicious endpoint  │
└──────────────────────────────────────────────────────────────────────────────────────┘
 ▲ Outbound — what's leaving                                       Top processes by bandwidth
 Process    PID   Proto  Remote                Port  Out    In   Class   chrome.exe ▓▓▓▓▓▓ 4.2M
 chrome.exe 9123  TCP  🔒 ads.doubleclick.net  443   12K   2K   notice  Spotify.exe ▓▓▓ 1.1M
 svchost    1432  TCP  🔒 v10.events.data.ms…  443   8K    1K   info    Live feed
 ???        —     TCP  🔒 http-intake.logs.…   443   21K   7K   warn    11:04 tracker [doubleclick]
 updater    7766  TCP  📖 download.example/v2  80    900B  4M   normal  11:03 new_flow chrome → ...

Click any row → a drawer opens with the process(es) talking to that endpoint, every connection, layer-7 content, and the events for it.

---

🚀 Quick start

Requirements: Windows 10/11, Python 3.10+, and Administrator rights (kernel packet capture needs it). The WinDivert driver ships bundled with pydivert — no separate Npcap install required.

# 1. clone
git clone https://github.com/ImMike/wirewatch.git
cd wirewatch

# 2. install dependencies
python -m pip install -r requirements.txt

# 3. run (must be elevated — WinDivert needs Administrator)
#    easiest: the helper auto-elevates via UAC
powershell -ExecutionPolicy Bypass -File .\run.ps1
#    or, from an Administrator terminal:
python -m wirewatch

Then open http://127.0.0.1:8080 and browse normally — connections populate live.

Verify your setup first (optional but recommended)

# Administrator terminal, from the repo root:
python smoke_test.py

This confirms the WinDivert driver loads, that SNIFF mode leaves your networking intact, and auto-calibrates the FLOW address/port decode against ground truth.

---

🧠 How it works

WireWatch fuses two kernel data sources that each see half the picture:

flowchart LR
    A[WinDivert FLOW layer<br/>5-tuple + ProcessId] --> E[Engine<br/>fuse by 5-tuple]
    B[WinDivert NETWORK layer<br/>bytes, direction, DNS, TLS SNI, HTTP] --> E
    E --> C[Enricher thread<br/>ip-api geo + ASN + reverse-DNS]
    E --> D[Intel lists<br/>StevenBlack · URLhaus · Feodo]
    C --> E
    D --> E
    E --> F[(SQLite<br/>WAL)]
    E --> G[FastAPI + WebSocket]
    G --> H[Browser dashboard<br/>tables · map · feed · drill-down]

Loading

• The FLOW layer tells you which process owns a connection (kernel events, no polling).
• The NETWORK layer gives you bytes, direction, and payloads — from which WireWatch extracts DNS answers, TLS SNI, and plaintext HTTP.
• Both run in SNIFF mode, so packets are copied, never diverted — your networking is untouched.
• A single-threaded engine fuses them by 5-tuple, classifies, enriches, and streams aggregated updates to the browser over WebSocket.

---

🔐 Privacy & honesty about encryption

• Your traffic stays local. WireWatch does not upload your packets anywhere. The only outbound calls it makes are IP geolocation lookups to ip-api.com (rate-limited, cached locally for days) and daily downloads of public block-lists. You can run it fully offline (you just lose geo + lists).
• Most traffic is HTTPS/TLS — and WireWatch respects that. It can show you the destination (via SNI), sizes, timing, and the owning process, but it cannot read encrypted request/response bodies. Anything that is plaintext HTTP is flagged 📖 and fully readable.
• No kernel driver is left running after you stop it beyond WinDivert's standard lifecycle.

---

⚠️ Limitations

• Windows only (relies on the WinDivert kernel driver).
• Encrypted payloads stay encrypted — WireWatch is a passive monitor by design. It does not MITM your TLS.
• IP geolocation accuracy depends on ip-api's free tier (city-level, ASN-accurate).
• Some short-lived UDP flows or pre-existing connections at startup may show as unattributed until re-observed.

---

🗺️ Roadmap

• Attribution backfill for unattributed flows via Get-NetTCPConnection/psutil
• Exfiltration alerts — flag unusual sustained outbound spikes per process
• Per-endpoint bytes-over-time sparklines
• Optional opt-in TLS inspection mode (local root CA) for deliberate debugging
• Export / search UI over history

Contributions welcome — open an issue or PR.

---

🧰 Tech stack

Python · pydivert (WinDivert) · psutil · FastAPI · uvicorn · httpx · dnslib · SQLite · vanilla JS · Leaflet.

Threat/tracker data: StevenBlack/hosts, abuse.ch URLhaus & Feodo Tracker. Geolocation: ip-api.com.

---

📄 License

MIT — free for personal and commercial use.

---

_{Keywords: Windows network monitor · who is connecting to my PC · what data is leaving my computer · outbound connection monitor · per-process network usage · packet capture Windows · WinDivert Python · network traffic dashboard · detect tracking / telemetry / spyware · firewall connection viewer · netstat alternative · GlassWire alternative · open source · privacy.}