NetRewind 1.1.0

A modernization pass on the desktop application: the shell no longer scrolls itself away, Arabic covers the actual content an investigation reads rather than only the surrounding chrome, the client talks to a live recorder efficiently instead of re-fetching everything on a timer, and every page the 1.0.0 PRD named gets the workflow it was missing. No API contract broke; every addition is additive.

What is new

The shell stays where you put it. The app-shell no longer scrolls its sidebar away on a long page — the sidebar and the workspace body each get their own scroll region now, so the footer and language toggle stay reachable regardless of content length. Sidebar navigation is native <button>s in a labelled <nav>.

Real Arabic, not just Arabic chrome. Rules now carry translated titles, advice, and per-clause explanations (i18n.ar in rules/*.yaml), and all 19 shipped rules are translated. A generated event-kind catalogue and a shared formatting service give times, dates, durations and counts a correct, consistent Arabic rendering. An automated scanner flags any untranslated English sentence rendered in the Arabic app.

The client stops re-fetching everything on a timer. /v1/events and /v1/incidents gained keyset cursor pagination, fold-aware so a repeated event's updated count is never missed. /v1/rules and /v1/capabilities support conditional GET. A new /v1/what-happened endpoint gives the GUI the same identity-aware host lookup the CLI has always had. Real URL-based routing replaces in-memory page state — every page is a deep link now.

The investigation workflows the PRD named. Raw evidence disclosure on chain links, incident-scoped evidence export, a secret-free support-summary copy button, search/sort/filter and an optional master/detail layout on Incidents, a sticky save/discard bar on Settings, a match-count date range on Rules, and structured {code, params, technical_detail} error values in place of hard-coded English strings.

Type is no longer a fallback font. Four font families are vendored (SIL OFL 1.1) instead of relying on whatever the OS happened to have. Two real WCAG contrast failures were found and fixed, and every scroll region added this release is keyboard-focusable.

Local AI evaluation continues; still nothing ships. The evaluation harness gained the fixes a real benchmark needs — evidence cited by closed handles instead of a verbatim event ID, a structurally-enforced confidence ceiling, and a request shape corrected twice against the real local model server. No model ships and no AI feature is enabled in this release.

The full entry is in CHANGELOG.md; every claim is backed by a test in the tree or a recorded run under docs/evidence.

NetRewind 1.0.0

The first release of NetRewind as a product rather than a Linux daemon with a CLI: a recorder on Linux and on Windows, a desktop application that reads it, and evidence bundles that carry a record between machines. What the recorder observes on each platform is stated by the recorder itself, in a capability report, rather than claimed by the documentation.

What is new

The recorder serves a local API, and the desktop application reads it. netrewindd serves a versioned JSON API (/v1/health, /v1/capabilities, /v1/events, /v1/incidents, /v1/rules, /v1/bundle) over a local-only transport: a Unix domain socket on Linux (/run/netrewind/api.sock, shared with the netrewind group), a named pipe on Windows (\\.\pipe\netrewind-api, restricted by ACL to the installing user). No TCP port; read-only by construction. The desktop application (Arabic and English) has three sources: the demo recording, a live recorder over that API, and an evidence bundle file. Its Health page shows the recorder's own capability report: what it is watching, what it is not, and why.

Windows is a platform, not a stub. Interfaces, addresses, routes and neighbours are recorded through the IP Helper API and fed to the same analysis code as the Linux netlink collectors. netrewindd service install registers the recorder as a Windows service; the desktop installer bundles the recorder and runs that registration. Flows, filtering policy, DHCP/DNS on the wire and active probes have no Windows source in this release and are reported as unsupported rather than run as stubs.

Evidence bundles are usable from end to end. netrewind bundle export | inspect | import; the desktop application exports from a live recorder and opens any bundle after verifying every member's checksum and, when a public key is configured, its ed25519 signature.

Packaging. The .deb and .rpm were installed, upgraded, removed and purged on real systemd hosts; both create the netrewind group and recommend nftables. Linux desktop bundles and Windows installers are built by make desktop.

Local AI stays off. Two candidate models were benchmarked in both languages against the evaluation corpus; neither meets the release gate, so no model ships and no AI feature is enabled.

The full entry is in CHANGELOG.md; every claim is backed by a test in the tree or a recorded run under docs/evidence.

Install

• Linux — sudo apt install ./netrewind_1.0.0_amd64.deb (or dnf install the .rpm), sudo systemctl enable --now netrewindd, then the netrewind-desktop package or the AppImage. Arm64 packages and tarballs are included. docs/install.md
• Windows 10 22H2+ / 11, x64 — run NetRewind_1.0.0_x64-setup.exe as an administrator; it installs the desktop application and the recorder service. The .msi installs the same files for deployment tooling.
• Tarball — netrewind-1.0.0-linux-<arch>.tar.gz with install.sh; this is also what the self-updater fetches.

Verify

Every asset is listed in SHA256SUMS, and SHA256SUMS.sig is an ed25519 signature over that file made on the maintainer's machine — the key never touches CI.

sha256sum -c SHA256SUMS
openssl pkeyutl -verify -pubin -inkey netrewind-release.pub -rawin -in SHA256SUMS -sigfile SHA256SUMS.sig

The public key, in the form update.public_key takes in netrewindd.yaml (a recorder configured with it refuses any release that is not signed by the matching private key):

L3Q7cNQWNu50IjcKdJpCHTZXvwdk+qg3aN8c98UmZn8=

For openssl, the same key as PEM:

-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEAL3Q7cNQWNu50IjcKdJpCHTZXvwdk+qg3aN8c98UmZn8=
-----END PUBLIC KEY-----

NetRewind 0.9.1

The first release since 0.8.0. A hardening release: nothing here changes what
the recorder is for, and all of it came out of trying to break it deliberately.

Correlation no longer costs cubic time in the burst its own rules exist to
recognise. Two thousand flaps used to take thirteen seconds of CPU on the
goroutine that also makes events durable — so the recorder fell behind exactly
when the network was worst, and the shape that caused it was a flapping port,
which is what port-flapping was written to catch. Twenty thousand events now
take 2.4 seconds.

Retention now bounds the disk. It pruned the events and nothing else:
PruneIncidents existed and was called by nothing, and the identity table was
never pruned at all. A recorder on a segment with any churn grew until the disk
was full, however retention was configured.

The CLI no longer hands the terminal bytes the watched network chose. The
kernel accepts an escape character in an interface name, and a DNS name is
whatever somebody looked up. Printed unchanged, those could clear the
operator's screen — so the machine under investigation decided what the
investigator read.

A release can no longer be built with a standard library that has known holes
in it, and CI can no longer take the signature back off one.

Also: seven smaller fixes to the installer, the container image, credential
handling and the web interface; a content security policy; fuzz targets over
the parsers that read bytes off the wire; and regression tests for all of it.
See the changelog.

0.9.0 was written up in the changelog and never tagged or published. This
release contains everything both entries describe.

---

Verify before installing

sha256sum -c SHA256SUMS

SHA256SUMS.sig is an ed25519 signature over that file, made with a key that
never touches CI. To check it, or to have a recorder check it for you:

update:
  public_key: "L3Q7cNQWNu50IjcKdJpCHTZXvwdk+qg3aN8c98UmZn8="

A recorder configured with that key refuses any release it does not verify.

Install

tar -xzf netrewind-0.9.1-linux-amd64.tar.gz
cd netrewind-0.9.1-linux-amd64 && sudo ./install.sh

Or write the appliance image to a disk and boot it — it records from first boot,
has no sshd, and opens no port:

gunzip -c netrewind-0.9.1-appliance-amd64.img.gz | sudo dd of=/dev/sdX bs=4M conv=fsync

Built for linux/amd64 and linux/arm64; the same eBPF object serves both.
See docs/runbook.md
for where to place the recorder and what each position costs you.

NetRewind 0.8.0

The first version that does everything the project set out to do: record state
changes rather than packets, tie them to machines across address changes,
notice when a working path stops working, and say what changed just before it.

What it records

Interface state, the neighbour table, routing and addressing (netlink); TCP
connection outcomes from two eBPF tracepoints; nftables rule changes; DHCP, DNS
and ICMP metadata from a filtered packet socket; and ICMP reachability measured
against a baseline rather than a fixed threshold.

flow.first_failure_for_pair is the strongest single signal here: two machines
that were connecting a moment ago no longer can.

What it concludes

Nineteen correlation rules as YAML files rather than code. Every link in a chain
names the event it rests on and states whether it caused the next one,
merely correlated with it, or only preceded it — the engine never blurs
those, because a tool that does teaches its operator to distrust it.

Optional clauses placed before a rule's anchor are searched backwards in
time, which is how a rule asks the question the project exists for: the symptom
has arrived, so what changed just before it?

What it admits

A record that hides what it missed is not evidence. There are four ways to miss
something and they are separate kinds because they need separate answers:
system.gap (not running), system.drop (running, could not keep up),
system.collector_down (running, timeline unbroken, one source dead), and
store refusals counted in memory and admitted on the first write that succeeds.

How to run it

tar -xzf netrewind-0.8.0-linux-amd64.tar.gz
cd netrewind-0.8.0-linux-amd64 && sudo ./install.sh

Static binaries, no runtime dependencies. Configured from
/etc/netrewind/netrewindd.yaml, which refuses unknown keys and refuses a
configuration that would leave the recorder useless. There is also a container
image and a bootable appliance image (sudo make image) that comes up
recording with nothing to install.

Verified, not assumed

• 219 tests, race-clean across 15 packages
• A synthetic lab in network namespaces injecting fourteen faults, checking
  each is reconstructed and that correlation named the cause
• A GNS3 topology of three Cisco routers in OSPF and two switches with real
  VLANs and a dot1q trunk — which found a defect namespaces could not produce
• The release tarball installed on a clean host; the container built, run and
  serving; a fresh clone built with an empty cache
• Both eBPF programs confirmed loaded and JIT-compiled with bpftool
• The appliance booted in QEMU, where it measured its own power-off across a
  reboot and said so
• 10,000 events/second sustained; govulncheck clean

Known limits

The recorder sees what reaches it, and where you plug it in decides what the
record is worth — the runbook sets out what each position
costs. Connection observation is host-local: a recorder at the gateway watches
its own connections, not the ones it forwards. MAC randomisation breaks
long-term tracking of mobile devices. This is a lab project; nothing here has
been deployed to production hardware.

AGPL-3.0.