Hodometer 1.3.0

Hodometer 1.3.0 makes the socket fit for many AI agents working at once, and adds the Sentinel daemon: the non-AI part of the defense that SENTINEL.md describes.

What's new

• Commands run in parallel. Four worker threads serve the socket. Each client's commands still run one at a time and reply in the order sent, but a slow inspect from one client no longer holds up the others. Up to 128 commands can wait across all clients; past that a client gets command queue full, try again.
• Four captures at once, one per process (or one for every process). capture stop <pid> ends one, capture stop ends all, and capture lists them in captures[]. The capture event carries active. Each Inspector shows its own process's capture.
• conns pages and filters: conns [pid|all] [active] [since <now>] [cursor <n>] [limit <n>], with total, count, next and now in the reply, so a poller can read every flow, or only what changed since its last poll.
• Lighter packet streams. watch <pid> handshakes sends only the frames that decode to TLS or QUIC hellos, DNS or HTTP. A new flowinfo event announces a flow's SNI, ALPN, HTTP request or TLS version as soon as it is decoded, without packets.
• 64 watched processes per connection (was 8).
• inspect reports the executable's SHA-256, and signature checks are cached per path and hash.
• status reports captures, max_captures, max_watch and workers.
• Sentinel daemon (sentinel/ in the source; Python, not part of the download). It owns the Hodometer connections, scores every process with the rubric in SENTINEL.md, starts an evidence capture at SUSPECT, and runs the Sentinel coordinator and up to four investigators on the Claude API. It runs from its own private Python copy, so allowing it does not trust every Python script on the machine, and it is dry-run by default: kills and blocks are logged, not sent. See sentinel/README.md. It has been run live against Hodometer without models; the run with models has not been tested yet.
• build.ps1 -Out <name> builds under another name while Hodometer.exe is running.

Install

1. Download Hodometer.exe and install.ps1 into the same folder.
2. Run install.ps1 from an elevated PowerShell. It registers the Hodometer logon task (elevated, no UAC prompt), adds a Desktop shortcut that starts that task, and starts the app.

Upgrading from 1.2.0: exit Hodometer from the tray menu, replace Hodometer.exe, and start it again. The logon task and your trusted and blocked lists are kept. install.ps1 is unchanged since 1.1.0. The socket protocol is backward compatible.

Build

Hodometer.exe was built from this tag with build.ps1 (MinGW-w64, static). It is not code-signed, so Windows SmartScreen may warn on first run.

SHA-256 c5fe6135050562749df3c5a0dc8aa27f315bbe27e3da6e57d3ecadfed4de28fc

Hodometer 1.2.0

Hodometer 1.2.0 lets you zoom into any process: its connections, its packets decoded on the wire, what it is and who started it, and what it spawned, with pcapng export. Everything still comes from Windows' own kernel telemetry and capture driver; there is no driver to install.

What's new

• Inspector. Double-click a process (or use the Inspect button, the right-click menu, or inspect <pid> show) to open a window for that one process:
  • Header: signer (embedded Authenticode or the Windows catalog), path, command line, user, integrity level, parent, start time, children, threads, handles, CPU, memory, disk, GPU, bytes and a two-minute rate graph.
  • Connections: every TCP connection and UDP flow with state, rates and totals, retransmits, RTT (TCP ESTATS), connect time, and the TLS SNI, ALPN and version, HTTP request or QUIC version.
  • Packets: live frames with a one-line decode: TLS ClientHello SNI/ALPN (reassembled across segments), DNS queries and answers, plaintext HTTP, QUIC, including the decrypted QUIC v1 Initial so HTTP/3 connections show their SNI too. Payloads stay encrypted.
  • Timeline: connects, failures with the Winsock error, retransmits, hellos, child processes, DLL loads, exit.
  • Capture 30 s → pcapng of just this process, Copy JSON, Kill, Block.
• Packet zoom runs only while something is inspected, watched or captured. Frames are attributed to processes by address and port, so you get per-process packets.
• Socket: new inspect, conns, watch, capture and zoom commands; new flow, pkt, trace and capture events; tick and list now carry active connections, retransmitted bytes and failed connects. See the README.
• Hostnames learned from TLS SNI fill the host column when DNS revealed none (browsers using DNS over HTTPS).
• SENTINEL.md: a design and prompts for an AI defense built on the socket.
• No longer needs libwinpthread-1.dll; dark scrollbars and menus.

Fixes

• UDP traffic received from a remote was recorded with local and remote swapped.
• Socket command arguments longer than 63 characters were cut off.

Install

1. Download Hodometer.exe and install.ps1 into the same folder.
2. Run install.ps1 from an elevated PowerShell. It registers the Hodometer logon task (elevated, no UAC prompt), adds a Desktop shortcut that starts that task, and starts the app.

Upgrading from 1.1.0: exit Hodometer from the tray menu, replace Hodometer.exe, and start it again. The logon task and your trusted and blocked lists are kept. install.ps1 is unchanged from 1.1.0.

Build

Hodometer.exe was built from this tag with build.ps1 (MinGW-w64, static). It is not code-signed, so Windows SmartScreen may warn on first run.

SHA-256 9250783eda5e7426f36b684f6127b5ec8fdd949d3e01919b9c64a98130294869

Hodometer 1.1.0

First release of Hodometer, a system-tray network monitor for Windows 10/11 (x64). It shows which program is sending and receiving bytes and to which host, keeps Windows connection auditing switched on, lets you kill a process or block a program with Windows Firewall, and streams everything over a localhost socket (127.0.0.1:48201) that only programs you have allowed can use.

Install

1. Download Hodometer.exe and install.ps1 into the same folder.
2. Run install.ps1 from an elevated PowerShell. It registers the Hodometer logon task (elevated, no UAC prompt), adds a Desktop shortcut that starts that task, and starts the app.

You can also run Hodometer.exe directly; it asks for administrator rights. See the README for options, the socket protocol and uninstalling.

Build

Hodometer.exe was built from this tag with build.ps1 (MinGW-w64). It is not code-signed, so Windows SmartScreen may warn on first run.

SHA-256 509da67c00c8c2cb173aec132032a0aadc066d51dc0630d40e7afd556a56a219