Skip to content

Hodometer 1.2.0

Choose a tag to compare

View all tags
@gary23w gary23w released this 29 Oct 15:05
· 2 commits to main since this release
v1.2.0
f9e7b54
This commit was signed with the committer’s verified signature.
gary23w Garrett Stimpson
SSH Key Fingerprint: 7OqZD8nkDbK00URTZ2xZPRa3AFiy3eO+XoHaGtqy/og
Verified
Learn about vigilant mode.

Hodometer 1.2.0 lets you zoom into any process: its connections, its packets decoded on the wire, what it is and who started it, and what it spawned, with pcapng export. Everything still comes from Windows' own kernel telemetry and capture driver; there is no driver to install.

What's new

  • Inspector. Double-click a process (or use the Inspect button, the right-click menu, or inspect <pid> show) to open a window for that one process:
    • Header: signer (embedded Authenticode or the Windows catalog), path, command line, user, integrity level, parent, start time, children, threads, handles, CPU, memory, disk, GPU, bytes and a two-minute rate graph.
    • Connections: every TCP connection and UDP flow with state, rates and totals, retransmits, RTT (TCP ESTATS), connect time, and the TLS SNI, ALPN and version, HTTP request or QUIC version.
    • Packets: live frames with a one-line decode: TLS ClientHello SNI/ALPN (reassembled across segments), DNS queries and answers, plaintext HTTP, QUIC, including the decrypted QUIC v1 Initial so HTTP/3 connections show their SNI too. Payloads stay encrypted.
    • Timeline: connects, failures with the Winsock error, retransmits, hellos, child processes, DLL loads, exit.
    • Capture 30 s → pcapng of just this process, Copy JSON, Kill, Block.
  • Packet zoom runs only while something is inspected, watched or captured. Frames are attributed to processes by address and port, so you get per-process packets.
  • Socket: new inspect, conns, watch, capture and zoom commands; new flow, pkt, trace and capture events; tick and list now carry active connections, retransmitted bytes and failed connects. See the README.
  • Hostnames learned from TLS SNI fill the host column when DNS revealed none (browsers using DNS over HTTPS).
  • SENTINEL.md: a design and prompts for an AI defense built on the socket.
  • No longer needs libwinpthread-1.dll; dark scrollbars and menus.

Fixes

  • UDP traffic received from a remote was recorded with local and remote swapped.
  • Socket command arguments longer than 63 characters were cut off.

Install

  1. Download Hodometer.exe and install.ps1 into the same folder.
  2. Run install.ps1 from an elevated PowerShell. It registers the Hodometer logon task (elevated, no UAC prompt), adds a Desktop shortcut that starts that task, and starts the app.

Upgrading from 1.1.0: exit Hodometer from the tray menu, replace Hodometer.exe, and start it again. The logon task and your trusted and blocked lists are kept. install.ps1 is unchanged from 1.1.0.

Build

Hodometer.exe was built from this tag with build.ps1 (MinGW-w64, static). It is not code-signed, so Windows SmartScreen may warn on first run.

SHA-256 9250783eda5e7426f36b684f6127b5ec8fdd949d3e01919b9c64a98130294869

Assets 4
Loading