Command Reference

🇧🇷 Português

Every subcommand, its flags, and what to expect. Run netwp help for the one-line version. Commands that only read the network never need admin on Windows.

scan

netwp scan [--json] [--diff] [--ports=<list>] [--class=<class>]

One-shot ARP sweep of your subnet, then enrichment per device: hostname (reverse DNS, then mDNS/NetBIOS), vendor from the MAC's OUI, a device-class guess, RTT and TTL from one ICMP echo, and open ports from a curated probe.

• --json prints a machine-readable array instead of the table.
• --diff prints only what changed since the last scan (joins, departures, IP changes, and possible IP/MAC conflicts), comparing by MAC.
• --ports=22,80,443 probes a custom TCP port set instead of the ~29 curated defaults. Comma-separated individual ports, no ranges.
• --class=media shows only devices of one class (router|computer|mobile|media|printer|iot). Display-only: the scan cache still stores every device, so alias and --diff are unaffected. An unknown class name fails fast, before scanning.

netwp scan
netwp scan --json | ConvertFrom-Json | Where-Object reachable
netwp scan --diff
netwp scan --ports=22,80,3000,32400
netwp scan --class=media

monitor

netwp monitor [--alert-down=<rate>] [--quiet]

The live version of scan: a TUI that re-scans on an interval and reports devices joining and leaving in real time. An unrecognized device joining (no alias set) rings the terminal bell.

• --alert-down=50Mbps samples the active interface once a second and highlights the bandwidth line when download drops below the threshold (Mbps, Kbps, Gbps, bps). Omit it and there is no bandwidth line.
• --quiet runs headless (no UI): it prints one plain line per join/leave to stdout and still records events, for a background service or a logfile. Ctrl-C/SIGTERM stops it cleanly.
• Press / to filter the device table (see Filtering) and s to sort it (see Sorting).
• r rescans now (re-resolving hostnames instead of serving the cache), q quits.

dashboard

netwp dashboard

A composite live view: Wi-Fi (with a channel suggestion from nearby AP congestion), real-time bandwidth, a periodic speedtest, the device table, and a LOG panel tracing the dashboard's own work (scans, speedtests, internet/Wi-Fi changes). Same / filter, s sort, r, and q keys as monitor.

doctor

netwp doctor [--json]

Diagnoses connectivity top-down: interface has an IP, gateway responds, internet is reachable, DNS resolves, Wi-Fi signal. Each check prints a hint on failure. Read it top to bottom: the first ✗ is usually the root cause and explains the ones below it. --json prints the checks as a machine-readable array.

ports

netwp ports <ip> [--json]

Probes one device directly and lists its open ports by name (SSH, SMB, RDP, ...), plus RTT and TTL. No port history across runs, just the current state. --json prints the result as a machine-readable object.

wake

netwp wake <ip-or-mac-or-alias>

Broadcasts a Wake-on-LAN magic packet to power on a sleeping device. Only works if that device has WoL enabled in its BIOS/OS. It is fire-and-forget: netwp reports "sent", not "woke". Accepts an alias name or a cached IP, so it resolves even while the target is off.

speedtest

netwp speedtest [--json]

Download/upload throughput against Cloudflare's anycast speed.cloudflare.com; prints which edge answered (e.g. "via Cloudflare edge: GRU"). --json prints the download/upload/edge as a machine-readable object.

iface

netwp iface
netwp iface static <ip>/<bits> <gateway> [dns...]
netwp iface dhcp

iface alone inspects the active interface's IP config (read-only, any OS). iface static and iface dhcp change the real config on Windows; both need an elevated terminal and ask for a typed "yes". Not implemented on Linux.

netwp iface static 192.168.1.50/24 192.168.1.1 8.8.8.8 1.1.1.1
netwp iface dhcp

alias

netwp alias set <ip-or-mac> <name>
netwp alias ls
netwp alias rm <ip-or-mac>

Nicknames a device. Aliases are keyed by MAC, so they survive a DHCP IP change. alias set <ip> resolves the MAC from the last scan's cache when possible; pass a MAC to skip the network entirely.

netwp alias set 192.168.1.20 "Living Room TV"

class

netwp class set <ip-or-mac> <class>   # router|computer|mobile|media|printer|iot
netwp class ls
netwp class rm <ip-or-mac>

Pins a device's class when the automatic guess is wrong (a phone with a random MAC and no open ports often falls to Unknown). A manual pin is kept by MAC and always wins over the guess.

netwp class set 192.168.1.20 mobile

watch

netwp watch add <ip-or-mac>
netwp watch ls
netwp watch rm <ip-or-mac>

Marks a device whose absence matters (a camera, a server). While monitor or dashboard runs, a watched device leaving highlights its log line and rings the terminal bell.

events

netwp events [n] [--device=<alias-or-mac>]

Prints the last n join/leave events (default 20) recorded by monitor and dashboard in events.jsonl. --device restricts to one device; it resolves an alias to its MAC, so it also catches events logged before the alias existed.

netwp events 50
netwp events --device="Living Room TV"

version / update / uninstall / help

• netwp version prints the installed version.
• netwp update re-runs go install ...@latest (needs Go).
• netwp uninstall removes local data after a confirmation and prints how to remove the binary.
• netwp help (or no arguments) prints usage.

Filtering

In monitor and dashboard, press / to filter the device table by a case-insensitive substring of any field (IP, alias, hostname, vendor, MAC, class). Type to narrow, Enter keeps the filter applied, Esc clears it. The online/known counts still reflect the whole network.

Sorting

In monitor and dashboard, press s to cycle the device table's sort column (IP, RTT, name, class); the active column shows in the footer. Online devices always sort ahead of offline ones, so s orders within each group. RTT puts reachable devices first, fastest first.

Where data lives

netwp keeps a few plain files under <user-config-dir>/netwp/ (%AppData%\netwp on Windows, ~/.config/netwp on Linux):

File	Written by
aliases.json	alias
classoverride.json	class
watchlist.json	watch
lastscan.json	scan (cache, so alias set <ip> is instant)
events.jsonl	monitor / dashboard (incl. monitor --quiet)

All are human-readable and safe to delete; netwp uninstall removes them. events.jsonl is bounded: once it passes ~1 MB it is trimmed to the most recent 5000 events, so a long-running monitor can't grow it without limit.