Netglass v1.2.1

Security and reliability update.

• Harden elevated packet capture against shell injection.
• Keep rotated captures available to inspector and export.
• Count live packet-rate updates incrementally.
• Serialize sampler restarts around in-flight work.

Netglass v1.2.0

Netglass 1.2.0

New OPSEC features (all read-only):

• YAML scope import — define scope inline or import a file (allowed: / excluded: blocks with CIDRs and *.domains)
• Process ancestry — connection inspector shows the chain behind a connection (launchd → zsh → python3)
• Trust inspection — signed/unsigned, team ID, signing authority, SHA-256, temp-path / disk-image / system flags, changed-since-first-seen, network entitlements
• Periodic communication — Operations view flags regular outbound intervals per process/destination (jitter-based), exported with the evidence bundle
• Packet credential hints — Packet Inspector scans opened captures for plaintext credentials: HTTP auth/cookie headers, embedded-URL passwords, FTP/Telnet/POP3 USER/PASS, sensitive DNS names

218 tests, CI green.

Netglass v1.1.0

Netglass 1.1.0

New — Operation Mode (OPSEC workspace): start a named session with an expected tunnel interface and scope (CIDRs / domains / exclusions), watch a live timeline of connections, DNS and listeners, get leak warnings (tunnel bypass, IPv6 escape, pre-tunnel DNS, resolver drift, out-of-scope destinations, exposed listeners, traffic after stop), review a cleanup report, and export a JSON evidence bundle.

Performance — much lighter:

• Sampling now one-shot at 1 s (was a hot nettop stream at 0.25 s that burned ~136% CPU)
• Idle slowdown: ticks halve when nothing changes
• Info.plist lookups cached
• UI redraws 4 Hz → 1 Hz (WindowServer load drops)

Fixes: stable wall-clock chart buckets (bars no longer re-morph), rate measurement on the real 1 Hz nettop cadence, menu-bar meter clipping, wildcard listeners, leak-rule false positives.

198 tests, CI green.

Netglass v1.0.0

Netglass 1.0.0

A process-aware network monitor for macOS. Netglass shows which apps are talking, to whom, and how much — no kernel extensions, no filtering, fully read-only. Just Apple's own APIs and command-line tools.

Features

• Live connections — per-process flows with real-time throughput, app icons, and transport breakdown
• Apps & Domains — traffic aggregated per app and per domain, with reverse-DNS evidence for every hostname (forward-confirmed where possible)
• DNS activity — live DNS query monitoring
• Packet capture & inspector — ring-rotated pcapng captures with packet decoding (Ethernet/IP/TCP/UDP/ICMP, DNS, HTTP, TLS SNI + certificate details), follow-stream reassembly, and hex view
• History — persistent flow database with search, filtering, and CSV/JSON export
• Menu bar meter — little-Snitch-style speed bars with per-second traffic
• GeoIP — offline country lookup for IPv4 and IPv6
• flowdump CLI — headless flow sampling to the terminal (included in the repo)

Requirements

• macOS 15 or later (Apple Silicon or Intel)

Install

1. Download Netglass-v1.0.0-macos15.zip
2. Unzip, drag Netglass.app to Applications
3. On first launch, right-click → Open (the app is ad-hoc signed, not notarized)
4. Grant the admin password prompt when starting your first packet capture

Building from source

git clone https://github.com/vrlda/netglass.git
cd netglass
swift build
./scripts/build-app.sh --open

Caveats

• Read-only observer: cannot block or filter traffic
• Packet capture requires admin privileges (one-time password prompt) and is disabled in sandboxed builds
• History is stored locally in ~/Library/Application Support/Netglass