{"id":51183900,"url":"https://github.com/matrixreligio/matrixnet","last_synced_at":"2026-06-30T16:00:29.862Z","repository":{"id":367535835,"uuid":"1281194037","full_name":"MatrixReligio/MatrixNet","owner":"MatrixReligio","description":"A native macOS network monitor + deep packet analyzer. Passive, zero-conflict, per-app attribution. SwiftUI, Apache-2.0.","archived":false,"fork":false,"pushed_at":"2026-06-26T12:17:42.000Z","size":606,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-26T12:18:47.608Z","etag":null,"topics":["developer-tools","macos","network-monitor","networking","packet-analyzer","privacy","security","swift","swiftui"],"latest_commit_sha":null,"homepage":null,"language":"Swift","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/MatrixReligio.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":"NOTICE","maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-26T10:05:57.000Z","updated_at":"2026-06-26T12:17:46.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/MatrixReligio/MatrixNet","commit_stats":null,"previous_names":["matrixreligio/matrixnet"],"tags_count":9,"template":false,"template_full_name":null,"purl":"pkg:github/MatrixReligio/MatrixNet","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MatrixReligio%2FMatrixNet","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MatrixReligio%2FMatrixNet/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MatrixReligio%2FMatrixNet/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MatrixReligio%2FMatrixNet/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/MatrixReligio","download_url":"https://codeload.github.com/MatrixReligio/MatrixNet/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MatrixReligio%2FMatrixNet/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34973617,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-30T02:00:05.919Z","response_time":92,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["developer-tools","macos","network-monitor","networking","packet-analyzer","privacy","security","swift","swiftui"],"created_at":"2026-06-27T09:01:53.524Z","updated_at":"2026-06-30T16:00:29.823Z","avatar_url":"https://github.com/MatrixReligio.png","language":"Swift","funding_links":[],"categories":[],"sub_categories":[],"readme":"# MatrixNet\n\n**English** · [简体中文](./README.zh-CN.md) · [繁體中文](./README.zh-Hant.md) · [日本語](./README.ja.md) · [한국어](./README.ko.md) · [Français](./README.fr.md) · [Deutsch](./README.de.md) · [Español](./README.es.md)\n\n**See which app is talking to which IP — then dig any flow down to the packet.**\n\nA 100% native SwiftUI network monitor and deep packet analyzer for macOS. As\neffortless as Activity Monitor for *who is on the network*, as deep as Wireshark\nfor *what is on the wire* — and every packet knows which app sent it.\n\n\u003ca href=\"https://www.producthunt.com/posts/matrixnet\" target=\"_blank\"\u003e\u003cpicture\u003e\u003csource media=\"(prefers-color-scheme: dark)\" srcset=\"https://api.producthunt.com/widgets/embed-image/v1/featured.svg?post_id=1183718\u0026theme=dark\" /\u003e\u003cimg src=\"https://api.producthunt.com/widgets/embed-image/v1/featured.svg?post_id=1183718\u0026theme=light\" alt=\"MatrixNet on Product Hunt\" width=\"250\" height=\"54\" /\u003e\u003c/picture\u003e\u003c/a\u003e\n\n[![CI](https://github.com/MatrixReligio/MatrixNet/actions/workflows/ci.yml/badge.svg)](https://github.com/MatrixReligio/MatrixNet/actions/workflows/ci.yml)\n[![License](https://img.shields.io/badge/license-Apache--2.0-blue)](./LICENSE)\n[![Platform](https://img.shields.io/badge/platform-macOS%2026%2B-black)](#requirements)\n[![Swift](https://img.shields.io/badge/Swift-6-orange)](https://swift.org)\n[![Release](https://img.shields.io/github/v/release/MatrixReligio/MatrixNet?sort=semver\u0026color=brightgreen)](https://github.com/MatrixReligio/MatrixNet/releases/latest)\n[![Downloads](https://img.shields.io/github/downloads/MatrixReligio/MatrixNet/total?label=downloads\u0026color=success)](https://github.com/MatrixReligio/MatrixNet/releases)\n[![Stars](https://img.shields.io/github/stars/MatrixReligio/MatrixNet?color=yellow)](https://github.com/MatrixReligio/MatrixNet/stargazers)\n[![Last commit](https://img.shields.io/github/last-commit/MatrixReligio/MatrixNet)](https://github.com/MatrixReligio/MatrixNet/commits/main)\n[![Notarized](https://img.shields.io/badge/Developer%20ID-notarized-success?logo=apple\u0026logoColor=white)](#installation)\n[![Passive](https://img.shields.io/badge/passive-zero--conflict-8A2BE2)](#privacy)\n[![No telemetry](https://img.shields.io/badge/telemetry-none-success)](#privacy)\n\n\u003e **100% passive — observe, never block.** MatrixNet reads only from the kernel's\n\u003e statistics and a copy of each packet, so it runs alongside any proxy, filter, or\n\u003e VPN without conflict. No firewall, no traffic interception, no HTTPS decryption.\n\n---\n\n## What is MatrixNet?\n\nTwo tools have owned macOS networking for a decade. **Little Snitch** tells you\n*which app* is connecting where. **Wireshark** shows you *every byte on the wire*\n— but with no idea which app produced it. MatrixNet brings both into one native\napp: per-app connection monitoring on top, packet-level dissection underneath,\nand a correlation layer that ties every captured packet back to the process and\nconnection it belongs to.\n\nMatrixNet is strictly **passive — observe, never block**. There is no firewall,\nno traffic interception, and no HTTPS decryption. Because it only observes,\nMatrixNet runs alongside whatever proxy, filter, or VPN you already use without\nfighting it.\n\n## Features\n\n### 🔭 Connection Monitoring\n- A live **Overview dashboard**: a throughput chart (last minute), headline\n  metrics (active connections, session total, active apps, countries reached,\n  threat connections, share via proxy), a protocol-mix breakdown, top\n  destination countries, and an enriched Top Talkers list.\n- System-wide, per-app live connection list: process, remote host/IP, country,\n  up/down rate, cumulative bytes, and connection lifecycle. The Connections,\n  History and Usage views **group by app by default** — click an app to drill\n  into its individual flows.\n- Kernel-attributed process ownership — the same mechanism `nettop` and Activity\n  Monitor use — so attribution is accurate without polling races.\n- **Client/server role** inferred per flow from the ports (did this host dial\n  out, or accept a connection?).\n- **Proxy \u0026 VPN/tunnel awareness** — connections whose remote is your configured\n  or local proxy are marked, and processes that relay other apps' traffic\n  (NetworkExtension tunnels) are badged, so it's clear when traffic is routed.\n  With packet capture on, a proxied connection still shows its **real domain and\n  byte volume** (read from the tunnel interface), and the \"via proxy\" metric is a\n  share of bytes.\n- **Threat-IP flagging** — remote addresses on a public threat-intelligence\n  blocklist are flagged with a ⚠️ badge (advisory only — MatrixNet labels, it\n  never blocks).\n- **New-destination (\"phoning home\") alerts** — opt-in, non-blocking\n  notifications when a known app first reaches a country it has never reached\n  before. A per-app learning window and rate-limiting keep it quiet; it's the\n  insight of an outbound firewall without the blocking or the alert-flood.\n- Hostname enrichment from **TLS SNI and DNS** — the exact host an app requested,\n  read straight from the ClientHello and DNS answers **without any decryption**,\n  and preferred over reverse-DNS PTR records (which are often CDN wildcards). A\n  one-click toggle shows **domain names or raw IPs** across the Connections and\n  Packets views.\n- A **Map tab** plots a real-world, offline dotted globe (Natural Earth, no map\n  tiles) with glowing arcs from this Mac to every country it is talking to —\n  node size by connection count, threat destinations in red.\n- Connection history you can look back through (\"which app connected where\n  yesterday\").\n\n### 📊 Usage Reports\n- A **Usage tab** that answers \"where did my bandwidth go\": the top apps,\n  countries, and domains by bytes over **Today / 7 days / 30 days / your billing\n  cycle**, with an interactive download/upload trend chart — hourly area for\n  today, daily bars for longer windows — that you can hover for exact per-period\n  totals.\n- Built from hourly buckets kept locally (default 90 days, configurable), so\n  totals survive relaunch — unlike Activity Monitor, which resets to zero.\n- Select an app to scope the country and domain breakdowns to just that app, and\n  set a **billing-cycle reset day** so the \"Cycle\" window matches your plan.\n- **Export** the current period as CSV or JSON for reporting, billing, or audit.\n\n### 🔬 Deep Packet Analysis\n- Per-packet capture where **every packet carries its owning PID**.\n- Solid dissection of the protocols that matter most: **Ethernet, IPv4, IPv6,\n  TCP, UDP, ICMP, DNS, TLS (handshake / SNI / certificate), and HTTP/1.1**.\n- **JA4 TLS client fingerprinting, per app** — passively derive each app's TLS\n  stack from the ClientHello (a browser engine vs Go vs curl vs a suspicious\n  library) without any decryption; shown on the TLS layer and per app in the\n  connection inspector, with recognized stacks labelled.\n- **HTTP/3 / QUIC visibility** — passively decrypt the QUIC Initial (public,\n  DCID-derived keys per RFC 9001 — no secret, no MITM) to read each HTTP/3\n  connection's SNI, ALPN, and version, and compute its QUIC JA4, all per app.\n- **Per-app network quality** — passively measure each TCP connection's handshake\n  RTT, retransmits, and connection-setup time from the captured packets, shown in\n  the connection inspector (capture-only; no probes sent).\n- **Per-app encrypted DNS** — see which apps still use plaintext DNS vs DoT, DoQ,\n  or DoH (with the resolver named), classified from the 5-tuple and hostname — no\n  packet capture required.\n- **Per-app activity timeline** — a heat strip per app showing when it was active\n  (by hour or day) from persisted usage, so background/overnight activity stands out.\n- A Wireshark-style three-pane view: packet list, protocol detail tree, and\n  synchronized hex.\n- Follow Stream reassembly and a display-filter language to slice the capture.\n- Filter packets down to a single app or a single connection.\n- Export selected packets or whole sessions to **pcapng** — including per-packet\n  process metadata — to hand off to Wireshark.\n\n### 🖥️ Desktop Widget\n- A WidgetKit widget (small / medium / large) shows active-connection count,\n  up/down throughput, session totals, the top talking apps, and a threat-hit\n  count — right on your desktop or in Notification Center.\n- It updates live while the app window is focused; in the background macOS caps\n  third-party widget refreshes to roughly every 30 minutes (WidgetKit's daily\n  budget). For to-the-second rates, watch the menu bar.\n\n### 🧭 Menu Bar \u0026 Background\n- Lives in the **menu bar** with a live ↓/↑ throughput readout, and keeps\n  monitoring after you close the main window — so the shared data the widget reads\n  stays current even when the app is in the background.\n- Optional **menu-bar-only mode** hides the Dock icon entirely.\n- **Launch at login** and a **Settings window** (⌘,) for background mode,\n  threat-connection notifications, automatic update checks, and on-demand dataset\n  refresh.\n- **Threat-connection notifications** alert you when an active connection reaches\n  a flagged address — advisory only; MatrixNet never blocks.\n\n### 🌍 Speaks Your Language\n- Fully localized into **8 languages** — English, Simplified \u0026 Traditional\n  Chinese, Japanese, Korean, French, German, and Spanish — following your macOS\n  system language automatically. Translation coverage is enforced in CI.\n\n### 🔄 Stays Current\n- **In-app auto-update** via [Sparkle](https://sparkle-project.org), with EdDSA-\n  signed updates served from GitHub Releases. Check on demand or let it check\n  daily in the background.\n- The **GeoIP database refreshes automatically** in the background from the\n  monthly DB-IP dataset, so country attribution stays accurate over time. It\n  covers both **IPv4 and IPv6** destinations, so the map and country metrics\n  don't under-count IPv6 traffic. When a local proxy/tunnel is active the\n  destination IP is a synthetic placeholder, so the country is recovered from the\n  real domain instead (see Privacy).\n- The **threat-IP list refreshes automatically** the same way, from the public\n  IPsum aggregate — the app only ever contacts its own release asset, never the\n  upstream feeds.\n\n### 🛡️ Privacy \u0026 Zero-Conflict\n- **Zero conflict by design.** MatrixNet is fully passive: it uses no\n  NetworkExtension, claims no exclusive routing/proxy slot, and never sits in the\n  packet path. It coexists with AdGuard, Surge, Little Snitch, LuLu, and any VPN.\n- **100% local, passive capture.** All packet and connection processing happens\n  on your machine — no telemetry, no account, no cloud. The one network request\n  MatrixNet can make for monitoring is the optional GeoIP country lookup for\n  *proxied* flows (on by default): when a local proxy hides the real address, it\n  resolves the destination's domain over encrypted DNS (DoH) to recover its\n  country. Turn it off in Settings to keep no data leaving the device.\n- **Least privilege.** Connection monitoring needs no authorization at all.\n  Packet capture is isolated in a minimal, capture-only helper; protocol parsing\n  of untrusted bytes runs in the unprivileged app.\n\n## Why MatrixNet?\n\n| | Little Snitch | Wireshark | **MatrixNet** |\n|---|:---:|:---:|:---:|\n| Per-app connection view | ✅ | ❌ | ✅ |\n| Packet-level dissection | ❌ | ✅ | ✅ |\n| Every packet knows its app | ❌ | ❌ | ✅ |\n| Connection ↔ packet correlation | ❌ | ❌ | ✅ |\n| Coexists with proxies/VPNs | ⚠️ | ✅ | ✅ |\n| Native, lightweight macOS app | ✅ | ❌ | ✅ |\n| Blocks/filters traffic | ✅ | ❌ | ❌ (by design — passive) |\n\nMatrixNet is not trying to replace a firewall. It is the tool you reach for when\nyou want to *understand* your machine's network behavior — from a bird's-eye,\nper-app overview all the way down to the bytes — without disrupting anything else\nrunning on the system.\n\n## Architecture\n\nMatrixNet follows a **passive-first, dual-source** design (internally referred to\nas \"Architecture A′\"). Two independent passive sources are fused by 5-tuple and\nPID:\n\n- **Connection level** comes from Apple's private `NetworkStatistics` framework\n  (`NStatManager*`) — the kernel mechanism behind `nettop` and Activity Monitor.\n  The kernel attributes each connection to a PID and reports the 5-tuple and byte\n  counters. This needs no root, no entitlement, and no NetworkExtension, which is\n  exactly why MatrixNet conflicts with nothing.\n- **Packet level** comes from `PKTAP` (`DLT_PKTAP`) over BPF, which tags each\n  packet with its originating PID. When a VPN is active, MatrixNet captures both\n  the physical interface (`en0`) and the tunnel(s) (`utun*`). Raw capture\n  requires root, so it lives in a small privileged helper registered via\n  `SMAppService`. The helper *only captures* — all protocol dissection of\n  untrusted network data happens back in the unprivileged main app.\n\n```mermaid\nflowchart TB\n    subgraph App[\"MatrixNet.app — SwiftUI, non-sandboxed, Hardened Runtime\"]\n        NS[\"Connection monitor\u003cbr/\u003eNetworkStatistics (in-process, no privilege)\"]\n        CORR[\"Correlation engine + protocol dissection\u003cbr/\u003epersistence + pcapng + UI\"]\n        XPCC[\"XPC client\"]\n        NS --\u003e CORR\n        CORR --- XPCC\n    end\n    subgraph Helper[\"com.matrixreligio.matrixnet.helper — root daemon (SMAppService)\"]\n        CAP[\"PKTAP / BPF raw capture only\u003cbr/\u003een0 + utun*, no parsing\"]\n    end\n    XPCC \u003c--\u003e|\"XPC: raw packet stream + control\"| CAP\n```\n\n**Why no NetworkExtension?** On macOS, attributing traffic to a process does\n*not* require NetworkExtension — the kernel already does it via\n`NetworkStatistics`. Using `NEFilterDataProvider`, `NEPacketTunnelProvider`, or\n`NEDNSProxyProvider` would mean competing for exclusive, contended slots in the\nsocket/routing/DNS path, which is the documented source of conflicts between\nfiltering products. For a monitoring tool, passive kernel observation satisfies\nthe zero-conflict requirement perfectly.\n\nSee [`docs/ARCHITECTURE.md`](./docs/ARCHITECTURE.md) for the full design,\nmodule dependency graph, and data flows.\n\n## Requirements\n\n- **macOS 26 (Tahoe)** or later\n- Apple Silicon or Intel\n- For building from source: **Xcode 26** and [XcodeGen](https://github.com/yonaskolb/XcodeGen)\n\n## Installation\n\nDownload the notarized `.dmg` from the\n[GitHub Releases](https://github.com/MatrixReligio/MatrixNet/releases) page, open\nit, and drag MatrixNet to your Applications folder. Builds are signed with a\nDeveloper ID and notarized by Apple, so Gatekeeper opens them without warnings.\nOnce installed, MatrixNet keeps itself up to date — no need to revisit this page.\n\nMatrixNet is **not** distributed through the Mac App Store: BPF/PKTAP capture and\nthe `NetworkStatistics` framework are not available to sandboxed apps. Direct,\nnotarized distribution is a deliberate architectural consequence, not an\noversight.\n\n## Building from Source\n\n\u003e The exact commands below are placeholders and **to be finalized** as the build\n\u003e and packaging scripts land.\n\n```sh\n# 1. Clone\ngit clone https://github.com/MatrixReligio/MatrixNet.git\ncd MatrixNet\n\n# 2. Run the pure-logic core test suite (no Xcode required)\nswift test\n\n# 3. Generate the Xcode project (App + privileged helper targets)\nxcodegen generate\n\n# 4. Build / run the app\n#    (open MatrixNet.xcodeproj in Xcode 26, or use xcodebuild — to be finalized)\nopen MatrixNet.xcodeproj\n```\n\nThe pure-logic core (domain model, dissection, pcapng, correlation, etc.) is a\nlocal Swift Package, so it builds and tests with plain `swift test`. The macOS\napp and the privileged helper are Xcode targets generated by XcodeGen from\n`project.yml`. See [`CONTRIBUTING.md`](./CONTRIBUTING.md) for the full developer\nworkflow.\n\n## Permissions\n\nMatrixNet asks for the *least* privilege at each level, and degrades gracefully:\n\n- **Connection monitoring — no authorization required.** Launch the app and you\n  immediately see which apps are on the network. `NetworkStatistics` runs\n  in-process with no root, entitlement, or TCC prompt.\n- **Deep packet capture — one-time system authorization.** Raw capture needs\n  root, so MatrixNet installs a minimal capture-only helper daemon via\n  `SMAppService`, which requires a single system approval. If you decline or the\n  install fails, every connection-monitoring feature keeps working and only\n  packet capture is disabled (with a retry prompt).\n\nThe helper exists solely to satisfy the root requirement of BPF/PKTAP. It does\nno parsing — handling untrusted network bytes stays out of the privileged\nprocess on purpose.\n\n## Privacy\n\nMatrixNet processes everything locally — no telemetry, no account, no cloud. The\nonly network request it can make for monitoring is the optional GeoIP country\nlookup for proxied flows (on by default): when a local proxy hides the real\naddress, it resolves the destination's domain over encrypted DNS (DoH) to recover\nits country. Turn it off in Settings to keep no data leaving your machine.\nCaptures, history, and settings live only on your disk.\n\n## Versioning\n\nMatrixNet follows [Semantic Versioning](https://semver.org): **MAJOR.MINOR.PATCH**.\n\n- **MAJOR** — incompatible changes or a fundamental shift in what the app does.\n- **MINOR** — new, backward-compatible features.\n- **PATCH** — backward-compatible bug fixes.\n\nEvery release is notarized and delivered through the in-app updater. See the\n[CHANGELOG](./CHANGELOG.md) for what changed in each version.\n\n## Contributing\n\nContributions are welcome. MatrixNet is built test-first with strict\nconcurrency, SwiftLint/SwiftFormat, and Conventional Commits. Please read\n[`CONTRIBUTING.md`](./CONTRIBUTING.md) before opening a pull request, and note\nour [Code of Conduct](./CODE_OF_CONDUCT.md).\n\nSecurity issues should be reported privately — see [`SECURITY.md`](./SECURITY.md).\n\n## License\n\nLicensed under the [Apache License 2.0](./LICENSE). Copyright 2026 MatrixReligio\nLLC. See [`NOTICE`](./NOTICE) for attributions.\n\n## Acknowledgements\n\nMatrixNet stands on the shoulders of the tools that made network transparency a\nnorm. Thanks to the **Wireshark** and **tcpdump/libpcap** projects for decades of\nprotocol dissection and capture work, and to **Little Snitch** and **LuLu** for\nshowing what per-app network awareness on macOS can be.\n\nBundled data: country geolocation by [DB-IP](https://db-ip.com) (CC-BY-4.0), the\nthreat-IP list derived from [IPsum](https://github.com/stamparm/ipsum) (public\ndomain), and the Map tab's world geometry from\n[Natural Earth](https://www.naturalearthdata.com) (public domain). See\n[`NOTICE`](./NOTICE) for full attributions.\n\n---\n\nQuestions or feedback: [contact@matrixreligio.com](mailto:contact@matrixreligio.com)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmatrixreligio%2Fmatrixnet","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmatrixreligio%2Fmatrixnet","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmatrixreligio%2Fmatrixnet/lists"}