WhereMyTunnels

example_1

WhereMyTunnels is a cross-platform tool for viewing SSH connections and tunnels.

Usage

usage: wheremytunnels [options]

Tool for viewing SSH connections

options:
  -h, --help            show this help message and exit
  --version, -v         show program's version number and exit
  --about, -a           Show information about WhereMyTunnels
  --interval, -i INTERVAL
                        Refresh interval in seconds (default: 2)
  --no-color            Disable colored output
  --show-connections    Displays attached connections I.E: "LISTEN 127.0.0.1:8081", "ESTABLISHED 15.1.2.5:12385 -> 8.5.1.4:80"
  --show-arguments      Shows SSH arguments I.E: "ssh test.com -L 8080:localhost:80"

Why does this exist?

During a CTF in late 2024, I found myself five SSH tunnels deep while pivoting between hosts trying to find a flag when I suddenly got disconnected from my ssh jump box.

When I finally got back in, all my notes were gone, and I was left with one question: Where My Tunnels?

How does this work?

  1. Enumerates active ssh processes using psutil
  2. Parses ssh processes into:
    • Master sockets (-MS) and attached socket forwards/sessions (-S)
    • Traditional tunnels (-L, -R, -D)
    • Traditional SSH sessions
  3. Find associations between processes, forwards, and connections
  4. Detect errors in forwards and connections I.E: a local forward that doesn't have an attached listening connection
  5. Render everything in a tree structure using rich

Linux Install

Download the wheremytunnels binary from the release page, see (Which linux binary do I pick?) for help

Then run:

chmod 755 wheremytunnels_latest_linux.bin
mv wheremytunnels_latest_linux.bin /usr/bin/wheremytunnels

Which linux binary do I pick?

glibc vs musl

Nearly all linux systems use glibc or the GNU C Library, including:

  • Ubuntu
  • Debian
  • Fedora
  • CentOS / RHEL
  • Kali
  • Arch Linux

However some more "unique" operating systems rely on musl, notably Alpine linux

Architecture

Most systems run on the x86_64 cpu architecture, however some devices use ARM (aarch64)

The simplest way to tell is by running uname -m, you could also determine this by looking at your cpu specifications

Windows Install

There is currently only an x86_64 install for windows, sorry ARM users

After downloading the windows binary run:

Move-Item -Path "wheremytunnels_latest_windows.exe" -Destination "~/AppData/Local/Microsoft/WindowsApps/wheremytunnels.exe"

Examples

wheremytunnels.exe

example_1

wheremytunnels.exe --show-arguments --show-connections

example_2

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Latest release

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for Androsh7 from gravatar.com Androsh7

License

MIT

Requires

Python >=3.10

Provides Extra

dev

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

wheremytunnels-1.2.0.tar.gz (12.6 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

wheremytunnels-1.2.0-py3-none-any.whl (14.2 kB view details)

Uploaded Python 3

File details

Details for the file wheremytunnels-1.2.0.tar.gz.

File metadata

  • Download URL: wheremytunnels-1.2.0.tar.gz
  • Upload date:
  • Size: 12.6 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for wheremytunnels-1.2.0.tar.gz
Algorithm Hash digest
SHA256 57262a152f7f7f4acf9bf3c0d10e5bd920f9f15c1aa37d0e633af09f362ba37c
MD5 623deeea058e8f164301d91d0fee921c
BLAKE2b-256 3c6bdc24016b8cd066e16602d74758aac40401ca33d55a73ca85b30b279bd44d

See more details on using hashes here.

Provenance

The following attestation bundles were made for wheremytunnels-1.2.0.tar.gz:

Publisher: publish.yml on Androsh7/WhereMyTunnels

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file wheremytunnels-1.2.0-py3-none-any.whl.

File metadata

  • Download URL: wheremytunnels-1.2.0-py3-none-any.whl
  • Upload date:
  • Size: 14.2 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for wheremytunnels-1.2.0-py3-none-any.whl
Algorithm Hash digest
SHA256 8a0425169375a61fb1194ceae68b50021a653ed583744e8ca77b0d993c370046
MD5 c028127b419310df1ba811d8e87dbfad
BLAKE2b-256 387ecc5b16bb9d7086841367a9abc354ffff2950ba18cbaa655103e21c698b09

See more details on using hashes here.

Provenance

The following attestation bundles were made for wheremytunnels-1.2.0-py3-none-any.whl:

Publisher: publish.yml on Androsh7/WhereMyTunnels

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

This release

1.2.0 This release

2 files

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page