Interactive, process-aware network monitoring for your terminal.
Python 3.11+ · macOS & Linux · Built with Textual
This checkout contains the UI refresh in development. Screenshots use example data.
uvx netshowruns the published release; use the source instructions below to try this version.
Install and run
uvx netshow
For this development version:
git clone https://github.com/taylorwilsdon/netshow.git
cd netshow
uv sync --locked
uv run netshow
Or install the published package with pipx install netshow.
What it shows
- Live TCP connections with PID, friendly service name, process, endpoints, and status.
- Process details including executable, owner, command, working directory, threads, and live CPU/memory usage.
- Host or interface bandwidth: separate receive/transmit rates and a 30-second sparkline.
- Regex search across PID, names, addresses, and status; invalid patterns fall back to literal matching.
- Process/status sorting that preserves your selection, plus full IPv6 details.
- Confirmed process termination with a separate force-kill option if the process stays alive.
- The original Selenized Dark palette and labeled metric chips, built-in light/dark/ANSI themes, and a compact layout for small terminals.
Netshow tries psutil first and falls back to lsof when access is denied, as is common
on macOS. Install lsof if your system doesn't include it. Without sufficient privileges,
results may be incomplete; the status line marks limited visibility. Collection failures
show an error and retain the last successful snapshot, marked stale.
Bandwidth is measured for the entire host or chosen interface. It is not per-process or per-connection throughput. Summing interfaces may count traffic at multiple layers on hosts with bridges, tunnels, or virtual interfaces.
Usage
netshow --interval 1.5
netshow --no-colors
netshow --version
| Option | Behavior | Default |
|---|---|---|
--interval SECONDS |
Positive, finite connection refresh interval | 3.0 |
--no-colors |
Monochrome rendering; also enabled by a nonempty NO_COLOR |
Off |
--version |
Print installed version and exit | — |
Bandwidth samples every 0.5 seconds while the connection screen is visible. Connection collection pauses during details/dialogs and resumes immediately on return. Process details refresh every second while visible.
| Key | Action |
|---|---|
| ↑ / ↓ | Select a connection |
| Enter | Open selected connection details |
| Click | Highlight a row; click the highlighted row again to open details |
| Esc / ← | Return from details |
| Ctrl+R | Refresh the current connection/detail view |
/ / f |
Open search / toggle search field |
| Enter in search | Return focus to the table |
| Esc in search | Hide the field; the active filter remains visible in the status line |
s / p |
Toggle status / process sorting; press again for default PID order |
i |
Cycle bandwidth interfaces |
e |
Toggle status symbols |
v |
Toggle full IPv6 addresses in the table |
k |
Confirm termination of the selected process |
? |
Toggle contextual keyboard help |
| Ctrl+P | Command palette, including theme selection |
q / Ctrl+C |
Quit |
Clear the search text to remove the filter. Settings last for the current session. Single-letter shortcuts leave typing in the search field uninterrupted.
Terminate a process
Select a connection and press k, or use Terminate process… in its detail view.
The dialog identifies the process and defaults to Cancel. Confirming Terminate
sends SIGTERM and waits up to three seconds. If it remains alive, a second confirmation
offers Force kill, which sends SIGKILL. Netshow never escalates automatically.
The action affects the whole process and all its connections, so unsaved work may be lost. Netshow rechecks PID and creation time before each signal, blocks unknown identities, PID 0/1, and itself, and reports permission failures or exited/replaced processes. It does not terminate process trees or request elevated privileges.
Development
uv sync --locked
uv run ruff format --check .
uv run ruff check .
uv run mypy src
uv run pytest -q
uv build
Run uv run ruff format . to format changes. CI tests Python 3.11–3.14 on Linux and
Python 3.14 on macOS, and verifies installations from both wheel and source artifacts.
Tests use synthetic connection data; process-control integration tests act only on
children they start themselves.
See architecture and release instructions. The earlier published version remains available for Python 3.9/3.10 users.
License
Release files for netshow 0.3.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| netshow-0.3.0.tar.gz | 63.8 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| netshow-0.3.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 86.8 kB
Release files / netshow-0.3.0.tar.gz
| Download URL | netshow-0.3.0.tar.gz |
|---|---|
| Size | 63.8 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
9641bf5a6512615c5faa09d4077756a0e8dfd97a7b202b960e4ac1f04f5f8c8c
|
|
BLAKE2b-256 checksum How to use checksums |
7f81fc97b3c70ecdd747583c1016373a64bb0e8b7519ed02fd234eaaf527a756
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 19, 2026.
Transparency logRelease files / netshow-0.3.0-py3-none-any.whl
| Download URL | netshow-0.3.0-py3-none-any.whl |
|---|---|
| Size | 23.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
09b90e70d0b560346be9ae32c2a25bcd08e06652945a9d9ca0ff43147c4fa0fc
|
|
BLAKE2b-256 checksum How to use checksums |
15792fee331f2f58ec9b3a0fe2f61fa48c0e13fa4b9b2758b1caf80fd40cb60d
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 19, 2026.
Transparency log