### Setup Ollama for AI Insights

Source: https://context7.com/matthart1983/netwatch/llms.txt

Commands to install, start, and prepare the Ollama server for local AI model inference.

```bash
# Install Ollama
curl -fsSL https://ollama.com/install.sh | sh

# Start the Ollama server
ollama serve

# Pull a model
ollama pull llama3.2

# Run NetWatch and enable insights
sudo netwatch
# Press ',' to open settings
# Navigate to "AI Insights" and toggle on
# Press 'S' to save configuration
# Press '9' to view Insights tab (appears when enabled)
```

--------------------------------

### Setup and Run NetWatch with Ollama

Source: https://github.com/matthart1983/netwatch/wiki/AI-Insights

Commands to install Ollama, start the service, pull the required model, and launch the NetWatch application.

```bash
# Install Ollama
curl -fsSL https://ollama.com/install.sh | sh

# Start server
ollama serve

# Pull model
ollama pull llama3.2

# Run NetWatch
sudo netwatch
# Switch to tab 8 (Insights)
```

--------------------------------

### Generate Starter Configuration

Source: https://github.com/matthart1983/netwatch/blob/main/WIKI.md

Run this command to create a starter configuration file without entering the TUI. This is useful for initial setup.

```bash
netwatch --generate-config
```

--------------------------------

### Install NetWatch with Homebrew

Source: https://github.com/matthart1983/netwatch/blob/main/README.md

Install NetWatch on macOS or Linux using the Homebrew package manager.

```bash
brew install matthart1983/tap/netwatch
```

--------------------------------

### Use NetWatch as a Library

Source: https://context7.com/matthart1983/netwatch/llms.txt

Example of loading configuration and accessing interface statistics programmatically using the NetWatch Rust crate.

```rust
// Cargo.toml:
// [dependencies]
// netwatch = { package = "netwatch-tui", version = "0.11" }

use netwatch::{app, collectors, config, platform};

// Load configuration
let config = config::NetwatchConfig::load();
println!("Default tab: {}", config.default_tab);
println!("Refresh rate: {}ms", config.refresh_rate_ms);

// Access platform-specific interface statistics
use netwatch::platform::{collect_interface_stats, InterfaceStats};

let stats: Vec<InterfaceStats> = collect_interface_stats();
for iface in stats {
    println!("{}: RX {} bytes, TX {} bytes",
             iface.name, iface.rx_bytes, iface.tx_bytes);
}
```

--------------------------------

### Display Filters Examples

Source: https://github.com/matthart1983/netwatch/blob/main/README.md

Examples of Wireshark-style filter syntax for the Packets tab. Use these to narrow down network traffic.

```text
tcp                        # Protocol
192.168.1.42               # IP address (src or dst)
ip.src == 10.0.0.1         # Directional
port 443                   # Port
stream 7                   # Stream index
contains "hello"           # Text search
tcp and port 443           # Combinators
!dns                       # Negation
google                     # Bare word → contains "google"
```

--------------------------------

### Install NetWatch from crates.io

Source: https://github.com/matthart1983/netwatch/wiki/Home

Installs the NetWatch terminal UI application using Cargo, Rust's package manager.

```bash
cargo install netwatch-tui
```

--------------------------------

### Install NetWatch via Cargo

Source: https://context7.com/matthart1983/netwatch/llms.txt

Install the application using the Rust package manager. Running with sudo is required for full packet capture functionality.

```bash
# Install from crates.io
cargo install netwatch-tui

# Run in basic mode (no root required)
netwatch

# Run in full mode with packet capture and health probes
sudo netwatch
```

--------------------------------

### NetWatch Configuration File Format

Source: https://context7.com/matthart1983/netwatch/llms.txt

Example TOML configuration file for customizing NetWatch behavior and alerts.

```toml
# Which tab to show on launch
default_tab = "dashboard"

# Refresh rate in milliseconds (100-5000)
refresh_rate_ms = 1000

# Preferred capture interface (empty = auto-detect)
capture_interface = "en0"

# Show GeoIP location column in Connections tab
show_geo = true

# Default timeline window (1m, 5m, 15m, 30m, 1h)
timeline_window = "5m"

# Auto-follow new packets in Packets tab
packet_follow = true

# Default BPF capture filter applied at libpcap level
bpf_filter = "tcp port 443"

# Path to MaxMind GeoLite2-City .mmdb file (optional)
geoip_db = "/path/to/GeoLite2-City.mmdb"

# Path to MaxMind GeoLite2-ASN .mmdb file (optional)
geoip_asn_db = "/path/to/GeoLite2-ASN.mmdb"

# Color theme (dark, light, solarized, dracula, nord)
theme = "dark"

# Enable AI Insights tab (opt-in, off by default)
insights_enabled = false

# AI model name for Ollama
insights_model = "llama3.2"

# AI endpoint: "local" or full URL like "http://gpu-box.lan:11434"
insights_endpoint = "local"

# Network intelligence alert settings
[alerts]
bandwidth_threshold = 100000000  # 100 MB/s
port_scan_threshold = 20
port_scan_window_secs = 30
```

--------------------------------

### Windows-only build.rs Script

Source: https://github.com/matthart1983/netwatch/wiki/Build-System

A build script for Windows that handles the dynamic linking of the pcap library. It checks environment variables and common installation paths, and can auto-download the Npcap SDK if necessary.

```rust
# Windows-only build script that:
# 1. Checks `LIBPCAP_LIBDIR` env var
# 2. Checks `NPCAP_SDK` env var
# 3. Searches common install paths (`C:\Npcap SDK\Lib\x64`, etc.)
# 4. Auto-downloads Npcap SDK from `npcap.com` via PowerShell
# 5. Extracts zip and sets `rustc-link-search`

```

--------------------------------

### BPF Capture Filter Examples

Source: https://context7.com/matthart1983/netwatch/llms.txt

Standard tcpdump syntax for BPF filters applied at the libpcap level before packets reach NetWatch. Use 'b' in the Packets tab to set.

```bash
tcp port 80
```

```bash
host 10.0.0.1
```

```bash
tcp port 443 and host 10.0.0.1
```

```bash
not port 22
```

```bash
udp portrange 5000-6000
```

--------------------------------

### List Available Ollama Models

Source: https://github.com/matthart1983/netwatch/blob/main/INSIGHTS.md

View all installed models on your local Ollama instance or list available cloud models. Use the exact tag shown for the `insights_model` configuration.

```sh
ollama ls
```

--------------------------------

### Generate Default Configuration

Source: https://context7.com/matthart1983/netwatch/llms.txt

Create a starter configuration file at the default location.

```bash
# Generate a starter config file
netwatch --generate-config

# Config is written to ~/.config/netwatch/config.toml
```

--------------------------------

### Build NetWatch from Source

Source: https://context7.com/matthart1983/netwatch/llms.txt

Clone the repository and build the binary locally using Cargo.

```bash
# Clone the repository
git clone https://github.com/matthart1983/netwatch.git
cd netwatch

# Build release binary
cargo build --release

# Run the binary
./target/release/netwatch

# Install system-wide (optional)
sudo cp ./target/release/netwatch /usr/local/bin/
```

--------------------------------

### Run NetWatch (Full Mode)

Source: https://github.com/matthart1983/netwatch/wiki/Home

Launches NetWatch with full functionality, including packet capture and health probes. Requires root privileges.

```bash
sudo netwatch
```

--------------------------------

### Build NetWatch from Source

Source: https://github.com/matthart1983/netwatch/wiki/Home

Clones the NetWatch repository and builds a release version of the application using Cargo.

```bash
git clone https://github.com/matthart1983/netwatch.git
cd netwatch
cargo build --release
```

--------------------------------

### Initialize and Test NetWatch

Source: https://github.com/matthart1983/netwatch/blob/main/CONTRIBUTING.md

Commands for cloning the repository, running the application, and executing quality assurance checks.

```bash
git clone https://github.com/matthart1983/netwatch
cd netwatch

# macOS / Linux
sudo cargo run --release

# Run tests and checks before every PR
cargo test
cargo fmt --check
cargo clippy --all-targets
```

--------------------------------

### Run NetWatch (Basic Mode)

Source: https://github.com/matthart1983/netwatch/wiki/Home

Launches NetWatch in its basic operational mode without requiring elevated privileges.

```bash
netwatch
```

--------------------------------

### Build NetWatch from Source

Source: https://github.com/matthart1983/netwatch/blob/main/README.md

Clone the NetWatch repository and build the release version from source. Requires Rust 1.70+ and libpcap development files.

```bash
git clone https://github.com/matthart1983/netwatch.git && cd netwatch
cargo build --release
```

--------------------------------

### Run NetWatch Commands

Source: https://github.com/matthart1983/netwatch/blob/main/README.md

Basic commands to launch NetWatch. Use `sudo` for full mode, which includes health probes and packet capture. Use `--generate-config` to create a configuration file.

```bash
netwatch            # Interface stats, connections, config
sudo netwatch       # Full mode — adds health probes + packet capture
netwatch --generate-config
```

--------------------------------

### Perform Basic Packet Capture

Source: https://context7.com/matthart1983/netwatch/llms.txt

Demonstrates listing network devices and opening a capture session using the pcap crate.

```rust
// From examples/test_capture.rs
fn main() {
    println!("Listing devices...");
    match pcap::Device::list() {
        Ok(devices) => {
            for d in &devices {
                println!("  {} - {:?}", d.name, d.desc);
            }
            if let Some(dev) = devices.first() {
                println!("\nTrying to capture on {}...", dev.name);
                match pcap::Capture::from_device(dev.name.as_str()) {
                    Ok(cap) => {
                        println!("  Created inactive capture OK");
                        match cap.promisc(false).snaplen(256).timeout(1000).open() {
                            Ok(mut active) => {
                                println!("  Opened capture OK, waiting for packet...");
                                match active.next_packet() {
                                    Ok(pkt) => println!("  Got packet: {} bytes", pkt.data.len()),
                                    Err(e) => println!("  Next packet error: {}", e),
                                }
                            }
                            Err(e) => println!("  Open failed: {}", e),
                        }
                    }
                    Err(e) => println!("  from_device failed: {}", e),
                }
            }
        }
        Err(e) => eprintln!("Error listing devices: {}", e),
    }
}
```

--------------------------------

### Configure Cloud Models for AI Insights

Source: https://context7.com/matthart1983/netwatch/llms.txt

Commands and configuration to utilize cloud-hosted models via the Ollama daemon.

```bash
# Sign in to Ollama (stores credentials in ~/.ollama/)
ollama signin

# List available cloud models
ollama ls

# Configure NetWatch for cloud model
# In config.toml:
insights_enabled = true
insights_model = "minimax-2.5:cloud"  # or other :cloud tags
insights_endpoint = "local"           # daemon proxies to cloud

# Cloud model benefits:
# - No local GPU/RAM needed
# - Faster than CPU inference
# - Larger models available
```

--------------------------------

### Run project verification commands

Source: https://github.com/matthart1983/netwatch/blob/main/CONTRIBUTING.md

Execute these commands to ensure code quality and test coverage before submitting a pull request.

```bash
cargo test                   # all tests
cargo fmt --check            # formatting
cargo clippy --all-targets   # lints
```

--------------------------------

### Register Tab Module and Dispatch

Source: https://github.com/matthart1983/netwatch/blob/main/CONTRIBUTING.md

Expose the new module and add the rendering logic to the UI dispatcher.

```rust
pub mod my_new_tab;

// inside render():
Tab::MyNewTab => my_new_tab::render(f, &app, area),
```

--------------------------------

### Run All Tests

Source: https://github.com/matthart1983/netwatch/wiki/Testing

Execute all unit tests in the project. These tests focus on parsing and data transformation logic and do not require network access or elevated privileges.

```bash
cargo test
```

--------------------------------

### Implement Tab Rendering Layout

Source: https://github.com/matthart1983/netwatch/blob/main/CONTRIBUTING.md

Standard layout structure for a new UI tab using the Ratatui-style constraints.

```rust
let chunks = Layout::default()
    .direction(Direction::Vertical)
    .constraints([
        Constraint::Length(3), // header
        Constraint::Min(0),    // content
        Constraint::Length(3), // footer
    ])
    .split(area);

widgets::render_header(f, app, chunks[0]);
// render content into chunks[1]
widgets::render_footer(f, app, chunks[2], hints);
```

--------------------------------

### NetWatch GeoIP Lookup Configuration

Source: https://context7.com/matthart1983/netwatch/llms.txt

Instructions for toggling the GeoIP column in the Connections tab and details on GeoIP source configurations and caching behavior.

```bash
# Toggle GeoIP column in Connections tab:
# Press 'g' to show/hide location column

# GeoIP sources:
# 1. Local MaxMind .mmdb files (configure in settings)
# 2. Online ip-api.com (free, no API key, rate-limited to 1 req/1.4s)

# Cache: 4096 entries, evicts 25% oldest when full
# Skips: RFC1918, loopback, link-local, ULA, multicast IPs
```

--------------------------------

### Flight Recorder Controls

Source: https://context7.com/matthart1983/netwatch/llms.txt

Global keyboard shortcuts for managing the NetWatch flight recorder, which maintains a rolling 5-minute capture window.

```bash
# Global keyboard shortcuts (from any tab):
Shift+R   # Arm/reset the rolling 5-minute recorder
Shift+F   # Freeze the current incident window
Shift+E   # Export incident bundle to ~/netwatch_incident_YYYYMMDD_HHMMSS/
```

--------------------------------

### Run Standard Rust Checks

Source: https://github.com/matthart1983/netwatch/blob/main/WIKI.md

Execute these commands for routine maintenance and to ensure code quality. Includes formatting checks, linting, and tests.

```bash
cargo fmt --check

```

```bash
cargo clippy --all-targets

```

```bash
cargo test
```

--------------------------------

### NetWatch WHOIS/RDAP Lookup Usage

Source: https://context7.com/matthart1983/netwatch/llms.txt

How to initiate WHOIS/RDAP lookups from the Connections or Packets tabs in NetWatch for source and destination IP addresses.

```bash
# From Connections tab:
# Select a connection, press 'W' for WHOIS lookup

# From Packets tab:
# Select a packet, press 'W' for WHOIS on source/dest IPs

# Source: rdap.org (free RDAP endpoint)
```

--------------------------------

### Verify Ollama Connectivity

Source: https://github.com/matthart1983/netwatch/blob/main/INSIGHTS.md

Use this command to confirm the Ollama daemon is running and reachable on the local machine.

```sh
curl http://localhost:11434/api/tags
```

--------------------------------

### Traceroute Architecture Overview

Source: https://github.com/matthart1983/netwatch/wiki/Traceroute

Visual representation of the TracerouteRunner structure and its threading model.

```text
TracerouteRunner
  ├── result: Arc<Mutex<TracerouteResult>>
  │     ├── target: String
  │     ├── status: Idle | Running | Done | Error(String)
  │     └── hops: Vec<TracerouteHop>
  └── run(target) → spawns thread → run_traceroute()
```

--------------------------------

### Add Tab Keybinding

Source: https://github.com/matthart1983/netwatch/blob/main/CONTRIBUTING.md

Update the global key handler to allow switching to the new tab.

```rust
KeyCode::Char('9') => { app.current_tab = Tab::MyNewTab; }
```

--------------------------------

### Configure NetWatch for Cloud Models (TOML)

Source: https://github.com/matthart1983/netwatch/blob/main/INSIGHTS.md

This TOML configuration enables AI Insights, specifies a cloud model, and keeps the endpoint as 'local' to proxy requests through the Ollama daemon.

```toml
insights_enabled = true
insights_model = "minimax-2.5:cloud"
insights_endpoint = "local"
```

--------------------------------

### Configure NetWatch AI Insights (TOML)

Source: https://github.com/matthart1983/netwatch/blob/main/INSIGHTS.md

These TOML settings enable the AI Insights tab, specify the Ollama model to use, and define the Ollama endpoint. Changes take effect immediately.

```toml
# Enable the Insights tab. Off by default.
insights_enabled = true

# Model name as Ollama knows it. Must be pulled via `ollama pull <model>`.
insights_model = "llama3.2"

# "local" is shorthand for http://localhost:11434.
# Point this at a remote Ollama host by giving a full base URL.
insights_endpoint = "local"
```

--------------------------------

### Traceroute Usage in NetWatch

Source: https://context7.com/matthart1983/netwatch/llms.txt

Instructions for initiating traceroute from the Connections or Topology tabs in NetWatch. Displays hop information with color-coded RTTs.

```bash
# From Connections tab (2):
# Select a connection, press 'T' to traceroute remote IP

# From Topology tab (6):
# Select a remote host, press 'T' to traceroute

# Traceroute overlay:
# - Centered modal (70% screen)
# - Hop table with RTT values (3 probes per hop)
# - Color-coded RTTs: green <10ms, yellow <50ms, orange <100ms, red >=100ms
# - Up/Down to scroll, Esc to close
```

--------------------------------

### Add Configuration Validation in Rust

Source: https://github.com/matthart1983/netwatch/blob/main/REFACTORING.md

Implement a `validate` method for `NetwatchConfig` to ensure configuration values are within acceptable ranges and have defaults, moving validation logic closer to the data it pertains to.

```rust
impl NetwatchConfig {
    pub fn validate(&mut self) {
        self.refresh_rate_ms = self.refresh_rate_ms.clamp(100, 5000);
        if self.theme.is_empty() { self.theme = "dark".into(); }
        // etc.
    }
}
```

--------------------------------

### Sign in to Ollama Account

Source: https://github.com/matthart1983/netwatch/blob/main/INSIGHTS.md

Authenticate with your Ollama account via the CLI to use cloud models. This command opens a browser for authentication and stores credentials locally.

```sh
ollama signin
```

--------------------------------

### Export Packets to PCAP

Source: https://context7.com/matthart1983/netwatch/llms.txt

Instructions and format details for exporting captured packets to a .pcap file.

```bash
# In the Packets tab:
# Press 'w' to export captured packets to .pcap file

# PCAP format:
# - Global header: Magic 0xa1b2c3d4, version 2.4, max length 65535, Ethernet link type
# - Per-packet: timestamp (sec + usec), captured length, original length, raw bytes
# - Respects display filter - only matching packets are exported
```

--------------------------------

### Verify Cloud Model Authentication

Source: https://github.com/matthart1983/netwatch/blob/main/INSIGHTS.md

Use this command to test if the local Ollama daemon is correctly authenticated for cloud model requests.

```sh
curl http://localhost:11434/api/chat \
  -d '{"model":"minimax-2.5:cloud","messages":[{"role":"user","content":"ping"}],"stream":false}'
```

--------------------------------

### Packet Capture Lifecycle

Source: https://context7.com/matthart1983/netwatch/llms.txt

Commands and lifecycle steps for managing packet capture within the TUI.

```bash
# Run with root for packet capture capability
sudo netwatch

# In the TUI:
# Press '4' to switch to Packets tab
# Press 'c' to start capture
# Press 'c' again to stop capture

# Capture lifecycle:
# 1. Opens pcap device in promiscuous mode (1MB buffer, 1ms timeout)
# 2. Optionally applies BPF filter
# 3. Spawns capture thread looping on cap.next_packet()
# 4. Decoded packets stored in ring buffer (max 5000 packets)
```

--------------------------------

### Nix Flake for Reproducible Development

Source: https://github.com/matthart1983/netwatch/wiki/Build-System

Configures a reproducible development environment using Nix Flake. It specifies inputs, packages the Rust project, and defines development shell dependencies including Cargo, Rust, and linters.

```nix
`flake.nix` provides a reproducible development environment:
- Inputs: nixpkgs-unstable, flake-utils
- Package: `callPackage ./package.nix {}` (uses `rustPlatform.buildRustPackage`)
- Dev shell: cargo, rustc, rust-analyzer, clippy, rustfmt
- Build inputs: pkg-config, libpcap

```

--------------------------------

### Platform-Specific Traceroute Commands

Source: https://context7.com/matthart1983/netwatch/llms.txt

Platform-specific commands for performing traceroute, including options for non-blocking probes and timeouts. Also shows the Hop data structure.

```text
# Linux/macOS:
traceroute -n -q 3 -w 1 -m 30 <target>

# Windows:
tracert -d -w 1000 -h 30 <target>

# Hop data structure:
TracerouteHop {
    hop_number: u8,
    host: Option<String>,
    ip: Option<String>,
    rtt_ms: Vec<Option<f64>>  # 3 probes
}
```

--------------------------------

### NetWatch Combinators

Source: https://context7.com/matthart1983/netwatch/llms.txt

Combine multiple filters using logical operators like AND, OR, and NOT for more complex filtering.

```text
tcp and port 443
```

```text
dns or icmp
```

```text
!dns
```

```text
not arp
```

--------------------------------

### Register Tab in UI Widgets

Source: https://github.com/matthart1983/netwatch/blob/main/CONTRIBUTING.md

Include the new tab in the base tabs list and define its label for the UI.

```rust
const BASE_TABS: &[Tab] = &[
    // existing...
    Tab::MyNewTab,
];
```

```rust
Tab::MyNewTab => ("9", "MyTab"),
```

--------------------------------

### Pull an Ollama Model

Source: https://github.com/matthart1983/netwatch/blob/main/INSIGHTS.md

Use this command to download a language model from Ollama. Ensure the Ollama daemon is running before or after pulling.

```sh
ollama pull llama3.2
```

--------------------------------

### Create Frame Layout Helper in Rust

Source: https://github.com/matthart1983/netwatch/blob/main/REFACTORING.md

Implement a reusable `frame_layout` function in `src/ui/widgets.rs` to handle the common 3-chunk vertical layout (header, content, footer) across UI modules.

```rust
pub struct FrameChunks {
    pub header: Rect,
    pub content: Rect,
    pub footer: Rect,
}

pub fn frame_layout(area: Rect) -> FrameChunks {
    let chunks = Layout::default()
        .direction(Direction::Vertical)
        .constraints([
            Constraint::Length(3),
            Constraint::Min(0),
            Constraint::Length(3),
        ])
        .split(area);
    FrameChunks { header: chunks[0], content: chunks[1], footer: chunks[2] }
}
```

--------------------------------

### Implement a new collector

Source: https://github.com/matthart1983/netwatch/blob/main/CONTRIBUTING.md

Use this template to create a new collector struct that manages shared state and runs a background collection thread.

```rust
pub struct MyCollector {
    data: Arc<Mutex<Vec<MyData>>>,
}

impl MyCollector {
    pub fn new() -> Self {
        let data: Arc<Mutex<Vec<MyData>>> = Arc::new(Mutex::new(Vec::new()));
        let data_clone = Arc::clone(&data);

        thread::spawn(move || {
            loop {
                // collect and update data_clone
                thread::sleep(Duration::from_secs(5));
            }
        });

        Self { data }
    }

    pub fn get_data(&self) -> Vec<MyData> {
        self.data.lock().unwrap().clone()
    }
}
```

--------------------------------

### Enumerate Settings Fields in Rust

Source: https://github.com/matthart1983/netwatch/blob/main/REFACTORING.md

Use a Rust enum with `#[repr(usize)]` to represent settings cursor positions, replacing magic indices with named variants for better clarity and maintainability.

```rust
#[repr(usize)]
pub enum SettingsField {
    Theme           = 0,
    DefaultTab      = 1,
    RefreshRate     = 2,
    // ...
    AiInsights      = 12,
    AiModel         = 13,
    AiEndpoint      = 14,
}
pub const SETTINGS_COUNT: usize = 15; // must equal variant count
```

--------------------------------

### Configure NetWatch for Remote Ollama Host (TOML)

Source: https://github.com/matthart1983/netwatch/blob/main/INSIGHTS.md

Set the `insights_endpoint` to the base URL of a remote Ollama server. NetWatch appends `/api/chat` to this URL. The request times out after 30 seconds.

```toml
insights_endpoint = "http://gpu-box.lan:11434"
```

--------------------------------

### Implement Scroll Clamping in Rust

Source: https://github.com/matthart1983/netwatch/blob/main/REFACTORING.md

Create a helper function `clamp_scroll` to deduplicate and centralize the logic for handling scroll deltas across different UI elements, ensuring scroll positions stay within bounds.

```rust
fn clamp_scroll(current: usize, delta: isize, max: usize) -> usize {
    ((current as isize + delta).max(0) as usize).min(max)
}
```

--------------------------------

### TracerouteHop Data Structure

Source: https://github.com/matthart1983/netwatch/wiki/Traceroute

Rust struct definition for storing individual hop data, including RTT measurements for three probes.

```rust
TracerouteHop {
    hop_number: u8,
    host: Option<String>,
    ip: Option<String>,
    rtt_ms: Vec<Option<f64>>,  // 3 probes
}
```

--------------------------------

### NetWatch Flight Recorder Shortcuts

Source: https://github.com/matthart1983/netwatch/blob/main/README.md

Keyboard shortcuts for NetWatch's flight recorder feature. These allow capturing and exporting network incident data.

```text
Shift+R   Arm a rolling 5-minute recorder
Shift+F   Freeze the current incident window
Shift+E   Export an incident bundle to ~/netwatch_incident_YYYYMMDD_HHMMSS/
```

--------------------------------

### Cargo.toml Package Manifest

Source: https://github.com/matthart1983/netwatch/wiki/Build-System

Defines the package name, version, and edition for the Netwatch TUI project. This file is essential for managing Rust project dependencies and metadata.

```toml
[package]
name = "netwatch-tui"
version = "0.3.6"
edition = "2021"

```

--------------------------------

### NetWatch Stream Filters

Source: https://context7.com/matthart1983/netwatch/llms.txt

Display a specific TCP or UDP stream by its index. This is useful for analyzing individual conversations.

```text
stream 7
```

--------------------------------

### Protocol Decoding Pipeline

Source: https://context7.com/matthart1983/netwatch/llms.txt

Visual representation of the packet decoding hierarchy.

```text
Raw frame -> Ethernet (or raw IP) ->
  |-- ARP -> parse_arp()
  |-- IPv4 -> parse_ipv4_header()
  |   |-- TCP -> parse_tcp(), tcp_flags()
  |   |   |-- DNS (port 53) -> parse_dns()
  |   |   |-- TLS (port 443) -> parse_tls()
  |   |   |-- HTTP (port 80) -> parse_http()
  |   |   +-- Payload text extraction
  |   |-- UDP -> parse_udp()
  |   |   |-- DNS (port 53) -> parse_dns()
  |   |   |-- DHCP (port 67/68) -> parse_dhcp()
  |   |   |-- NTP (port 123) -> parse_ntp()
  |   |   +-- mDNS (port 5353) -> parse_dns()
  |   +-- ICMP -> icmp_type_name()
  +-- IPv6 -> parse_ipv6_header()
      |-- TCP/UDP -> (same as IPv4)
      +-- ICMPv6 -> icmpv6_type_name()
```

--------------------------------

### TCP Stream Reassembly Controls

Source: https://context7.com/matthart1983/netwatch/llms.txt

Controls for the stream view in NetWatch, allowing filtering by direction and toggling hex/text mode. Press 's' in the Packets tab to open.

```bash
# -> or <- : Filter to A->B or B->A direction
# a        : Show both directions
# h        : Toggle hex/text mode
# Up/Down  : Scroll through stream data
# Esc      : Close stream view
```

--------------------------------

### Configure AI Insights

Source: https://context7.com/matthart1983/netwatch/llms.txt

Configuration settings for enabling the AI Insights tab and selecting the model and endpoint in the TOML config file.

```toml
# In ~/.config/netwatch/config.toml:

# Enable the Insights tab
insights_enabled = true

# Model options (smaller = faster, larger = better analysis):
# llama3.2      ~2GB  - Default, good balance
# llama3.2:1b   ~1GB  - Fastest, modest hardware
# llama3.1:8b   ~5GB  - Better reasoning, needs ~8GB RAM
# mistral       ~4GB  - Solid alternative
# qwen2.5:7b    ~5GB  - Strong at structured analysis
insights_model = "llama3.2"

# Endpoint options:
# "local" = http://localhost:11434
# Full URL for remote Ollama: "http://gpu-box.lan:11434"
insights_endpoint = "local"
```

--------------------------------

### Incident Bundle Structure

Source: https://github.com/matthart1983/netwatch/blob/main/README.md

The directory structure generated when an incident bundle is exported or frozen.

```text
netwatch_incident_20260403_103501/
  summary.md
  manifest.json
  connections.json
  health.json
  bandwidth.json
  dns.json
  alerts.json
  packets.pcap   # present when packets were captured
```

--------------------------------

### Packet Processing Pipeline

Source: https://github.com/matthart1983/netwatch/blob/main/README.md

Visual representation of the packet processing flow from raw bytes to protocol analysis.

```text
Raw bytes → Ethernet → IPv4/IPv6/ARP → TCP/UDP/ICMP → DNS/TLS/HTTP/DHCP/NTP
                                             ↓
                               Stream tracking · Handshake timing
                               Expert info · Payload extraction
```

--------------------------------

### NetWatch IP Address Filters

Source: https://context7.com/matthart1983/netwatch/llms.txt

Filter network traffic based on source or destination IP addresses. Use 'ip.src' or 'ip.dst' for specific matching.

```text
192.168.1.42
```

```text
ip.src == 10.0.0.1
```

```text
ip.dst == 8.8.8.8
```

--------------------------------

### NetWatch Protocol Filters

Source: https://context7.com/matthart1983/netwatch/llms.txt

Use these filters to display specific types of network traffic. They are applied directly in the NetWatch interface.

```text
tcp
```

```text
dns
```

```text
icmp
```

```text
arp
```

```text
tls
```

--------------------------------

### Extract Event Handlers in Rust

Source: https://github.com/matthart1983/netwatch/blob/main/REFACTORING.md

Split the main event loop in `app.rs` into focused handler functions for better organization and readability. Each handler returns a boolean indicating if the event was consumed.

```rust
fn handle_settings_keys(app: &mut App, key: KeyEvent) -> bool { ... }
```

```rust
fn handle_filter_input(app: &mut App, key: KeyEvent) -> bool { ... }
```

```rust
fn handle_tab_keys(app: &mut App, key: KeyEvent) -> bool { ... }
```

```rust
fn handle_global_keys(app: &mut App, key: KeyEvent) { ... }
```

--------------------------------

### Incident Bundle Contents Structure

Source: https://context7.com/matthart1983/netwatch/llms.txt

Structure of the incident bundle exported by NetWatch, containing various analysis artifacts like summaries, connection data, and packet captures.

```text
netwatch_incident_20260403_103501/
  summary.md         # Human-readable incident summary
  manifest.json      # Bundle metadata and timestamps
  connections.json   # Active connections at freeze time
  health.json        # Gateway/DNS health snapshots
  bandwidth.json     # Per-interface bandwidth context
  dns.json           # DNS query/response analytics
  alerts.json        # Network intelligence alert history
  packets.pcap       # Captured packets (when available)
```