Skip to content

Back to the catalog

ZXCurban/NetOrbit
github.comrepo

ZXCurban/NetOrbit

NetOrbit is a terminal-based (TUI) tool that uses Scapy to asynchronously capture outbound IPv4 packets and plots them in real time onto a Braille-rendered world map using GeoIP resolution (MaxMind-compatible with IP-API fallback). It requires root for raw-socket capture, filters out local/private/multicast traffic, and shows a live panel of recent connections (IP, country, protocol, size, interface) - a lightweight terminal alternative to a network-monitoring dashboard for spotting where a machine is talking on the internet.

TL;DR Terminal tool that maps a machine's live outbound IPv4 traffic onto a Braille world map via Scapy capture and GeoIP lookup.
Open original ↗
Document

What it is

NetOrbit is a Python 3.10+ TUI that visualizes outbound IPv4 traffic on a Braille-rendered world map. The summary covers the capture/GeoIP/filtering mechanics; what it does not carry is how to install, run, and drive it — including a no-root demo mode and interface-selection flags.

Preconditions

  • Linux recommended (Fedora explicitly supported); root for real capture.
  • On Linux, NetOrbit will re-exec itself through sudo when it detects missing capture privileges — so it can escalate on its own rather than failing.
  • Interfaces are auto-detected from the routing table, but can be forced.

What to do

Install and run live capture:

pipx install git+https://github.com/ZXCurban/NetOrbit.git
sudo netorbit

Evaluate the UI without root or real traffic (useful for deciding before granting raw-socket privileges):

netorbit --demo
netorbit --demo --green

Inspect interfaces, then pin a specific one or a VPN + default-route pair:

netorbit --list-interfaces
sudo netorbit -i eth0
sudo netorbit -i tun0,wlo1

Color themes: --green, --red, --violet. Full flags via netorbit --help.

Nix users must invoke it through a specific incantation (internal privilege management + Scapy raw-socket needs break the normal path):

sudo nix --extra-experimental-features "nix-command flakes" run github:ZXCurban/NetOrbit

Caveats

  • The only performance figure the page offers is a 0.0044s "warm render" for the cached static map layer — a single micro-benchmark, not a full-run CPU measurement, so treat "low CPU footprint" as unquantified beyond that.
  • GeoIP is described as "MaxMind-compatible workflows" with IP-API fallback; the page does not state whether a MaxMind database ships or must be supplied, so plan for the network-dependent IP-API path.

Technologies named here

Techniques named here

  • Real-time outbound IPv4 packet capture
  • GeoIP resolution
  • Traffic filtering
  • Interface auto-detection

Related in Blue Team & Detection