user@devops:~$ cat README.md
TCP Watch
# Description
TCP Watch (cpp-tcp-watch) is a Linux TCP connection monitor written in dependency-free C++23 that reads the kernel socket table from /proc/net/tcp and /proc/net/tcp6. Robust parsing: malformed or short lines are skipped without breaking the rest, and extra fields from modern kernels (4.1+) are tolerated. Address decoding verified against real data: little-endian IPv4 (0100007F -> 127.0.0.1) and IPv6 with :: compression and IPv4-mapped detection (::ffff:a.b.c.d) starting from the byte-swapped network words the kernel prints with %08X on little-endian hosts. 13 decoded TCP states with per-state colors in the table (LISTEN cyan, ESTAB green, TIME_WAIT dim, unstable yellow, CLOSING red). inode -> PID -> process resolution: scans the socket:[inode] symlinks in /proc/*/fd once per snapshot and maps each socket to its process via /proc/<pid>/comm, with --no-resolve to disable it. Listeners table (port, state, uid, pid, process, inode) and active connections top-N by TX+RX queues (--top N); --ports mode with the top-N local ports by connection count and per-state breakdown; --state NAME filter with short forms (ESTAB, TW, LISTEN...). Live watch mode (--watch N) with per-state delta rates (connections/s), elapsed time, screen clear and flush so the output survives timeout/kill. Full JSON output (--json) with {connections{total, ipv4, ipv6, by_state}, connections_list[{local, remote, state, uid, pid, proc, tx, rx, inode, family}], summary}. Demo mode (--demo) with an embedded synthetic sample (sshd, nginx, postgres, chrome, curl, real IPv6) whose counters grow in watch. 33 self-test checks (--selftest): IPv4/IPv6 decoding, states, synthetic parsing, aggregation, deltas, JSON and a conditional smoke test against the real /proc. Zero dependencies: direct compilation with g++ -std=c++23.
# Key features
$ Robust /proc/net/tcp and /proc/net/tcp6 parsing: malformed or short lines are skipped without breaking the rest; tolerates extra fields from modern kernels (4.1+)
$ Address decoding for IPv4 (little-endian) and IPv6 with :: compression and IPv4-mapped detection (::ffff:a.b.c.d), verified against real /proc/net/tcp6
$ 13 decoded TCP states: LISTEN, ESTABLISHED, SYN_SENT, SYN_RECV, FIN_WAIT1/2, TIME_WAIT, CLOSE, CLOSE_WAIT, LAST_ACK, CLOSING, NEW_SYN_RECV
$ inode -> PID -> process resolution by scanning the socket:[inode] symlinks in /proc/*/fd and reading /proc/<pid>/comm (--no-resolve to disable)
$ Listeners table + top-N active connections by TX+RX queues (--top N) with state colors: LISTEN cyan, ESTAB green, TIME_WAIT dim, unstable yellow, CLOSING red
$ --ports mode: top-N local ports by connection count with per-state breakdown, and --state NAME filter with short forms (ESTAB, TW, LISTEN...)
$ Live watch mode (--watch N) with per-state delta rates (connections/s), elapsed time, screen clear and flush (full output even with timeout/kill)
$ Full JSON output for scripting (--json) and 33 self-test checks (--selftest) with a conditional smoke test against the real /proc; synthetic --demo mode for containers/VMs
# Gallery
# Technologies used
