udp-watch

# Description

udp-watch (cpp-udp-watch) is a Linux kernel UDP socket monitor written in C++23 with zero external dependencies. It reads /proc/net/udp and /proc/net/udp6 (13 hex columns per socket) and decodes little-endian IPv4 and byte-swapped per-word IPv6 addresses (:: compression and ::ffff mapping). UDP states: 0x01 CONNECTED (sockets with connect) and 0x07 UNCONNECTED (the common case, wildcard listeners). Drops KPI: packets discarded per socket (full RX buffer), highlighted in red. Well-known service names next to the port (domain, ntp, syslog...) from /etc/services with an embedded fallback for containers. inode -> PID -> comm resolution via a permission-tolerant /proc/*/fd scan. Watch mode (--watch N) with deltas: new/closed sockets and drops between snapshots. JSON output (--json) with summary + sockets array validatable with python -m json.tool. --demo with 16 synthetic sockets of a DNS/NTP/syslog host. Filters --port, --state CONNECTED|UNCONNECTED, --drops, --top. --file parses dumps and tolerates # comments. --no-color uses a mutable ANSI palette (0 escapes in pipes). Selftest 45 checks: parser, IPv4/IPv6, states, filters, JSON and real /proc reads. Zero deps: g++ -std=c++23 -O2 -Wall -Wextra.

$ ./deploy.sh $ git clone

# Key features

$ Reads /proc/net/udp + /proc/net/udp6 (13 hex columns per socket)

$ Little-endian IPv4 and byte-swapped IPv6 decoding with :: compression

$ UDP states: 0x01 CONNECTED and 0x07 UNCONNECTED with own colors

$ Per-socket drops KPI (discarded packets) in red + total summary

$ Well-known service names (/etc/services + embedded fallback) next to the port

$ inode -> PID -> process resolution via /proc/*/fd, permission tolerant

$ Watch mode (--watch N) with new/closed socket and drop deltas

$ Filters --port, --state, --drops, --top; --file with # comments; validatable JSON

# Gallery

Project terminal

Mobile view

# Technologies used

C++23