v1.0.0
AGPL-3.0
Linux + Windows
One static binary

See what changed before the network failed.

NetRewind records state changes, not packets.

NetRewind records changes across interfaces, routes, and connections, then connects them on one timeline so you can investigate an outage after it ends.

Get NetRewind Explore NetRewind Desktop

The recorder and the desktop viewer are both available today, for Linux and Windows.

Verified against fourteen injected faults on a GNS3 lab of Cisco routers and switches, and on Linux network namespaces; the Windows collectors were also verified on a real machine. Not yet run on production hardware — the status section says exactly what the fault-injection lab covers.

state changes · 11 seconds · one segment

!! error! warn- notice

Local-first
No packet payloads
Open source — AGPL-3.0
Tested fault scenarios

How it works

From a change on the wire to an incident you can check

1
Record the change
interface, ARP, route, flow, policy
2
Keep the evidence
timestamp, source, affected entity, raw evidence
3
Build the incident
cause, correlation, order, confidence, unknowns

Read how it works in full

NetRewind Desktop

1.0.0

One workspace for the timeline, the evidence, and an optional local assistant

NetRewind Desktop ships for Windows and Linux — the recorder’s timeline and evidence chain in one interface. An optional local AI assistant that never leaves your machine is planned, and not enabled in 1.0.0.

Explore NetRewind Desktop

Real output

Not a mockup. This is what the tool prints.

The synthetic lab builds a topology out of network namespaces and veth pairs, starts the recorder against it, and then injects faults into it: a flapping access port, a hijacked gateway, a contested address, a re-pointed prefix, a vanished default route, a filtering rule dropped in front of a working path.

Afterwards it asks the recorder to account for every one of them, and fails the run if anything injected left no trace or was not recognised.

Both blocks below are output from that lab. The incident is the one produced by the change-broke-a-path rule; its sentences are the rule’s own.

netrewind incidents --last 1h

A path that was working stopped working

window: 19:09:19 to 19:09:23 (4s)
rule: change-broke-a-path
confidence: 88%
affected: 10.99.1.11

19:09:19.078l2.arp_binding_changed10.99.1.11
This is the last thing that changed on the path before it broke.
which caused
19:09:23.086flow.first_failure_for_pair10.99.1.11
Two machines that had been connecting successfully can no longer complete a handshake. Whatever else is true, something between them changed.
and at the same time
19:09:23.090l2.neighbor_failed10.99.1.11
Other connections started failing in the same window.

root cause: l2.arp_binding_changed on 10.99.1.11 (confidence 88%)

next: The change named here is the nearest one in time, not a proven cause. Confirm it against your change record before acting: if it was intended, the breakage is a side effect nobody planned; if it was not, something changed the network without going through you.

$netrewind what-happened --host 10.99.0.11 --at now --window 10m

  warning: !  12:15:50.621             nrlab1 was shut down administratively
  notice: -  12:15:52.628  +2.01s     nrlab1 came back after 2.006s
  warning: !  12:15:53.639  +1.01s     10.99.0.11 moved from 02:00:00:00:00:11 to 02:00:00:00:00:aa
  error: !! 12:15:54.647  +970ms     10.99.0.201 moved from 02:00:00:00:00:01 to 02:00:00:00:00:ff - this is the default gateway
  error: !! 12:15:55.660  +1.01s     10.99.0.11 is being claimed by more than one machine  (x3)
  notice: -  12:15:59.685  +4.02s     route to 10.200.0.0/24 now goes via 10.99.1.11 (was 10.99.0.11)
  error: !! 12:16:01.713  +2.02s     the default route was removed - nothing beyond the local segment is reachable

Severity is a glyph

Because these end up in a monochrome terminal and in a screenshot pasted into a ticket, and colour survives neither.

!!: Something is broken now.
!: Worth an operator’s attention.
-: A real change, ordinary in isolation.
: Context. No glyph at all — it should not draw the eye.

The (x3) is not a rendering shortcut. Repeats of the same fact fold into one row inside a sixty-second window, keeping the original start time and counting up — so a flapping port is one growing event rather than ten thousand rows, and the count is itself the evidence of flapping.

What you get

A record that answers the question, not one you have to mine

The chain, not the pile
Nineteen correlation rules read the record and say what caused what — each link naming its relation and carrying the evidence it rests on. You get a conclusion you can check, not a search box.
A week of history, in gigabytes
It records state changes, not packets: a carrier dropping, an ARP binding moving, a route vanishing. Orders of magnitude smaller than capture, so history survives long enough to be there when you finally need it.
It tells you what it missed
Every gap in the record is written into the record, measured against a heartbeat. A recorder that quietly omits its blind spots shows a quiet network — and a quiet network is what you conclude when nothing is wrong.
Nothing to operate
One static binary with no runtime dependencies, a SQLite file, and a systemd unit. No agent fleet, no collector tier, no cluster. It runs on a Raspberry Pi.

Get the evidence before the next outage, not during it

The recorder and the viewer both run on Linux and Windows. Both are in 1.0.0.

Download NetRewind Explore NetRewind Desktop

See what changed before the network failed.

From a change on the wire to an incident you can check

Record the change

Keep the evidence

Build the incident

One workspace for the timeline, the evidence, and an optional local assistant

Not a mockup. This is what the tool prints.

A path that was working stopped working

Severity is a glyph

A record that answers the question, not one you have to mine

The chain, not the pile

A week of history, in gigabytes

It tells you what it missed

Nothing to operate

Get the evidence before the next outage, not during it