NetRewind Desktop
1.0.0Investigate incidents from one workspace
NetRewind Desktop brings the timeline, the evidence chain, recorder health, and settings into one interface for network engineers on Windows and Linux. It reads a recorder live over a local-only channel — a named pipe on Windows, a socket on Linux — or opens an evidence bundle exported from any recorder.
An optional local AI assistant is planned on top of it: a suggestion layer over the deterministic engine, running on your machine, never sending network data to the cloud. It is not enabled in 1.0.0 — no candidate model has met the bar yet, and the app ships without it rather than with one that guesses.
This is an early release — the first 1.0.0 — and it may still contain bugs that lab testing has not caught. It has not run on a production network yet.
The viewer shipped in 1.0.0 for Windows and Linux. The optional local AI assistant is the one part still in development; everything below the recorder’s own timeline and causal chain comes from the deterministic engine, not from a model.
Platform status
Windows 10 22H2+ / Windows 11, x64
Available in 1.0.0
A signed installer (NSIS, and an MSI for deployment tooling) that also installs and registers the recorder as a Windows service. The app reads the live recorder over its local named pipe.
Linux x86-64 / arm64
Available in 1.0.0
Ships as a .deb, a .rpm and an AppImage. It reads a recorder over its local socket — add your user to the netrewind group — or opens an evidence bundle without a recorder at all.
The local AI assistant
No model includedNo AI model ships with NetRewind 1.0.0 — not this application, not the recorder. What produces the timeline and the causal chain is the deterministic Isnad correlation engine: explicit rules matching real recorded events, not a model making a guess.
An optional local AI assistant is planned as a suggestion layer on top of that engine: running entirely on your machine through a small, quantized, CPU-only model, never sending network data to the cloud. It is not enabled in this release.
When it exists, the model will run on your machine, without sending network data to the cloud.
Known limitation. This project publishes no accuracy number for the assistant. Two named candidates were benchmarked against a synthetic corpus — microsoft/Phi-4-mini-instruct (3.8B, MIT-licensed) and Qwen2.5-1.5B-Instruct (1.5B, Apache-2.0) — and neither met the release gate, so neither ships: read the real numbers rather than trusting a summary.
Questions worth asking
- Is it available now?
- The desktop viewer, yes — it ships in 1.0.0 for Windows and Linux, on the download page. No AI model is included: the optional local assistant is the only part not yet enabled.
- Which AI models has NetRewind evaluated?
- Two, named: microsoft/Phi-4-mini-instruct (3.8B parameters, MIT-licensed) and Qwen2.5-1.5B-Instruct (1.5B, Apache-2.0). Both were benchmarked against a synthetic evaluation corpus and neither met the release gate, so neither ships. No AI model is included in NetRewind today.
- Does the assistant need a GPU?
- No. It is designed to run on CPU only, using a quantized model — the same kind of machine that runs the recorder is the target.
- Does any data leave my device?
- No. The viewer reads a recorder over a local-only channel, and the assistant, when it exists, runs locally; NetRewind does not send network data or events to a cloud service.
- Does it replace the rule engine?
- No. The Isnad correlation engine produces the timeline and the causal chain. The assistant will only suggest and explain — it does not get to invent a cause the engine itself did not surface.
The recorder and the viewer are separate downloads: the recorder is the Linux service that watches the kernel, and the viewer reads what it kept. Both are in 1.0.0.
Get NetRewind 1.0.0