NetRewind Desktop
1.2.0Investigate incidents from one workspace
NetRewind Desktop brings the timeline, the evidence chain, recorder health, and settings into one interface for network engineers on Windows and Linux. It reads a recorder live over a local-only channel — a named pipe on Windows, a socket on Linux — or opens an evidence bundle exported from any recorder.
A local AI assistant is fully built underneath it — the runtime, the model manager, the guardrails, the panel — and evaluated honestly against a pre-registered safety gate on real hardware. It stays off: two model families were tried, and neither was both safe and useful enough to trust. Downloading a model in Settings still works today; running an analysis with one does not, until a candidate clears both bars.
This release has not run on a production network yet; see the status section on the product page for exactly what has been verified and where.
The viewer shipped in 1.0.0 for Windows and Linux, and keeps shipping. The local AI assistant is fully built and evaluated but stays off by default; everything the viewer shows — the timeline, the causal chain — comes from the deterministic engine, never from a model.
Platform status
Windows 10 22H2+ / Windows 11, x64
Available in 1.0.0
A signed installer (NSIS, and an MSI for deployment tooling) that also installs and registers the recorder as a Windows service. The app reads the live recorder over its local named pipe.
Linux x86-64 / arm64
Available in 1.0.0
Ships as a .deb, a .rpm and an AppImage. It reads a recorder over its local socket — add your user to the netrewind group — or opens an evidence bundle without a recorder at all.
The local AI assistant
Built, evaluated, off by defaultNo AI model analyzes anything in NetRewind 1.2.0 — not this application, not the recorder. What produces the timeline and the causal chain is the deterministic Isnad correlation engine: explicit rules matching real recorded events, not a model making a guess.
The local AI assistant is fully built as a suggestion layer on top of that engine: a runtime, a model manager, a pre-inference guardrail, post-answer validation, all running entirely on your machine through a small, quantized, CPU-only model, never sending network data to the cloud. A compile-time switch keeps the analysis feature itself off in this release — downloading a model in Settings still works, independent of that switch.
The model runs on your machine, without sending network data to the cloud.
Known limitation. This project publishes no accuracy number for the assistant. Two model families were run through a pre-registered gate on real hardware — Qwen3.5 (0.8B/2B/4B) and IBM Granite 4.x (1B/3B/8B) — and neither shipped. Qwen3.5 failed the gate outright. Granite 4.2-3B, after a real fix for a verbosity problem, technically met every safety criterion but found the correct cause in zero of nine held-out test cases — safe, but not useful enough to trust, so it stays off too. Read the real numbers rather than trusting a summary.
Questions worth asking
- Is it available now?
- The desktop viewer, yes — it ships for Windows and Linux, on the download page. No AI model analyzes anything: the local assistant is fully built and evaluated, but the analysis feature itself is not enabled.
- Which AI models has NetRewind evaluated?
- Two families, named: Qwen3.5 (0.8B/2B/4B, Apache-2.0) and IBM Granite 4.x (1B/3B/8B, Apache-2.0). Both were run through a pre-registered gate on real hardware. Qwen3.5 failed outright. Granite 4.2-3B technically met every safety criterion after a real fix, but found the correct cause in zero of nine held-out cases — not shipped, on a usefulness judgment rather than a safety failure. No AI model analyzes anything in NetRewind today.
- Does the assistant need a GPU?
- No. It is designed to run on CPU only, using a quantized model — the same kind of machine that runs the recorder is the target.
- Does any data leave my device?
- No. The viewer reads a recorder over a local-only channel, and the assistant runs locally when enabled; NetRewind does not send network data or events to a cloud service.
- Does it replace the rule engine?
- No. The Isnad correlation engine produces the timeline and the causal chain. The assistant only ever suggests and explains — it does not get to invent a cause the engine itself did not surface.
The recorder and the viewer are separate downloads: the recorder is the Linux service that watches the kernel, and the viewer reads what it kept. Both are in this release.
Get NetRewind 1.2.0