Skip to content
netrewind
A black box recorder for the network

Get it

Version 1.0.0

Static binaries with no runtime dependencies. Unpack, run the installer, and it records. Every file below is covered by one signed checksum manifest.

This is an early release — the first 1.0.0 — and it may still contain bugs that lab testing has not caught. It has not run on a production network yet; see the status section on the product page for exactly what has been verified and where.

On Linux the recorder watches the kernel directly, through netlink and eBPF. On Windows it watches through the IP Helper API instead, and covers less — interfaces, addresses, routes and neighbours, not flows or filtering policy. There is no macOS build. On Windows, one installer gives you the recorder and the desktop viewer together; on Linux they are separate packages.

All releases →

Check what you downloaded

This release publishes checksums and a signature over them, made with a key that never touches CI. Checksums prove the file arrived as the server sent it; the signature is what proves who built it.

SHA256SUMSSHA256SUMS.sig

sha256sum -c SHA256SUMS
L3Q7cNQWNu50IjcKdJpCHTZXvwdk+qg3aN8c98UmZn8=

Put this in netrewindd.yaml under update.public_key and the recorder refuses any release it cannot verify — including one it is offered by something pretending to be the release feed.

Or as a container

No image is published to a registry yet, so build it from the repository. --network host is not optional: without it the recorder watches the container’s own namespace, which is a network of one interface that nothing interesting happens on.

docker build -f deploy/Dockerfile -t netrewind .
docker run --network host --cap-add NET_ADMIN --cap-add BPF netrewind

Quick start

Recording inside a minute

One static binary, no runtime dependencies, no database to stand up, no agents to roll out.

  1. 1

    Unpack

    Also built for arm64 — the same eBPF object serves both.

    tar -xzf netrewind-1.0.0-linux-amd64.tar.gz
cd netrewind-1.0.0-linux-amd64

  2. 2

    Install

    Installs both binaries, the rule library and a systemd unit, then starts recording.

    sudo ./install.sh

  3. 3

    Read it back

    Or netrewind serve for the same record in a browser, on loopback.

    netrewind timeline --last 15m

Uninstalling never touches the event store. It is the record, and a script that deleted evidence on its way out would be indefensible.

Or on Windows

One signed installer gives you the recorder and the desktop viewer together: it installs both, registers the recorder as a Windows service, and starts it. See the downloads above.

Or boot it from a USB stick

Write the appliance image to a stick, boot a spare machine, and it records from first boot. Nothing to install, nothing to configure.

See it running

NetRewind 1.0.0, on a real machine

The desktop viewer reading a live recorder on a physical Windows machine — then a fault, injected on purpose, and the recorder naming its cause on its own.

Real captures of the installed 1.0.0 build, connected to the Windows recorder over its local pipe — the same netrewindd service that ships on Linux, watching through the IP Helper API on this machine. Cropped to the application window; the recorder’s observer id is the neutral “workstation”.

  1. The Health page of the NetRewind desktop viewer, connected to a live recorder, showing version 1.0.0 and the capability report.

    01Recorder health

    Connected to the live recorder: version, uptime, store path, and the capability report — what each collector is watching on this machine, and what it cannot watch here, with the reason. It reports its own blind spots.

  2. The raw timeline, a list of recorded network state changes in order.

    02The raw timeline

    Every recorded state change, in order. This is the record NetRewind keeps so an outage can be read back after it is over, instead of guessed at.

  3. The Incidents page before the fault, showing no incidents in the window.

    03No incidents — yet

    Before the fault: “No incidents in this window — that does not necessarily mean nothing went wrong.” It does not invent one to look busy.

  4. The correlation-rule catalogue loaded in the recorder, each rule with a confidence and a root cause.

    04The rule catalogue

    The correlation rules loaded in the recorder — each with the confidence it carries and the root cause it names when it fires.

  5. The Evidence bundles page: export a signed, checksummed window of the record, or import one.

    05Evidence bundles

    Export a window of the record as a signed, checksummed archive — no secrets, and no DNS names unless you opt in — or open one you were sent, and read it without touching your own record.

  6. The Diagnostics page: source, endpoint, totals, and events by family.

    06Diagnostics

    The self-diagnostic view for when something is not answering: the source and endpoint the viewer is reading, the totals, and the count of events by family.

  7. The Settings page: language, record source, recorder endpoint, refresh interval, and bundle public key.

    07Settings

    Language, the record source (here, the live recorder on this machine), the recorder endpoint, the refresh interval, and the public key that makes the viewer refuse an unsigned bundle.

  8. The timeline during the fault: repeated link down and link up, and the address and route that left and returned.

    08A fault, as it is recorded

    We flapped a network port five times — what a failing transceiver or a marginal cable looks like. The recorder captured the repeated link-down / link-up, and the address and route that left and returned with it.

  9. The incident view: “A port is flapping”, 88% confidence, with the causal chain, root cause and suggested next step.

    09The diagnosis

    The engine concluded “A port is flapping” on its own — 88% confidence — set out the causal chain, named the root cause, and gave the remediation. Nobody asked it a question.

  10. The same flapping-port incident rendered in Arabic, right-to-left.

    10The same incident, in Arabic

    The whole interface is bilingual and right-to-left. Only what the recorder itself prints — event kinds, the rule’s own text — stays in the language it printed it, because translating output would invent output NetRewind does not produce.

  11. The Health page after the fix: recorder healthy, no observation gap.

    11Healthy again

    After the fix, the recorder is healthy with no observation gap — and the flapping incident stays in the record as history. The evidence is not erased by the recovery.