portwatchz

A Zig library and CLI that snapshots listening ports and connections, maps them to processes and binaries, and alerts on drift via webhooks.

Zigexperimentalports · network · ecs · webhookshost monitoring source on github

Why

Know when something new starts listening, a connection appears, or the binary behind a known port changes — and get it as a structured event, not a log line to grep.

How

On Linux it parses /proc/net/{tcp,tcp6,udp,udp6}, maps socket inodes to PIDs, and reads each process’s executable, command line and UID/GID from /proc.
Executables are hashed with BLAKE3, so a diff reports not only opened and closed but binary_changed and process_changed.
Output as text, JSON or ECS (Elastic Common Schema) for SIEM ingestion. Webhooks are batched with retries and signed with an HMAC-SHA256 X-Hub-Signature-256 header.

Limits

Linux is native; macOS currently shells out to netstat and lsof; BSD and Windows are planned. A sibling to IntegrityZ.

portwatchz init --include-established
portwatchz check --filter :22 --filter :443
portwatchz watch --output json --webhook-url https://example.com/alerts

$ git clone https://github.com/zombocoder/portwatchz

← all projects