Real-time network detection, behavioral analysis and deception engine for Windows.
NetMonitor provides deep visibility into system-level network activity by correlating connections with running processes and detecting anomalous or context-inconsistent behavior in real time.
- Real-time inbound & outbound traffic detection
- Process-to-connection correlation
- Behavioral analysis (not just packet inspection)
- Detection of anomalous or inconsistent activity
- Deception sandbox (trap mode) for interaction logging
- Canary-based tracking and attribution
- Fully local operation (no external data collection)
Unlike traditional network monitors, NetMonitor focuses on:
- Behavior, not just traffic
- Context correlation between processes and connections
- Detection of suspicious patterns even when traffic appears legitimate
- Detect port scans and reconnaissance activity
- Identify suspicious outbound connections
- Analyze process behavior in real time
- Monitor unexpected network usage
- Test environments using tools such as:
- nmap
- masscan
- hping3
- hydra
Looking for the latest private version?
This repository contains the original public Community Edition of NetMonitor PRO.
Since its initial public release, the project has evolved into a significantly more advanced private codebase focused on Windows endpoint network monitoring, active deception and forensic analysis.
- Advanced TCP and contextual UDP traffic analysis
- Inbound and outbound monitoring engine
- Advanced outbound inspection and protection
- Advanced anti-exfiltration capabilities
- Active Deception framework
- Multi-protocol Canary services
- Enhanced Trap and Honeypot capabilities
- Process, Parent Process and Digital Signature correlation
- JA3 / JA4 TLS fingerprinting
- DNS tunneling detection
- Threat scoring and contextual trust engine
- Advanced forensic HTML reporting
- AI-assisted security analysis
- Night Mode automated protection
- Telemetry and performance dashboard
- Hardened installer, SBOM and build provenance
The latest Enterprise Edition is not publicly distributed.
The acquisition package includes:
- Complete source code
- Complete development project
- Build and packaging projects
- Installer
- Technical documentation
- User documentation
- Architecture documentation
- Project assets
The project is offered as a complete technology acquisition for organizations wishing to integrate, commercialize or further develop the platform.
The acquisition is intended as a one-time transfer of the complete project.
No ongoing development, consultancy or maintenance is included.
please open a GitHub Issue using the title:
Commercial Inquiry
Further information will be shared privately.
This software is provided for educational, diagnostic and security analysis purposes only.
NetMonitor operates entirely on the local system and does not transmit data externally by default.
The tool is designed to monitor network activity and system behavior. It does not perform exploitation, intrusion or unauthorized actions by itself.
The author is not responsible for any misuse of this software, including but not limited to unauthorized monitoring, violation of privacy, or illegal activities.
Users are solely responsible for ensuring that their use of this software complies with applicable laws and regulations.
This software is provided "as is", without warranty of any kind, express or implied, including but not limited to fitness for a particular purpose.
Under no circumstances shall the author be held liable for any direct, indirect, incidental or consequential damages arising from the use or misuse of this software.
If you find this project useful:
👉 Support development