Visualize connections between servers. Add netstat or ss output from several machines and see who talks to whom. Runs in your browser.
A list of connections is hard to picture, and a list from one machine only shows half of each conversation. This tool takes the connection lists from several machines, matches them up, and draws a map of which machines talk to each other, on which ports, and which outside addresses they reach.
Add each machine with a name and its netstat or ss output from Windows, Linux or macOS. Links are drawn between machines when their addresses and ports line up, solid when both machines show the connection and dashed when only one does. Click a machine to see what it listens on and what it connects to.
Everything runs in your browser. The output you add is never uploaded and never added to the page address. You can export the map as an image or as a vector file, also in your browser.
Run the command from the Netstat Output Analyzer on each machine you want on the map. It collects the machine name, its IP addresses and its connection list in one step. Then add the machines one at a time with a short name, for example web-01, and paste or open the output.
A good first map covers one tier of an application: the web server, the application server and the database. If you add every machine, the map can get crowded, and the filters help you look at one port at a time.
Take the output at a busy time. A connection that is open when you run the command shows up, and one that is not does not.
A link is drawn when a connection on one machine goes to the address and port of another machine you added. For example, if web-01 has a connection to 10.0.0.20 on port 5432 and you added db-01 with the address 10.0.0.20, the map links web-01 to db-01 on port 5432.
The command also collects each machine's own addresses, so matches do not rely on guesses. If a machine's addresses are missing, you can type them in.
When both machines show the connection, the link is solid. When only one side does, for instance because you did not add the other machine's connection list, or it closed in the meantime, the link is dashed and labeled as inferred.
It is a snapshot. Connections that were closed or not yet open when you ran the command are not there, so a quiet link may just have been idle. Capturing more than once gives a fuller picture.
Network address translation, load balancers and container networks can make the address a machine sees differ from the address you expect, and the map can then miss a link or show it to the wrong machine. Without sudo on Linux and macOS, some process names are missing.
The map shows who connects to whom. It does not say whether a connection is good or bad. Use the Netstat Output Analyzer for the checks on each machine.
Large circles are the machines you added. Small circles are outside addresses, and addresses on your own network that you did not add show with an orange outline. The width of a line shows how many connections it carries, and the arrow points from the machine that opened the connection to the one that answered.
Connections that are closing are drawn faded. Click a machine to see what it listens on, what it connects to and what connects to it, and click an outside address to check it. When there are a lot of outside addresses, the map groups them by network so it stays readable, and you can turn the grouping on or off.
It matches each connection's remote address and port to the addresses of the machines you added. If web-01 connects to 10.0.0.20 port 5432 and db-01 owns 10.0.0.20, the two are linked. If both machines show the connection, the link is solid.
A dashed line is an inferred link: only one machine shows the connection. It often means the other machine's list was captured at a different moment, was not added, or the connection was translated by a NAT or load balancer.
It may have had no connections to the other machines when you captured it, its addresses may be missing or different from what the others connect to, or it may be behind address translation. Check its addresses, and try capturing again at a busier time.
Yes. Each machine can come from a different operating system, and the map reads each format. Use the command for each system from the Netstat Output Analyzer.
No. The text is read and drawn in your browser, it is never uploaded and never added to the page address. Exports are made in your browser too.
It works best with a handful of machines up to a few dozen. Outside addresses are the usual cause of crowding, so when there are many the map groups them by network. Use the port filter to look closely at one service.
You can export it as an image (PNG) or a vector file (SVG). They show machine names and addresses, so remove sensitive details before you share one.
Paste netstat, ss or lsof output from Windows, Linux or macOS and see what is listening, what is connected, and which connections are worth checking.
Build netstat and Get-NetTCPConnection commands to find the process using a port and list connections.
Comprehensive database of common network ports and their associated services
Build and test firewall rulesets with an interactive rule editor. Craft test packets to trace through rules, toggle stateless vs stateful inspection, view connection state tables, and analyze rule match statistics. Includes pre-built rulesets for web servers, DMZ, and corporate LAN.
Normalize a domain, IP, CIDR, or URL, compare DNS snapshots, preserve findings locally, and continue across focused network investigation tools.