NetOrbit visualizes network traffic as it happens, mapping outbound IPv4 packets onto a Braille-rendered world map right in the terminal. Packets captured from your machine appear as signals on this map, showing destinations, connection speeds, and routes without needing a browser or graphical interface. The tool uses Scapy for packet capture and Textual/Rich for the terminal UI, delivering real-time GeoIP telemetry and live traces from a fixed home point.

This setup addresses the gap between raw packet logs and interactive dashboards. Instead of sifting through text dumps, users see traffic light up geographically, with panels listing recent connections by IP, country, protocol, size, and interface. It runs asynchronously to avoid blocking the UI, and static map caching keeps CPU use low at 0.0044 seconds per warm render.

Core features

NetOrbit packs several specific capabilities into its terminal interface:

  • Braille-rendered world map using high-density terminal pixels and a coordinate grid for sub-pixel accuracy via a virtual 2x4 Braille dot layer.
  • Async Scapy sniffing that captures live outbound IPv4 traffic while the UI renders continuously.
  • GeoIP resolution pulling from MaxMind-compatible sources or IP-API as fallback, plotting destinations and drawing neon-style traces.
  • Recent connections panel displaying IP addresses, countries, protocols, packet sizes, and network interfaces.
  • Smart filtering that ignores local, private, multicast, and broadcast addresses to focus on external traffic.

These elements create a dense, information-rich view. The map stays static for performance, with dynamic overlays for incoming packets. Color themes like green, red, or violet adjust the neon aesthetics.

Getting it running

NetOrbit requires Python 3.10 or higher and root privileges for Scapy's raw socket access. On Linux, it can elevate itself with sudo if needed. First, check available network interfaces:

netorbit --list-interfaces

Install via pipx for isolation:

pipx install git+https://github.com/ZXCurban/NetOrbit.git

Launch the live capture:

sudo netorbit

For Nix users on any Linux distro, use this due to privilege handling:

sudo nix --extra-experimental-features "nix-command flakes" run github:ZXCurban/NetOrbit

Specify interfaces, such as a VPN tunnel and wireless:

sudo netorbit -i tun0,wlo1

Test without root or real traffic using the demo mode:

netorbit --demo
netorbit --demo --green

Theme options include --green, --red, or --violet for live runs. The project supports Fedora and macOS natively, with Nix flakes for reproducible builds. MIT-licensed, it sits at 180 GitHub stars.

Who this is for

Network curious users who prefer shell tools will find NetOrbit useful. It suits those debugging outbound connections—watching where a script phones home, spotting unexpected VPN routes, or monitoring app behavior during development. Security-minded folks gain quick visibility into external chatter without GUI overhead.

Run it while browsing or running services; packets from your default route populate the map instantly. Developers testing GeoIP-dependent code or tracing latency can pair it with tools like tcpdump. If your workflow stays in tmux or a multiplexer, this fits as a split-pane monitor. It's lightweight enough for always-on use on a server console, given the low CPU footprint.

Not ideal for inbound traffic analysis—that stays out of scope. Teams needing shared dashboards or historical logs should look elsewhere, as this focuses on ephemeral, real-time outbound views.

How it compares

NetOrbit stands apart by staying terminal-native, avoiding Electron apps or web servers like those in Wireshark's GUI or ntopng. Tools such as tcpdump or tshark dump text logs requiring manual parsing, while NetOrbit adds geographic mapping without extra steps. For visualization, it resembles afterglow or Maltego graphs but confines everything to ASCII/Braille, trading export features for instant access.

Heavier alternatives like Zeek or Suricata offer protocol deep dives and alerting, but demand more setup and resources. NetOrbit's 0.0044-second renders beat redraw-heavy TUIs like htop in network contexts. If you need mobile or cross-platform apps, something like Fing or Network Analyzer apps fill that, though they lack shell integration.

Tech stack details

The project layers Python 3.10+ as runtime, Textual and Rich for the UI, and Scapy for sniffing. GeoIP workflows integrate MaxMind databases with IP-API redundancy. Braille rendering handles dense mapping efficiently, supported by async I/O to prevent UI freezes. Platforms include Fedora, macOS, and NixOS via flakes—no Windows mention in docs.

NetOrbit works best for outbound IPv4 on Unix-like systems where root access comes easy. Source code lives at https://github.com/ZXCurban/NetOrbit. If terminal maps don't appeal or you avoid sudo prompts, plain packet counters like iftop might suffice instead.

View on GitHub →