Hodometer 1.3

A single-file native Windows tray application (C, Win32, no runtime) that shows exactly which program is sending and receiving bytes and to which host, keeps Windows connection auditing switched on, lets you or an AI agent kill a process or block a program on the spot, and streams everything over a localhost socket that only programs you have explicitly allowed can use.

1.2 adds the Inspector: zoom into one process and see its connections (state, RTT, retransmits, connect time), its packets decoded on the wire (TLS SNI/ALPN, QUIC, DNS, HTTP), a process profile (CPU, memory, disk, GPU, user, command line, signer) and a timeline (connects, failures, child processes, DLL loads), with pcapng export. All of it comes from Windows' own kernel providers and ndiscap.sys; there is no driver to install.

1.3 makes the socket fit for many agents at once (the Sentinel design in SENTINEL.md): commands run on worker threads, so a slow inspect from one client no longer stalls the others; up to four pcapng captures run at the same time, one per process; conns pages through every flow and can filter to active flows or flows touched since a timestamp; a watcher can ask for decoded handshakes only instead of every frame; a flowinfo event announces each flow's SNI, ALPN, HTTP request or TLS version the moment it is decoded; each connection may watch 64 processes; inspect reports the file's SHA-256 and caches signature checks.

Demo

Watch or download the 72-second demo · English captions

Actual Hodometer footage follows a controlled upload through process inspection, packet capture, and a verified firewall block. The Sentinel segment is a clearly labeled simulated AI investigation, with scores and dry-run behavior computed by the repository code. Personal details and unrelated processes are removed from the published video.

What it does

• Exact per-process traffic. Reads the kernel network ETW provider in real time (the same source Resource Monitor uses): bytes sent and received per process, with name, full path and the remote address:port that got the most bytes. Local and LAN traffic is hidden by default (toggle button, or local on).
• Hostnames. Learned live from the DNS client ETW provider (the name each program actually resolved), with a plain DNS PTR lookup as fallback. Shown in the table and in every event (host).
• Odometers and sparkline. Rolling-digit counters for bytes OUT and IN with live rates, and a five-minute graph.
• Process table sorted by current rate, 24 h of per-minute history per process in memory (history) and appended to history.jsonl.
• Kill or block. Select a row: Kill selected process (or Delete key, right-click), Block program (firewall) adds inbound and outbound Windows Firewall block rules for that program's path; unblock from the right-click menu. The app refuses to kill the processes Windows cannot live without and itself.
• Audit keeper. Every 30 s it checks the Filtering Platform Connection audit subcategory (what auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable turns on). Off means it turns it back on, logs it and tells connected agents. A button does it immediately.
• Connection events. With auditing on, Windows writes Security event 5156 for every connection; the app forwards each outbound non-local one as a conn event with program path, destination, hostname and port.
• Spikes. Upload over 0.75 MB/s or download over 1.5 MB/s (configurable) emits a spike event, a line in hodometer.log and a tray notification (at most one per 5 minutes).
• Tray. Left-click the icon to show or hide the window; right-click for pause, audit repair, forget trusted programs, log folder, README, exit. Closing or minimising hides to the tray; Exit is in the tray menu.

Inspector (zoom into a process)

Double-click a row, press Inspect selected process, use the right-click menu, or send inspect <pid> show over the socket. Up to eight Inspector windows can be open; each follows one pid.

• Header. Name, pid, running/exited/blocked, Authenticode signer (embedded signature, or the Windows catalog that covers the file; "unsigned" and "signature not trusted" are called out), path, command line, user and integrity level, parent, start time, children, threads, handles; CPU %, memory (working set and private), disk read/write rate, GPU % (the per-process "GPU Engine" counters Task Manager uses), CPU time; bytes out/in with rates, active connections, retransmitted bytes, failed connection attempts, packets seen; a two-minute rate graph for this process alone.
• Connections. Every TCP connection and UDP flow of the process: remote host (DNS name, else the TLS SNI, else the address), port, protocol, state (connecting / established / closed / failed, or udp / quic), rates and totals each way, retransmitted bytes and packets, smoothed and minimum RTT, local port, age, and an info column with SNI, ALPN, TLS version, HTTP request, QUIC version, connect time, reconnects, timeouts and congestion signals, MSS. Lifecycle and retransmits come from the Kernel-Network provider (events 12-17 and their IPv6 twins), states are seeded from the TCP table, RTT and retransmit counters from TCP ESTATS (enabled per connection while it is inspected).
• Packets. Live list of the process's frames: time, direction, protocol, remote, length, TCP flags and a one-line decode: TLS ClientHello with SNI and ALPN (reassembled across segments), ServerHello with the negotiated version, TLS record types, plaintext HTTP request line and Host header, DNS queries and answers, QUIC version and packet type. For QUIC v1 the client Initial is decrypted (its keys derive from the connection id alone, RFC 9001 5.2), so HTTP/3 connections show SNI and ALPN as well, even when Chrome scatters the ClientHello over many out-of-order CRYPTO fragments. Payloads stay encrypted; nothing beyond the handshake is read.
• Timeline. Connect / established (with connect latency) / closed / failed (with the Winsock error) / retransmit bursts, TLS hellos, DNS queries, HTTP requests, QUIC hellos, child processes the inspected process started, image (DLL) loads while inspected, process exit, finished captures.
• Capture 30 s → pcapng. Writes just this process's frames to capture_<name>_<pid>_<time>.pcapng next to the exe; opens in Wireshark. Up to four captures (one per process, or one for every process) can run at once; the header shows this process's capture and notes when others are running. Copy JSON puts the whole Inspector state on the clipboard (the inspect reply). Kill and Block act on this process.

How it works: frames come from Windows' own ndiscap.sys (the Microsoft-Windows-NDIS-PacketCapture provider behind netsh trace) through a second ETW session, HodometerZoom, which runs only while an Inspector is open, a socket client is watching, or a capture is running (plus a 30 s grace period). Frames carry no process id; Hodometer attributes them by matching local and remote address and port against the connection table it builds from the kernel network events. That is how it does per-process packets, which pktmon and Wireshark cannot. Names learned from SNI also fill the main table's host column when DNS revealed nothing (browsers using DNS over HTTPS, for instance).