KEY_EVENT // [p] Pause
ENGINE: ONLINE TARGET: x86_64-pc-windows-msvc EDITION: RUST 2024 // RATATUI 0.30.2 WIN32_API: IpHlpApi · WinTrust · AdvApi32 · ETW
TX: 412.4 KiB/s · RX: 2.38 MiB/s RELEASE: v1.3.0
T tcptui v1.3.0
↓ BINARIES GITHUB
+ + + +
SYSINTERNALS TCPVIEW // TERMINAL RE-ENGINEERING

Total Socket Visibility.
Zero GUI Overhead.

Native Rust terminal UI for Windows that enumerates every IPv4 & IPv6 TCP/UDP endpoint in real time. Equipped with extended TCP byte counters (EStats), kernel ETW connection tracing, a 17-field boolean query compiler, Wireshark-style row coloring, Authenticode verification, and instant SetTcpEntry socket termination.

↓ DOWNLOAD v1.3.0 (WIN-X64) ▶ INTERACTIVE TUI BELOW λ QUERY COMPILER
250ms
Min Poll Tick
0 Async
Pure std::thread
17 Fields
Filter Grammar
2 Bins
tcptui + tcpvcon
ESTATS_WAVEFORM // GetPerTcpConnectionEStats ■ TX · ■ RX
PS>scoop install https://github.com/sametcn99/tcptui/releases/download/v1.3.0/scoop-tcptui.json
tcptui.exe RATATUI TUI
Interactive socket table, EStats bandwidth chart, ETW kernel session, rules studio, whois, VirusTotal & SetTcpEntry killer.
tcpvcon.exe HEADLESS CLI
Script-ready companion mirroring Sysinternals tcpvcon with CSV (-c), JSON (-j), and --filter expressions.
01 // INTERACTIVE TUI WORKSTATION (RIGHT-CLICK ANY ROW · CLICK HEADERS · PRESS KEYS)
■ Administrator: tcptui.exe — --etw
RIGHT-CLICK ROW FOR CONTEXT MENU · DOUBLE-CLICK FOR AUTHENTICODE · CLICK HEADER TO SORT
─□✕
tcptui ETW sort:process↑ resolve:on
1000ms ADMIN
PRESETS:
/
M Process ▲ PID Proto Local Address L-Port Remote Address R-Port State Service Tx Rx Age Country
┌ Context Menu ──┐
┌ Popup ──┐
Enter:inspect B:chart G:group Ctrl+P:palette A:rules w:whois V:virustotal Space:mark c:close-socket K:kill-pid
total 16 · tcp 14 (est 9 lsn 3 tw 1 cw 1) · udp 2 · shown 16
+ NEW (Opened this tick) ~ CHANGED (TCP state transition) - DELETED (Closed / SetTcpEntry reset) * MARKED (Spacebar batch target)
PRESS PHYSICAL KEYS (p B G A w V c Space 1-8) OR RIGHT-CLICK ANY ROW
02 // SYSTEM INTERNALS & WIN32 TELEMETRY PIPELINE

Engineered for Sub-Millisecond Terminal Rendering.

No Electron. No Tokio async bloat. Classic std::thread + mpsc channels bridge low-level Windows IP Helper & ETW kernel APIs to a deterministic Ratatui frame buffer.

INTERACTIVE SCHEMATIC // CLICK A STAGE TO INSPECT RUST MODULE

4-Stage Lock-Free Collector & Render Pipeline

Click each subsystem node below to inspect the exact Win32 system calls and Rust source files powering tcptui:

STAGE 01
src/net.rs + proc.rs
Socket & EStats Poll
STAGE 02
src/etw.rs + dns.rs
Kernel ETW & GeoIP
STAGE 03
src/model.rs + filter.rs
Snapshot Diff & AST
STAGE 04
src/ui/ + actions.rs
Ratatui & SetTcpEntry
[STAGE 01 // src/net.rs · src/proc.rs · src/services.rs]
Calls netstat2::get_sockets_info(AF_INET | AF_INET6, TCP | UDP), queries Win32 GetPerTcpConnectionEStats / GetPerTcp6ConnectionEStats for raw DataBytesOut and DataBytesIn counters, enriches PIDs via sysinfo, and maps Windows Service Control Manager (SCM) services with EnumServicesStatusExW.
SNAPSHOT DIFF ENGINE // src/model.rs

Deterministic State Diffing

merge_snapshots() diffs consecutive socket tables by 5-tuple identity (Proto, LocalAddr:Port, RemoteAddr:Port), preserving first_seen ages and synthesizing ghost rows for closed connections.

+ TCP 192.168.1.111:54902 → 142.250.187.206:443RowChange::New (age: 0s)
~ TCP 192.168.1.111:50144 → 162.159.135.232:443ESTAB → TIME_WAIT
- TCP 192.168.1.111:55104 → 93.184.216.34:443RowChange::Deleted (1 tick)
SECURITY TELEMETRY // src/actions.rs

WinVerifyTrust Authenticode & SCM Unpacking

Inspect any socket to verify its executable's cryptographic signature via Windows WinVerifyTrust, resolve the SID token owner (DOMAIN\User), and unpack shared svchost.exe processes into exact service names.

PID 1420 svchost.exe [Service: Dnscache] Owner : NT AUTHORITY\NETWORK SERVICE Sign : ✔ Signed (Microsoft Windows) Spark : ▁▂▃▅▇█▆▄▂▁▂▄▆█▇▅▃▂ (2m traffic)
KERNEL TRACE // src/etw.rs

Event Tracing for Windows (--etw)

Polling alone misses sub-second connections. With --etw in an elevated shell, tcptui opens a real-time trace session on Microsoft-Windows-Kernel-Network for true connect timestamps and transient connection logging.

[21:14:08.412] ETW CONNECT pid=44910 curl.exe 192.168.1.111:55104 -> 93.184.216.34:443 [21:14:08.609] ETW DISCONNECT (duration 197ms)
DETECTION STUDIO // src/config.rs

Alert Triggers & Wireshark Row Styling

Write any filter expression as an Alert Rule to fire a ⚠ banner, event log entry, and terminal bell on new sockets—or create ordered Coloring Rules with custom foreground, background, bold, and underline styles.

⚠ ALERT: "rport=4444 or rport=1337" Matched: powershell.exe (PID 29104) Style : fg=#ff2e55 bold=true bell=on
03 // STRUCTURED FILTER LANGUAGE & AST PARSER (src/filter.rs)

Test the 17-Field Query Compiler Live.

Supports exact & wildcard matching (*, ?), substring (:), regex (=~, !~), numeric & byte-unit comparisons (>10MB), and nested boolean logic (and, or, not, parentheses).

filter > 7 / 16 MATCHED
TEST QUERIES:
Process PID Proto Local Address:Port Remote Address:Port State SCM Service Tx Bytes Rx Bytes Diff State GeoIP
04 // TACTILE KEYMAP EXPLORER

Interactive Keyboard Deck

Click any highlighted keycap below (or press keys directly on your keyboard) to inspect its binding and trigger it inside the live workstation.

KEY BINDING TELEMETRY
p / P

Pause Live Updates (p) · View Profiles (P)

Pressing p freezes the live endpoint table, statistics, and bandwidth chart for undisturbed inspection while ETW connect events continue buffering in the background. Pressing Shift+P opens the Named View Profiles manager with TOML import/export.

■ Navigation/Filter ■ Views/Popups ■ Socket/Process Action
05A // AUTOMATION & SCRIPTING COMPANION

tcpvcon.exe — CLI Output Formats

Ships alongside tcptui.exe. Supports positional process/PID filtering plus the full structured --filter expression engine in plain table, CSV, or JSON formats. 


      


      
      

        
05B // PERSISTENT PROFILE STUDIO (%APPDATA%\tcptui\config.toml)

        

          

            Live config.toml Synthesizer
          

          
        

        

          Toggle parameters below to generate a ready-to-drop configuration file with custom alert and Wireshark coloring rules.