Analysis view

The analysis view rewrites the l and i output to make it easier to read: ports get names, your own addresses become me, servers show what they are, and you can rename anything. Switch to it with a, and back to the classic view with a again. It only exists in interactive mode: the CLI mode always prints the classic view.

#17    [veth0]     4.008658  me             -> server             ttl 64  ICMP    64 B  [echo request]
#19    [veth0]     4.322547  me:37647       -> server:DNS         ttl 64  UDP     60 B  [DNS A?]
#20    [veth0]     4.322716  server:DNS         -> me:37647       ttl 64  UDP     53 B  [DNS A 1 answer]
#38    [veth0]     5.298915  me:58732       -> server:HTTPS       ttl 64  UDP   1208 B

(Here 192.0.2.2 was renamed to server with n 192.0.2.2,server. Renamed text is replaced after the columns are laid out, so a line with a renaming can be shifted.)

Port names

Well-known ports show by name: 53 as DNS, 443 as HTTPS, 22 as SSH, 5353 as MDNS, 51820 as WGRD (WireGuard), and about forty more. Every name is five characters wide, so the columns stay aligned. Game ports show as GAME , and i names the game on an Application line (for example Minecraft (Java)).

In i, the port line becomes Ports 58732 -> 443 (HTTPS).

Your own addresses: me

Each address of your machine (the ones M lists) is automatically renamed to me, as a whole address only: 192.0.2.1 doesn't touch 192.0.2.10. n lists them with (own address):

n
127.0.0.1 -> me  (own address)
192.0.2.1 -> me  (own address)
::1 -> me  (own address)
2001:db8::1 -> me  (own address)
fe80::200:5eff:fe00:5301 -> me  (own address)

New addresses (a new temporary IPv6 address, a VPN coming up) are picked up every 30 seconds. To see one address in full again, remove its renaming with n <address>; that lasts until NetOtter quits. A renaming you type for the same text always wins over the automatic one.

Hostnames and applications

NetOtter learns server names by itself, without sending anything, from the traffic it captures:

• DNS answers: when a DNS answer says that example.com is 192.0.2.2, that address gets the name example.com.
• HTTPS (TLS) and HTTP/3 (QUIC): the first message a browser sends to a server names the site it wants (the SNI). NetOtter reads it, including in QUIC, whose first packets it decrypts with public keys. See QUIC.

i shows the learned names:

Packet #19 on [veth0]
  ...
    Ports      37647 -> 53 (DNS)
  ...
  Dest. host   example.com

When a name belongs to a known service, the l line shows its category instead of the port name, and i names the application:

Category	For
SCLNW	social networks and Meta's messengers (Instagram, TikTok, Reddit, WhatsApp...)
GAME	games and game platforms
CHAT	messaging (Discord, Signal, Telegram)
VIDEO	video (YouTube, Twitch, Netflix...)
MUSIC	music (Spotify, Deezer...)

Names are matched on their domain: rr3.sn-abc.googlevideo.com belongs to YouTube. In online mode, addresses that have no name yet get a reverse DNS lookup; see Reverse DNS and privacy.

Renamings

Command	Effect
n 192.0.2.2,server	Shows server wherever 192.0.2.2 appears.
n 192.0.2.2,web	Replaces that renaming.
n 192.0.2.2	Removes it.
n	Lists the renamings.

A renaming replaces plain text, so it can rename anything in the output: an address, a MAC address, a port name, a protocol. When several renamings match at the same place, the longest one wins.

Because it's plain text, n 443,web also changes 4430 into web0, and port numbers inside other numbers. The automatic me renamings don't have this problem: they only match whole addresses.

Renamings are kept in either view but only applied in the analysis view. Your renamings (not the automatic ones) are saved in .nto files.