🦊 Netfox 0.20.0 — the server you forgot you started
Hey everyone 👋
Just shipped Netfox 0.20.0 — and this one adds something the app structurally could not do before.
The server you forgot you started 🧟
A test run finishes, you close the terminal, and something it started is still holding port 3000. Netfox couldn't see it — not because it wasn't looking hard enough, but because a server bound to the loopback address isn't on your network at all. It listens to your Mac and nothing else, so no network scan was ever going to find it.
0.20.0 looks in the other direction and tells you when one has been left behind. Not when a server appears — anyone who develops opens and closes those all day, and alerting on that is noise you'd learn to ignore. It waits fifteen minutes from the moment the process was orphaned, not from when the server started, so closing a terminal on something you've used all afternoon doesn't fire it. Off by default, under Alerts.
The hard part wasn't spotting them. It was telling a process nobody is watching apart from one macOS itself started — on a Mac both look the same, both parented to the system. The obvious rule fired on three services out of eight on a test machine, all of them Apple's own (AirPlay, Continuity). That would have been a great way to teach people to dismiss the alert forever.
Which link is actually slow 📶
If your Mac has a cable and Wi-Fi at once, the round trip to your router used to be measured once and labelled with whichever link the Mac happened to be using. So if the Wi-Fi was the thing worrying you, you were reading the cable.
Now each link reports its own. On a Mac Studio here: 0.6 ms on the cable, 2.8 ms on the radio — two numbers that used to be one, and the one you'd have seen was the one you weren't asking about. One link, nothing changes.
And a small one that bugged me 🩹
The weak-signal warning flickered — on and off every couple of seconds, the card resizing each time. Turned out it hit exactly the people it was written for: a signal near the threshold wanders a decibel either way, so it strobed for anyone marginal and sat still for everyone else. Now it turns on at once and stays until the link genuinely recovers, on a row that never changes height.
Free, universal binary, macOS 15.6+, signed and notarized 🦊
https://netfox.app — update via Netfox → Check for Updates…
As always: what would you want to see next?
Replies
the direction change is the whole feature. everyone has open ports, so an open port carries no information on its own. what carries it is that whatever started it has since exited. the case i would want handled is the one i started on purpose this morning, which from outside looks identical to a zombie from last week.
Netfox
@rabnoor_s "looks in the other direction" was the line I liked best in the post, and you've made it carry more than I did... :P
and you've found a real hole, tbh. I went and measured it rather than argue it: a server I detached on purpose reads parent pid 1, my uid, nothing in launchctl — field for field the same as one orphaned last week. intent leaves no trace in the process tree, so it's identical from inside too, which is worse than you put it. and no threshold fixes that: staying up is the whole point of detaching something, so fifteen minutes doesn't cover intent, it just delays the wrong answer.
what's missing is a per-listener "I meant that one" — right now it's on or off for everything. that's the piece, and it's filed
@gfazioli you went and measured it, which is more than i did. if intent leaves no trace in the tree, it has to be recorded at start time, not inferred later
Netfox
@rabnoor_s yep — and that's the version that goes in the issue, not mine...
the catch is the sampling window, though: netfox looks every 60 seconds, so a start time only exists if the parent was still alive when it last looked. that covers your detached server well, since it sits there for hours and gets seen parented at least once. it covers the agent-finishing-a-test case worst --- that whole life can fit inside one minute, and then the first sighting is already an orphan with nothing recorded.... ngl that's backwards: the case the feature was built for is the one hardest to record