Loading…
Loading…
Host network inventory
outseek inventories, per application, the process names it runs as, the domains it contacts, and the port + protocol used — so you can decide what to steer, bypass, or block.
macOS · Linux · Windows — a single, self-contained binary.
Google Chrome (com.google.Chrome) [macos] processes: Google Chrome, Google Chrome Helper (Renderer) DOMAIN IP PORT PROTO L7 CONFIDENCE www.googleapis.com 142.251.x.x 443 tcp https direct_sni clients4.google.com 142.251.x.x 443 udp quic direct_sni — 34.149.x.x 443 tcp https none Slack (com.tinyspeck.slackmacgap) [macos] processes: Slack, Slack Helper DOMAIN IP PORT PROTO L7 CONFIDENCE wss-primary.slack.com 3.89.x.x 443 tcp https dns_correlated
A socket table gives you a remote IP — never the domain. outseek joins two layers on the host to recover the whole picture.
Reads the kernel socket table to map every live connection to its owning process and application. Cross-platform, and works for your own user with no privilege.
Sniffs DNS answers and TLS/QUIC handshakes and correlates them to flows by IP and PID. On macOS this uses the pktap interface — per-packet process attribution with no kernel extension and no paid signing.
Domains are best-effort and honestly labeled: DoH, Encrypted Client Hello, and CDN-shared IPs are surfaced as such rather than guessed.
Resolves each connection to the real app — folding helper and XPC processes back onto their parent (e.g. every Chrome helper → Google Chrome) and keying identity on the code signature, so updates don't fragment the inventory.
Every process an app runs as, with the executable path and signing identity behind it.
Hostnames are recovered from live DNS answers, TLS ClientHello SNI, and QUIC/HTTP-3 Initial packets — then joined to flows by IP and PID. Never a fabricated domain.
Remote port and L4 protocol (TCP/UDP) for every destination, with a best-effort L7 label (https, quic, dns, ssh…).
Each destination is tagged by how its domain was learned — direct SNI > DNS-correlated > reverse-DNS > IP-only — so you can trust what to act on and see what's encrypted (DoH/ECH).
Per-app destination rollups export to JSON / CSV / Markdown — drop them straight into a Netskope steering or bypass policy. A local dashboard browses the same data.
One binary, a handful of subcommands. Domain capture needs root, so most are shown with sudo; append --help to any command for its flags.
$ sudo outseek openRender a searchable HTML report of everything collected and pop it open in your browser.
$ sudo outseek serve --openLaunch the live local dashboard on 127.0.0.1 and open it — searchable Apps × destinations, refreshing every few seconds.
$ sudo outseek reportPrint the full per-application inventory to the terminal.
$ sudo outseek scanTake a one-off snapshot of current connections now and fold it into the inventory.
$ sudo outseek watchRun the continuous collector (capture + periodic snapshots). The installer registers this as a background service.
$ outseek export -f csvExport the inventory as JSON / CSV / Markdown / HTML for the steering workflow (also -f json|md|html).
$ sudo outseek install --nowInstall + start (or --uninstall) the background collector as a launchd / systemd / Windows service.
$ outseek versionShow the version and whether this build has domain-capture support.
Data lives in a local SQLite database you own. --db <path> points at a specific database; --format json|csv|md|html selects the export shape; --group-domains collapses destinations to their registrable domain (eTLD+1).
Version 0.1.1. Each installer registers a background collector and bundles the command-line tool (outseek scan, report, export, serve).
sudo installer -pkg outseek-0.1.1.pkg -target /
Full domain capture out of the box — pktap, no kernel extension and no signing. Installs the CLI and a background collector.
sudo dpkg -i outseek_0.1.1_amd64.deb # or: sudo rpm -i outseek-0.1.1-1.x86_64.rpm
Installs a systemd service. Connection inventory; domain capture via the capture build (needs libpcap).
Expand-Archive outseek-0.1.1-windows-amd64.zip .\install.ps1
Registers a Windows service. Connection inventory; domain capture via the Npcap capture build.
Capturing domains requires elevated privilege (root / Administrator) — it sniffs DNS and TLS locally. Nothing leaves your machine: outseek writes to a local SQLite database you own. Without elevation it still reports your own user's connections (IP / port / protocol), minus domains.
Checksums: SHA256SUMS