<<<<<<< HEAD

kmon — Krypton network monitor

A live packet-capture network monitor written in Krypton, with a PySide6 desktop frontend and a self-contained browser dashboard.

Plans are for this to become a netowork monitor, names kmon or krypton monitor. Below is the current state, this is purely a passtime at this point, unless I get contributers it is a side project.

eb8f601c2b54fa106deb1778d9e9f5e0391bea56

Krypton 2.0 compatible. kmon is a long-running process — exactly the kind of program 2.0's mark-sweep GC + freelist reuse was built for. Call gcCollect() at the end of each event-pump cycle to keep memory bounded.

What ships

• kmon.exe — Krypton-built backend that captures packets via wpcap.dll (Npcap), parses IPv4/TCP/UDP/ICMP, and serves a JSON event stream over two transports:
  • HTTP/SSE on :8080 — for the browser dashboard at kmon_ui.html
  • TCP line-JSON on :9090 — for the PySide6 desktop frontend
• kmon_scanner.exe — companion port-scanner tool
• frontend/ — PySide6 GUI client that connects to the TCP transport
• kmon_ui.html — single-file dashboard served by the HTTP transport (open http://localhost:8080/ in any modern browser)

Status

Hobby project — usable for live packet inspection on a single interface, basic protocol breakdown (IPv4 / TCP / UDP / ICMP), and top-talker stats. Not a Wireshark replacement; capture-and-display only. Scanner emits a one-shot port report.

Build

Requires:

• Windows 10 / 11
• The Krypton 2.0 repo cloned to ..\krypton (sibling directory)
• Npcap installed (Packet.dll, wpcap.dll — bundled in this repo)
• TDM-GCC or another MinGW toolchain (the cfunc blocks for winsock and pcap need a C compiler)

build.bat

Produces kmon.exe and kmon_scanner.exe plus a freshly-copied krypton_rt.dll from ..\krypton\runtime\.

Run

Backend (needs administrator for raw packet capture):

kmon.exe <interface-name>

Then either:

• Browser: open http://localhost:8080/
• Desktop: cd frontend && python run_kmon.py

Source layout

• run.k — main entry; spawns capture, both servers, the event pump
• kmon_cap.k — Npcap binding + per-packet parse loop (cfunc body)
• kmon_http.k — HTTP server + SSE broadcaster (cfunc, winsock2)
• kmon_tcp.k — line-JSON TCP server (cfunc, winsock2)
• kmon_scanner.k — standalone port scanner
• parser.k — IPv4 / TCP / UDP / ICMP header parsers (Krypton-side)
• protocol.k — protocol number / port name lookups
• stats.k — top-talker counters, per-protocol byte tallies
• util.k / kmon_utils.k — formatting, IP→string, etc.
• frontend/ — PySide6 GUI

The Krypton source uses cfunc { } blocks for the OS bindings (winsock2 and Npcap) and pure Krypton for the protocol parsing and event-stream construction.

License

MIT — see LICENSE.