WTFnet/docs/COMMANDS.md

WTFnet Commands

This document lists CLI commands and supported flags. Output defaults to text; use --json for structured output.

Global flags

• --json / --pretty: emit JSON output (pretty-print if requested)
• --no-color / --quiet: disable ANSI colors / reduce stdout output
• -v / -vv / --verbose: increase log verbosity
• --log-level <error|warn|info|debug|trace>: set log level
• --log-format <text|json>: set log format
• --log-file <path>: write logs to file
• NETTOOL_LOG_FILTER or RUST_LOG can override log filters (ex: maxminddb::decoder=debug)

sys

• sys ifaces: list network interfaces
• sys ip flags: --all (include link-local), --iface <name> (filter by interface)
• sys route flags: --ipv4, --ipv6, --to <ip> (filter by destination)
• sys dns: show DNS configuration

ports

• ports listen flags: --tcp, --udp, --port <n> (filter by port)
• ports who <port>: find owning processes for a port
• ports conns flags: --top <n>, --by-process (summaries)

neigh

• neigh list flags: --ipv4, --ipv6, --iface <name>

cert

• cert roots: list trusted root certificates
• cert baseline <path>: write baseline JSON
• cert diff <path>: diff against baseline JSON

geoip

• geoip lookup <ip>: lookup GeoIP
• geoip status: show GeoIP database status

probe

• probe ping <host> flags: --count <n>, --timeout-ms <n>, --interval-ms <n>, --no-geoip
• probe tcping <host:port> flags: --count <n>, --timeout-ms <n>, --socks5 <url>, --prefer-ipv4, --no-geoip
• probe trace <host> flags: --max-hops <n>, --per-hop <n>, --timeout-ms <n>, --udp, --port <n>, --rdns, --no-geoip

dns

• dns query <domain> <type> flags: --server <ip[:port]>, --transport <udp|tcp|dot|doh>, --tls-name <name>, --socks5 <url>, --prefer-ipv4, --timeout-ms <n>
• dns detect <domain> flags: --servers <csv>, --transport <udp|tcp|dot|doh>, --tls-name <name>, --socks5 <url>, --prefer-ipv4, --repeat <n>, --timeout-ms <n>
• dns watch flags: --duration <Ns|Nms>, --iface <name>, --filter <pattern>
• dns leak status flags: --profile <full-tunnel|proxy-stub|split>, --policy <path>
• dns leak watch flags: --duration <Ns|Nms>, --iface <name>, --profile <full-tunnel|proxy-stub|split>, --policy <path>, --privacy <full|redacted|minimal>, --out <path>, --summary-only, --iface-diag (list capture-capable interfaces)
• dns leak report flags: <path>, --privacy <full|redacted|minimal>

http

• http head|get <url> flags: --timeout-ms <n>, --follow-redirects <n>, --show-headers, --show-body, --max-body-bytes <n>, --http1-only, --http2-only, --http3 (feature http3), --http3-only (feature http3), --geoip, --socks5 <url>

tls

• tls handshake|cert|verify|alpn <host:port> flags: --sni <name>, --alpn <csv>, --timeout-ms <n>, --insecure, --socks5 <url>, --prefer-ipv4, --show-extensions, --ocsp

discover

• discover mdns flags: --duration <Ns|Nms>, --service <type>
• discover ssdp flags: --duration <Ns|Nms>
• discover llmnr flags: --duration <Ns|Nms>, --name <host>
• discover nbns flags: --duration <Ns|Nms>

diag

• diag flags: --out <path>, --bundle <path>, --dns-detect <domain>, --dns-timeout-ms <n>, --dns-repeat <n>

calc

• calc subnet <cidr>|<ip> <mask>
• calc contains <a> <b>
• calc overlap <a> <b>
• calc summarize <cidr...>