www.github.com/m10ust/nethtop.git What you do from the tool 1. Enumerate all ghost sockets and see where they are connected and status 2. Can start a pcap capture or any single connection 3. Can trace and resolve any single connection 4. Can dump entire session and export. 5. Auto pf rule creation from the ghost sockets overlay 6. Kill process associated with any connection 7. Bypass system hooks by APTs, monitoring at the kernel level