For a while I've been looking for a tool that can monitor network connections down to individual sockets and with the ability to block or throttle traffic. Since the existing tools I found weren't able to do that I gave it a shot and tried to make my own.

Wächter (or waechter) is divided up into a demon using eBPF and tc for monitoring and controlling traffic and client using imgui for a simple GUI to control the demon. The demon can be connected to both via a unix socket or a web socket if you want to run it on a server and control it remotely. Eventually the goal is to also collect and visualize long term traffic statistics.

So far I was able to test it on Arch Linux with 6.18.3 and Ubuntu 24.04 LTS with 6.8.0. Since eBPF is a bit picky about whether or not it'll load a program depending on the kernel version people are welcome to test it on other setups and report bugs or request features.