<!--startmeta
custom_edit_url: "https://github.com/netdata/netdata/edit/master/src/go/plugin/go.d/collector/snmp/npm-catalog/integrations/live_network_connections.md"
meta_yaml: "https://github.com/netdata/netdata/edit/master/src/go/plugin/go.d/collector/snmp/npm-catalog/metadata.yaml"
sidebar_label: "Live Network Connections"
learn_status: "Published"
learn_rel_path: "Network Performance Monitoring/Topologies/Integrations"
keywords: ['network connections', 'sockets', 'processes', 'containers', 'kubernetes', 'dependencies', 'topology', 'live', 'npm']
message: "DO NOT EDIT THIS FILE DIRECTLY, IT IS GENERATED BY THE NPM CATALOG metadata.yaml FILE"
endmeta-->

<!-- markdownlint-disable-file -->

# Live Network Connections


<img src="https://netdata.cloud/img/network.svg" width="150"/>


Plugin: network-viewer.plugin
Module: network-viewer

<img src="https://img.shields.io/badge/maintained%20by-Netdata-%2300ab44" />

## Overview

Map application dependencies on a host. The network-viewer plugin reads the kernel's live socket table and draws which local process talks to which, and which remote endpoints they reach. On Linux it also attributes each process to the container, image, systemd unit, or Kubernetes pod, namespace, and workload that owns it, as far as the APPS_LOOKUP data allows — attribution is best effort, and a process it cannot resolve is still drawn.

The network-viewer plugin builds the `topology:network-connections` view directly from the host's live socket table, with no SNMP and no instrumentation. It is available on Linux, FreeBSD, and macOS; container and Kubernetes attribution is Linux-only.

This integration is only supported on the following platforms:

- Linux
- FreeBSD
- macOS

This integration runs as a single instance per Netdata Agent.

The plugin needs privileged access to enumerate the sockets of every process; standard installations grant it. In a container it additionally needs the host network namespace, the host `/proc`, `SYS_ADMIN` for sibling containers, and `SYS_PTRACE` to attribute connections to processes. On macOS a non-privileged or TCC-restricted run omits protected processes; grant Full Disk Access where local policy requires it. The Function itself requires a signed-in Netdata identity in the same Space with permission to view sensitive data — it is not available anonymously.

### Default Behavior

#### Auto-Detection

Always on; observes the host's live network connections.

#### Limits

A single response is capped at 64 MiB. On a host with enough connections to exceed that, the request is aborted rather than truncated — group the map (by process name or container) to bring it back under the cap.

#### Performance Impact

Sockets are enumerated when the Function is called, not continuously in the background, so the cost is paid per request and scales with the number of open sockets and processes.

## Setup


### Prerequisites

#### Privileged access to the socket tables

The plugin needs its normal privileged permissions to enumerate the sockets of every process. Standard installations grant these. A container needs the host network namespace and the host `/proc` to see anything beyond its own sockets, `SYS_ADMIN` to reach sibling containers' connections, and `SYS_PTRACE` to attribute connections to processes — without `SYS_PTRACE` the connections are still listed but not tied to the processes that own them. On macOS, a non-privileged or TCC-restricted run silently omits protected processes.


### Configuration

#### Options

The Function is always available and needs no setup. The only setting is the size of the per-PID APPS_LOOKUP cache, which holds the cgroup identity already resolved for each process; raising it does not make more processes resolvable, it only keeps more resolved ones cached.

<details open><summary>Config options</summary>



| Option | Description | Default | Required |
|:-----|:------------|:--------|:---------:|
| apps lookup cache size | Maximum number of per-PID APPS_LOOKUP cache entries kept by network-viewer.plugin. | 8192 | no |


</details>



#### via File

The configuration file name for this integration is `netdata.conf`.
Configuration for this specific integration is located in the `[plugin:network-viewer]` section within that file.

The file format is a modified INI syntax. The general structure is:

```ini
[section1]
    option1 = some value
    option2 = some other value

[section2]
    option3 = some third value
```
You can edit the configuration file using the [`edit-config`](https://github.com/netdata/netdata/blob/master/docs/netdata-agent/configuration/README.md#edit-configuration-files) script from the
Netdata [config directory](https://github.com/netdata/netdata/blob/master/docs/netdata-agent/configuration/README.md#locate-your-config-directory).

```bash
cd /etc/netdata 2>/dev/null || cd /opt/netdata/etc/netdata
sudo ./edit-config netdata.conf
```

##### Examples
There are no configuration examples.



## Alerts

There are no alerts configured by default for this integration.



## Metrics
