Quick start
lens-net
lens-net --once
lens-net --plain
lens-net --filter 443
lens-net --jsonThe interactive view samples interface counters once a second and charts current receive and transmit activity without pausing navigation. Wide terminals show separate RX and TX history charts; compact terminals keep the current rates on one line. The list groups interfaces, routes, listeners and cellular modems. Press Enter on an interface to see its own current rates.
Reading the network view
| Row type | What it answers | Important fields |
|---|---|---|
| Interface | Which local links are up, what addresses do they have and are they moving traffic? | Name, state, IPv4/IPv6 addresses, received/transmitted bytes and live rates |
| Route | Where will traffic to a destination go? | Destination, gateway, interface and native route text |
| Listener | Which local ports accept connections, and who owns them? | Protocol, local address/port, state and owner |
| Cellular modem | Is the modem registered and which radio/operator/SIM is active? | State, network, access technology, signal and SIM |
The activity charts show byte-rate deltas from operating-system interface counters; they begin after the second sample. A listener bound to 127.0.0.1 is local to the host. A listener on 0.0.0.0, :: or * accepts traffic on every applicable local interface, subject to firewall and network policy. Lens reports the bind state; it does not claim that an external path is reachable.
Common investigations
The device has an address but cannot reach the internet
Open the active interface, then look for a default route. A missing default route is raised in Health. If both exist, use the diagnostic shell for a deliberate reachability or DNS check while keeping the route view visible.
A port is unexpectedly open
lens-net --filter 1883
lens-top --filter-name mosquittoInspect the listener's bind address and owner. Where the operating system exposes a PID, Lens links it to the process and inferred service. Restricted owner information is shown as unavailable rather than guessed.
A physical interface is down
Confirm whether the interface is expected to carry traffic. Lens health avoids treating common unused virtual interfaces as failures, but an intentionally disconnected or administratively disabled physical link still needs operator context.
The route exists but uses the wrong interface
Open the route detail and compare destination, gateway and interface. Lens keeps the platform's native route text so metric or route-specific detail remains visible when it cannot be normalized.
4G/5G modems and SIM cards on Linux
Lens queries ModemManager's standard D-Bus-backed command interface. Each detected modem can include manufacturer, model, registration state, radio technologies such as LTE or 5G NR, signal quality, operator code/name and the active SIM.
SIM identifiers are sensitive inventory data. Interactive and plain output mask ICCIDs; deliberate JSON output retains the full collected value. Treat exported snapshots accordingly.
ModemManager keeps modem and SIM reporting consistent across supported hardware. Collection warnings identify service, command or permission problems separately from a successful empty inventory.
Interaction
Filters and output
# Find a port, address, interface or owner
lens-net --plain --filter 443
# Export the complete network inventory
lens-net --json --limit 0The default limit is 1,000 rows. JSON separates interfaces, routes, sockets and cellular_modems, with cumulative rx_bytes and tx_bytes on interfaces and relationships back to owning processes and services where known. Live rates and charts are calculated from successive interactive samples rather than written into a one-shot snapshot.
Linux and macOS sources
Linux
Lens uses standard Linux networking facilities and commands for links, addresses, routes and sockets, and ModemManager for cellular state. Owner visibility follows kernel interfaces and user permissions.
macOS
Lens reads native interface, route and listening-socket data. Use the diagnostic shell for focused native network commands while keeping the live view visible.
When network data is incomplete
Missing commands, permission restrictions and timeouts appear in collection_warnings. A blank owner means ownership could not be resolved; it does not mean no process owns the socket. An empty modem list with a ModemManager warning means collection was unavailable, not that the hardware is absent.