Netscrew is one small command, n. It diagnoses a host, audits what this machine is listening on, mounts and benchmarks shares, checks SSH and RDP readiness, finds ghost IPs and stale name caches — and every time, it shows you the real command it ran and explains what the result means.
Every one of these is a real afternoon lost. Netscrew doesn't hide the underlying tools — it runs them for you, shows you the exact command, and tells you what the answer means.
×A file copy is slow. You try a different cable, reboot the router, blame the NAS, and never actually find out.
n bench //nas/media✓Six phases: the link and its ceiling, what SMB negotiated, small-file latency, cache-defeated throughput, your own disk as the baseline — and a verdict that names the limiter and clears what isn't. How it works →
ss -tulpn vs netstat -ano vs lsof -i vs Get-NetTCPConnection×Four tools, four output formats, three operating systems, and you still have to look up the process name by PID.
n listen . n estab . n kill 8080✓Same words on every OS. Listening sockets with the process and the container that owns them; established connections; kill what's on a port (it asks first).
×mount -t cifs fails to resolve the name, then succeeds as root so you can't write, then vanishes at reboot. Three separate traps, no explanation.
n mount //White/D✓Resolves the host on every layer before asking for sudo, explains the two permission layers, shows the exact mount line, and gives you the fstab recipe with nofail so a missing server never blocks boot.
×The name resolves to yesterday's address from one of five caches (hosts file, DNS, mDNS, NetBIOS, the Samba cache) and nobody can tell you which.
n resolve nas✓Asks all five layers, shows what each one answers, flags the disagreement, and tells you which cache to flush — n flush . does it, with a warning first.
×Windows OpenSSH has an administrators_authorized_keys file nobody tells you about; RDP silently rejects passwordless and Microsoft-account logins. Hours.
n ssh-server . n rdp . n ssh-copy-id host✓Readiness checks that know the Windows gotchas by name, with --fix where it's safe, and a key installer that works on Windows too.
Every command follows the same grammar, so once you've used one you can use them all. Type a command on its own and you get its usage card — not a wall of theory.
n portsThe command alone shows a short usage card: the forms, the options, an example. Add -h for the concept behind it.
n ports .The dot means this machine (so do me and localhost). No flags to remember for "local".
n ports nasA name or address means a remote host. Netscrew resolves it on every layer and prefers your LAN over a VPN route — and says so.
Each name links to the exact usage card and guide the tool prints — the reference is generated from the binary, so it can't drift.
Reachability, latency, the MAC and vendor, open ports and web UIs — for one host or a whole subnet. The 5-layer name-resolution audit finds the ghost IP.
What's listening, what's connected, which process and which container owns it, and a port killer that asks before it acts.
Hardware and OS inventory, services, containers, the busiest remote IPs, stalled sockets, NIC drops, firewall status with a hardening plan, cache flush, LAN discoverability — with --fix where it's safe.
Audit shares, mounts and permissions (including the UAC mapped-drive trap); mount a share on any OS with the real command shown; see what this machine exports, or export a folder; and benchmark it properly.
Is this machine ready to accept SSH? Is the agent holding your keys? Install your key on a host (Windows included), open a port-forward that's explained as it runs, and check RDP readiness.
Nine playbooks live inside the binary — n -h uac-shares works on a plane. The same text is published here, and n guide export writes it all as HTML.
These are from the machines netscrew is built on. In each case the number alone would have been useless; the explanation is the product.
A share on an old 2-core HP Microserver served files at 12 MB/s on a clean gigabit LAN. n bench cleared the wire, MTU, signing and VPN, saw 26 ms per file against 2.5 ms of round trips, and said the time is spent on the server. n bench . on the server then said exactly why.
Windows PCs answer to their name over NetBIOS, which Linux doesn't speak by default. The usual tool tells you "could not resolve address" after sudo, the password and a stray mount point. Netscrew asks every layer first.
Typing a Windows path on Linux silently loses its backslashes — bash reads \D as an escape. Most tools report a nonsense path. This one says whose fault it is.
Netscrew speaks a raw SMB2 NEGOTIATE to port 445 — the first packet any client sends — so it needs no mount, no password and no admin rights, and works against Windows, Samba or a NAS. It found that a Windows 11 box now requires signing, that an SSD sat behind the share, and that SMB1 was properly off.
Netscrew started as one person's notes on which incantation to use on which OS. It became a tool the moment those notes started printing why — why a mapped drive vanishes in an admin window, why a Linux CIFS mount is owned by root, why a share is slow when the wire isn't.
The rule that shaped everything: never be a black box. If it runs a command, it shows you the command. If it changes something, it asks first and tells you how to undo it. If it guesses, it says it's guessing.
Netscrew audits and hardens machines you own. It will scan your subnet, plan your firewall, and tell you SMB1 is still on. It is not a penetration-testing toolkit and doesn't try to be one.
Every mount, tunnel, flush and fix prints the exact line it runs, so you learn the tool underneath — and can do it by hand next time.
n <command> is a practical usage card. n <command> -h is the concept: the theory, the traps, the playbook. Never a wall of text when you just wanted the syntax.
Benchmarks print their round-to-round spread and say "rerun" when it's high. Diagnoses label inference as inference. Unanswered pings say "skipped", not "fine".
Killing a process, flushing caches, writing to someone's share, changing a registry policy: each one names its impact and waits for you.
No account, no telemetry, no update checks. The one network request it can ever make on its own behalf is activating a licence key, once, if you buy one.
Standard library only, no runtime, no installer. The same words on Windows, Linux and macOS; the OS-specific work happens underneath.
The installer scripts do exactly one thing each — download the right static binary and put it on your PATH — and say so at the top of the script. Read them first if you like; they're short.
irm https://netscrew.dev/install.ps1 | iex
Puts n.exe in %LOCALAPPDATA%\netscrew and adds it to your user PATH. SmartScreen may ask once — the binary isn't code-signed yet.
curl -fsSL https://netscrew.dev/install.sh | sh
Puts n in ~/.local/bin. On macOS, Gatekeeper may need xattr -d com.apple.quarantine ~/.local/bin/n once.
Then type n. The front page lists every command; n check . is a good first run.
Everything that finds a problem and explains it is free. Pro removes the coffee message and unlocks the features that act on what was found. Exactly what unlocks →
--full--fix for host, RDP and SSH server; firewall --harden; mount --persistn license remove frees a seatPersonal use. 14-day refund, no questions.
--json, --quiet for cron/CI, fleet reports across a hosts listPayments by Lemon Squeezy, merchant of record.