windowsill

Passive network monitoring for macOS. See what your machine is doing. No agents, no cloud, no drama.

windowsill just now

Slack → slack.com:443

zoom → us02web.zoom.us:443

node → 185.73.44.2:8443 new

curl → raw.githubusercontent.com:443

How it works

Install the app, approve the system extension, and forget about it. Windowsill watches quietly.

Observe

A system extension watches every network connection your Mac opens. Process name, destination, port. Nothing leaves your machine.

Learn

Snapshot your current connections as a baseline. Windowsill now knows what "normal" looks like for your machine.

Flag

New process talking to an unfamiliar IP? Port that wasn't open yesterday? You'll see it. Yellow dot, not a siren.

Stay out of the way

Menu bar icon, optional dashboard, CLI if you want it. No pop-ups, no notifications unless you ask. It's a windowsill, not a guard dog.

CLI included

For when you'd rather type. sill reads from the same local SQLite database as the app.

terminal

$ sill status connections 23 active 21 known 2 new listeners 8 ports 8 baselined baseline set 3h ago drift detected daemon running

commands

sill connections # list active connections sill listeners # open listening ports sill scan # one-shot scan sill baseline learn # snapshot current state as normal sill baseline status # check for drift sill baseline reset # clear and start over sill daemon run|stop # manage the system extension sill export --format csv # export connection data sill tui # terminal UI (coming)

What it doesn't do

Windowsill is a monitor, not a firewall. It watches and tells you what it sees. That's it.

× Block or filter traffic

× Inspect packet contents

× Phone home or send data anywhere

× Require configuration to start working

MIT licensed. macOS 13+. Free.

github contact