Reading local network state — interfaces & sockets

On Linux, SubnetSlinger can read a lot about your own machine straight from the kernel — no extra tools, no root. Two capabilities surface this, both available to the Deputy (the built-in AI assistant) and used across the app.

What they are / when you'd use them:

• Local interfaces — every network interface with live counters: bytes and packets sent/received, errors, drops, link speed, MTU, MAC address, up/down state, and your default route. Use it to answer "is this NIC actually passing traffic, and how fast is the link?" without SNMP or a switch login.
• Local sockets — what your machine is listening on (TCP and UDP ports) and its active connections, tagged with the owning process (pid/name) where it's visible. Use it for "what's exposed on this box, and which program opened it?" and "who is this host talking to right now?"
• Local routes — the routing table (destinations, gateways, interfaces, metrics; IPv4 and IPv6). Use it for "which way does traffic to that subnet actually go?"

The basics: ask the Deputy ("show my local interfaces", "what ports am I listening on?", "show my routing table") or read them where the app surfaces them. The output is plain and labeled.

Going deeper — where it comes from: on Linux these read directly from the kernel's own files, which is why they're fast and need no privileges:

• Interfaces: /proc/net/dev (counters) enriched by /sys/class/net/<iface>/ (speed, MTU, MAC, operstate).
• Routes (default route and the full routing table): /proc/net/route (IPv4) and /proc/net/ipv6_route (IPv6).
• Sockets: /proc/net/tcp, tcp6, udp, and udp6 (owning process resolved via /proc/<pid>/fd for your own processes).

These are the same sources the classic `ip`, `ss`, and `netstat` commands read — so if you want to cross-check, `ip -s link`, `ss -tulnp`, and `ip route` should line up with what the app shows. On Windows and macOS the same features fall back to the OS's standard network APIs, so the tools exist everywhere; Linux is just where they read closest to the metal.

Good to know: counters are cumulative since the interface came up, not a rate — to see throughput, look at how they change over time. A socket listening on 0.0.0.0 is reachable from any interface; 127.0.0.1 is local-only. If a number looks surprising, check the underlying /proc file directly — it's the same data, and it settles most arguments.