NetSynth captures live network traffic (or reads pcap files), classifies packets by protocol, and synthesizes an ambient MP3 soundscape where each traffic type produces a distinct harmonic drone. A ping sounds different from HTTPS noise, which sounds different from a port scan.
Run it, let it listen, press Ctrl+C, get an audio fingerprint of your network.
## Quick Start
```bash
# Live capture on eth0 (requires root or CAP_NET_RAW)
sudo netsynth -i eth0
# Press Ctrl+C after a few seconds → saves netsynth-<timestamp>.mp3
NetSynth supports TOML config files to override the default sound mappings per traffic class. You can change the frequency and waveform for any class without affecting the others.
### Config File Discovery
NetSynth looks for config files in this order (first found wins):
1.`--config <path>` flag (error if file does not exist)
2.`./netsynth.toml` in the current working directory
3.`~/.config/netsynth/config.toml`
If no config is found, NetSynth starts silently with built-in defaults.
### Config File Format
```toml
# Override sound settings per traffic class.
# Only the fields you set are changed — everything else keeps its default.
[sounds.ICMP]
frequency=80.0# Hz (default: 65.0)
waveform="triangle"# sine, square, sawtooth, or triangle
1.**Capture** — Packets are read from a live interface (via [go-pcap](https://github.com/packetcap/go-pcap)) or a pcap file. Optional BPF filtering reduces the stream to traffic of interest.
2.**Classify** — Each packet is matched against 12 protocol rules (ICMP, DNS, HTTPS, SSH, HTTP, SMTP, NTP, DHCP, etc.). Unrecognized traffic is deterministically hash-bucketed into 4 "unknown" classes so it still produces distinct sounds.
3.**Aggregate** — Classified packets are grouped into 500ms time windows. Each window records per-protocol packet counts that drive synthesis amplitudes.
4.**Synthesize & Encode** — Each traffic class maps to an oscillator at a specific frequency, waveform, and stereo position. Amplitudes rise and fall via EMA smoothing based on traffic volume. All layers are mixed and encoded to MP3 via [LAME](https://github.com/sjzar/go-lame).
Sustained traffic sounds louder; quiet periods fade to silence. The result is a unique audio fingerprint of your network activity. All frequencies and waveforms can be overridden via the [config file](#custom-sound-configuration).
