Command reference
Every command, exactly as the tool prints it
This page is generated from the binary, so it can't drift. n <command> shows the usage card; n <command> -h the concept behind it; n <command> . runs it against this machine and n <command> <host> against a remote one.
The front page — n
═══════════════════════════════════════════════════════════════════════════════
Netscrew ("n") — The Developer's Network Screwdriver & Diagnostic Engine
═══════════════════════════════════════════════════════════════════════════════
Sleuth and harden your own machines & LAN — find out what's really going on, and fix it,
without memorising every ss / netstat / nmap / netsh switch.
THE MODEL: n <command> = how to use it · n <command> . = this machine · n <command> <host> = a remote host
Every command has a short form — n ping=n pi, n ports=n p, n services=n svc. Run n <command> to see its short forms.
DIAGNOSE A HOST / NETWORK:
n check .|<host> full check: reachability, latency, MAC, ports, web
n ping .|<host> fast reachability radar / who-am-I
n resolve <host> 5-layer name-resolution audit (stale ghost IPs)
n web .|<host> discover web UIs & dashboards (clickable)
n ports .|<host> local listeners, or a remote port audit
n scan .|<cidr> sweep a subnet for live devices
LOCAL SOCKETS & PROCESSES:
n listen . listening sockets (+ process & container)
n estab . established connections
n all . all sockets (listening + established + UDP)
n kill <port> kill the process listening on a port (asks first)
THIS MACHINE:
n sys . hardware / OS / disk inventory
n services . service & daemon inventory
n docker . containers & published ports
n top . busiest remote IPs (who's connected)
n choked . stalled / backed-up sockets
n drops . NIC dropped-packet audit
n firewall . firewall status · n firewall . --harden build a plan
n flush . deep cache flush (asks first)
n host . LAN discoverability · n host . --fix repair it
STORAGE & SHARES:
n shares . audit shares, mounts, permissions & UAC status
n mount //host/share mount a share (SMB/CIFS) — any OS, shows the real command
n share . what this machine shares · n share <folder> to export one
n bench //host/share how fast is it, and WHY — link, protocol, then throughput
SSH & REMOTE ACCESS:
n ssh-server . is this machine set up to accept SSH?
n ssh-agent . agent status / load your keys
n ssh-copy-id <host> install your key for passwordless login (Windows too)
n tunnel <host> <spec> SSH port-forward, explained as it runs
n rdp .|<host> Remote Desktop readiness (local) or reachability (remote)
DOCS:
n guide [topic] built-in playbooks · n guide export to write HTML
n license <key> $5 removes the coffee message — nothing else changes · n license status
GLOBAL FLAGS: --yes -y skip prompts · --probe public hosts · --full wide audit · --no-sudo
───────────────────────────────────────────────────────────────────────────────
Help: n <command> = usage (with its short forms) · n <command> -h = the concept · n -h = all playbooks
Target: . = this machine (= me, localhost, 127.0.0.1) · <host> = a remote IP/name
Commands
| command | short forms | what it does |
|---|---|---|
n check | c ch chk health diag diagnostics triage | Diagnostic triage ladder or target health check |
n ping | pi radar | Fast reachability radar (<300ms) or Who Am I loopback |
n resolve | r res resolv lookup ns | 5-layer name cache debugger & ghost IP detection |
n web | w we ui dashboards | Web services & dashboards discovery (local or remote) |
n ports | p po port | Port inspection (local listening or remote target ports) |
n scan | sc sweep subnet | Subnet network scanner |
n flush | f fl flush-dns flush-cache | Deep DNS/NetBIOS/ARP/Samba cache flush |
n host | h ho visibility discover | LAN discoverability audit |
n sys | sy sysinfo system hardware | Hardware, OS, storage & system inventory |
n docker | d dock containers ps | Docker containers and published port mapping |
n listen | l lis listening sl | List listening ports with process names |
n estab | e es established active | List active established connections |
n all | a sa | Master socket view (listening + established) |
n kill | k kil | Kill process bound to port |
n services | se svc service daemons | Service & daemon inventory |
n firewall | fw fir ufw iptables | Firewall rules & port blocking audit |
n top | t top-ips conns topconns | Top remote IPs by active connections |
n choked | chok backlog stalled | Stalled socket detection |
n drops | dr errors rx-errors link-health | Packet drops & CRC framing errors |
n guide | g gui doc docs playbook playbooks kb | Interactive engineering playbooks, offline documentation & HTML export |
n shares | sh smb nfs mounts | Network storage, SMB/Samba shares, permissions & remote mounts |
n mount | map cifs mnt | Mount a network share (SMB/CIFS) — cross-platform, hides the syntax |
n share | export serve | Share (export) a local folder over SMB — the recipe for your OS |
n bench | b be bm speed speedtest | How fast is a share or host — and WHY: path, protocol, then throughput |
n license | lic activate unlock | Activate a licence key — removes the coffee message. That is all it changes |
n rdp | remotedesktop mstsc | Remote Desktop readiness check & repair (local or remote) |
n ssh-copy-id | copy-id ssh-copy pushkey authkey | Install your SSH key on a host for passwordless login (works on Windows too) |
n ssh-server | sshd ssh-srv sshserver | Check & repair this machine's SSH server (sshd) — Windows gotchas included |
n ssh-agent | agent ssh-add | SSH agent status & load your keys (starts the Windows agent service) |
n tunnel | forward port-forward proxy | SSH port forwarding made easy (-L / -R / -D), explained as it runs |