---
sidebar_position: 8
title: dialout
---

# dialout

> tcpdump for intent. What is this box dialing, and why?

`dialout` is a live egress monitor that catches every outbound TCP connection in the kernel and groups it by the process that dialed it, flagging connections that leave the private network. The hook sits at `fexit/tcp_connect` — the single protocol-agnostic function where the kernel queues the SYN for both IPv4 and IPv6 — so one probe captures the full four-tuple and process lineage for every connection.

## Running

```sh
yeet run github:yeet-src/dialout
```

Sort and filter:

```sh
yeet run github:yeet-src/dialout -- --sort dials                             # most-dialed first
yeet run github:yeet-src/dialout -- --once --secs 5 | less -R               # 5-second snapshot
yeet run github:yeet-src/dialout/dump.js | jq -c 'select(.public)'          # NDJSON, public only
```

## Source

[`yeet-src/dialout`](https://github.com/yeet-src/dialout) on GitHub.