Rewind is a modern debugging and monitoring tool designed to provide deep insight into network activity. It utilizes a decoupled architecture where a high-performance C++ capture agent built on PcapPlusPlus handles raw packet capture and HTTP reassembly, while a Bun/SvelteKit stack delivers a real-time, interactive web experience.

• In-Browser Capture Terminal - Start/stop/restart the C++ capture agent directly from the web UI via WebSocket
• Real-time Traffic Metrics - Live status polling every 2s for uptime, PID, and crash detection
• PII Sanitization - Automatic anonymization of sensitive data during capture
• Capture Filters - Regex-based host and URI pattern matching to selectively capture traffic

• RQL (Rewind Query Language) - Custom query language for filtering sessions with expressions like method == "GET" AND status >= 400
• Simple Search - Quick text-based filtering by method, URI, IP, and status
• Advanced Filters - UI-based filtering by HTTP method and status range

• Alert Rules - Custom rules based on status codes, response times, methods, URL patterns
• Multi-Channel Notifications - Dispatch alerts to Email, Slack, and Discord simultaneously
• Cooldown System - Configurable cooldown periods to prevent notification spam

• HAR Export - Export captures in HAR 1.2 format for Chrome DevTools and Postman
• JSON/CSV Export - Export session data in JSON or CSV format
• SDK & CLI - TypeScript client library and CLI tool for programmatic access
• Request Replay - Re-send captured HTTP requests with one click

• Capture Runs - Sessions grouped by capture session with duration and session counts
• Per-Capture Export - Export all sessions from a specific capture run

graph TD
    FE["Frontend<br/><small>SvelteKit + Svelte 5</small><br/><small>:5173</small>"]
    BE["Backend API<br/><small>Bun + Elysia</small><br/><small>:8000</small>"]
    CA["C++ Capture Agent<br/><small>PcapPlusPlus</small>"]
    DB["MongoDB<br/><small>Sessions, Alerts, Notifications</small>"]
    NOTIFY["Notification Channels"]
    EMAIL["Email<br/><small>SMTP</small>"]
    SLACK["Slack<br/><small>Webhook</small>"]
    DISCORD["Discord<br/><small>Webhook</small>"]

    FE <-->|"HTTP / WebSocket"| BE
    BE <-->|"Process I/O"| CA
    BE <--> DB
    BE --> NOTIFY
    NOTIFY --> EMAIL
    NOTIFY --> SLACK
    NOTIFY --> DISCORD

    style FE fill:#ff3e00,color:#fff
    style BE fill:#5e165d,color:#fff
    style CA fill:#00599c,color:#fff
    style DB fill:#47a248,color:#fff

• Bun 1.0+
• MongoDB 7.x
• C++ Build Tools (for capture agent)
• Administrator/sudo access (for packet capture)

git clone https://github.com/sreekarnv/rewind.git
cd rewind
bun install

Build the capture agent:

cd services/capture-agent
build.bat    # Windows
make         # Linux/macOS

Terminal 1 (Backend - needs admin for capture):

cd services/backend-api
sudo bun run dev

Terminal 2 (Frontend):

cd services/frontend
bun run dev

Open http://localhost:5173

Query sessions with expressive filters in the frontend search bar (RQL mode) or via the CLI/SDK.

method == "GET" AND status >= 400
uri contains "/api" AND ip.src == "192.168.1.0/24"
status == 5xx OR response_time > 2000
NOT method == "OPTIONS"
host startswith "api."
port.dst == 443

Fields: method, status, uri, host, ip.src, ip.dst, port.src, port.dst, timestamp

Operators: ==, !=, >, <, >=, <=, contains, matches, startswith

Logical: AND, OR, NOT

Special values: Status ranges (2xx, 5xx), CIDR notation (192.168.1.0/24), durations

The @rewind/sdk package provides a TypeScript client library and CLI for interacting with a running Rewind backend.

cd packages/sdk

bun run src/cli.ts sessions list                    # list captured sessions
bun run src/cli.ts sessions list --limit 50         # with pagination
bun run src/cli.ts sessions get <session-id>        # session details
bun run src/cli.ts sessions export -o out.json      # export to file
bun run src/cli.ts sessions export -q 'status>=400' # export filtered
bun run src/cli.ts sessions clear                   # clear all sessions

bun run src/cli.ts query 'method == "POST"'         # RQL query
bun run src/cli.ts query 'status == 5xx' -f json    # output as JSON

bun run src/cli.ts capture status                   # agent status
bun run src/cli.ts capture start                    # start agent
bun run src/cli.ts capture stop                     # stop agent
bun run src/cli.ts capture restart                  # restart agent

bun run src/cli.ts alerts list                      # list alert rules
bun run src/cli.ts alerts toggle <id>               # enable/disable rule
bun run src/cli.ts alerts delete <id>               # delete rule

bun run src/cli.ts stats                            # traffic statistics
bun run src/cli.ts health                           # backend health check

bun run src/cli.ts config show                      # show CLI config
bun run src/cli.ts config set url http://host:8000  # change backend URL

import { RewindClient } from '@rewind/sdk';

const client = new RewindClient({ baseUrl: 'http://localhost:8000' });

const { sessions, total } = await client.sessions.list({ limit: 50 });
const { sessions: filtered } = await client.sessions.query('status >= 400');
const status = await client.capture.status();
const { rules } = await client.alerts.list();
const stats = await client.stats();

Create .env in services/backend-api/:

PORT=8000
MONGODB_URI=mongodb://localhost:27017/rewind
DATA_DIR=../capture-agent/output

# Email (optional)
EMAIL_ENABLED=true
EMAIL_SMTP_HOST=smtp.gmail.com
EMAIL_SMTP_PORT=587
EMAIL_SMTP_USER=your-email@gmail.com
EMAIL_SMTP_PASS=your-app-password
EMAIL_RECIPIENT=admin@example.com

# Slack (optional)
SLACK_WEBHOOK_URL=https://hooks.slack.com/services/...

# Discord (optional)
DISCORD_WEBHOOK_URL=https://discord.com/api/webhooks/...

FRONTEND_URL=http://localhost:5173

Configure in services/capture-agent/config/config.yaml:

filters:
  host_patterns:
    - "api\\.example\\.com"
    - ".*\\.internal\\.net"
  uri_patterns:
    - "/api/.*"
    - "/health"

• User Guide
• Developer Guide
• Email Setup Guide
• Metrics

Run docs locally:

cd docs && bun install && bun run dev

MIT - see LICENSE