Detect interfaces per platform; add macOS and single-interface support (closes #2)

Linux runs exactly as before when both bridge interfaces exist. When they do
not, the lone default-route interface is monitored, and a single interface
draws a single UI pane instead of an empty second one.

macOS is newly supported: a running VPN tunnel (utun) is monitored as the
primary pane alongside the physical default-route interface, or the physical
interface alone when no VPN is up.

Detection lives in internal/netdetect: interface/route data types, pure
selection logic keyed on OS name, and route parsers, all unit-tested on Linux
for both platforms. Only the real route query and the per-platform TCP dial
binding are build-tagged. NewMonitor now takes a list of interfaces.

Not verified on a real mac: live netstat parsing, IP_BOUND_IF dialing, Mullvad leak protection.

Model: opus-4-8 (implementation); fable-5-1 (landing commit)

internal/monitor/dial_darwin.go

@@ -0,0 +1,36 @@
+//go:build darwin
+
+package monitor
+
+import (
+	"net"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+// bindControl returns a socket control hook that pins the connection to the
+// given interface with IP_BOUND_IF. On macOS a bound source address is not
+// enough: without this the kernel still routes the packets over the VPN's
+// default route, so traffic would not leave the interface we are measuring.
+func bindControl(iface string) func(network, address string, c syscall.RawConn) error {
+	ifi, err := net.InterfaceByName(iface)
+	if err != nil {
+		return nil
+	}
+
+	idx := ifi.Index
+
+	return func(_, _ string, c syscall.RawConn) error {
+		var setErr error
+
+		ctrlErr := c.Control(func(fd uintptr) {
+			setErr = unix.SetsockoptInt(int(fd), unix.IPPROTO_IP, unix.IP_BOUND_IF, idx)
+		})
+		if ctrlErr != nil {
+			return ctrlErr
+		}
+
+		return setErr
+	}
+}

internal/monitor/dial_linux.go

@@ -0,0 +1,12 @@
+//go:build linux
+
+package monitor
+
+import "syscall"
+
+// bindControl returns no socket control hook on Linux: binding the dialer's
+// local source address (as tcpDuration already does) is enough to send
+// traffic out of the chosen interface.
+func bindControl(_ string) func(network, address string, c syscall.RawConn) error {
+	return nil
+}

internal/monitor/export_test.go

@@ -1,5 +1,3 @@
-//go:build linux
-
 package monitor
 
 // Test-only accessors exposing unexported state for white-box assertions.
@@ -13,8 +11,13 @@ func (m *Monitor) PacketLossHosts() []string { return m.packetLossHosts }
 // TCPHosts returns the configured TCP hosts.
 func (m *Monitor) TCPHosts() []string { return m.tcpHosts }
 
-// InterfaceA returns the first monitored interface.
-func (m *Monitor) InterfaceA() *InterfaceStatus { return m.interfaceA }
+// Interfaces returns the monitored interfaces.
+func (m *Monitor) Interfaces() []*InterfaceStatus { return m.interfaces }
 
-// InterfaceB returns the second monitored interface.
-func (m *Monitor) InterfaceB() *InterfaceStatus { return m.interfaceB }
+// PingArgs exposes pingArgs for external tests.
+func PingArgs(goos, iface, host string) []string { return pingArgs(goos, iface, host) }
+
+// LossArgs exposes lossArgs for external tests.
+func LossArgs(goos, iface, host string, count int) []string {
+	return lossArgs(goos, iface, host, count)
+}

internal/monitor/loops.go

@@ -1,5 +1,3 @@
-//go:build linux
-
 package monitor
 
 import (

internal/monitor/monitor.go

@@ -1,8 +1,6 @@
-//go:build linux
-
-// Package monitor implements the dual-interface real-time network
-// monitoring dashboard: ICMP reachability, packet loss, TCP latency, and
-// the terminal UI that renders them.
+// Package monitor implements the real-time network monitoring dashboard:
+// ICMP reachability, packet loss, TCP latency, and the terminal UI that
+// renders them. It monitors one or two interfaces.
 package monitor
 
 import (
@@ -14,6 +12,7 @@ import (
 	"net"
 	"os"
 	"os/exec"
+	"runtime"
 	"strconv"
 	"strings"
 	"sync"
@@ -88,9 +87,8 @@ type Monitor struct {
 	packetLossHosts   []string
 	tcpHosts          []string
 
-	// Interfaces
-	interfaceA *InterfaceStatus
-	interfaceB *InterfaceStatus
+	// Interfaces to monitor (one or two)
+	interfaces []*InterfaceStatus
 
 	// Logging
 	logFile string
@@ -104,9 +102,16 @@ type Monitor struct {
 	mu sync.RWMutex
 }
 
-// NewMonitor creates a new Monitor instance with default settings.
-func NewMonitor(ifaceA, labelA, ifaceB, labelB, logFile string) *Monitor {
-	return &Monitor{
+// IfaceSpec names one interface to monitor and its display label.
+type IfaceSpec struct {
+	Name  string
+	Label string
+}
+
+// NewMonitor creates a new Monitor instance with default settings,
+// monitoring the given interfaces (one or two).
+func NewMonitor(ifaces []IfaceSpec, logFile string) *Monitor {
+	m := &Monitor{
 		ICMPTimeout:      defaultICMPTimeout,
 		TCPTimeout:       defaultTCPTimeout,
 		PacketLossPings:  defaultPacketLossPings,
@@ -127,13 +132,16 @@ func NewMonitor(ifaceA, labelA, ifaceB, labelB, logFile string) *Monitor {
 		packetLossHosts:   []string{},
 		tcpHosts:          []string{},
 
-		interfaceA: NewInterfaceStatus(ifaceA, labelA),
-		interfaceB: NewInterfaceStatus(ifaceB, labelB),
-
 		logFile:   logFile,
 		startTime: time.Now(),
 		uiUpdate:  make(chan struct{}, uiUpdateBuffer),
 	}
+
+	for _, spec := range ifaces {
+		m.interfaces = append(m.interfaces, NewInterfaceStatus(spec.Name, spec.Label))
+	}
+
+	return m
 }
 
 // AddReachabilityHost adds a host for reachability monitoring.
@@ -194,12 +202,11 @@ func (m *Monitor) Run(ctx context.Context) error {
 	tcpHosts := append([]string{}, m.tcpHosts...)
 	m.mu.RUnlock()
 
-	go m.reachLoop(ctx, m.interfaceA, reachHosts)
-	go m.reachLoop(ctx, m.interfaceB, reachHosts)
-	go m.lossLoop(ctx, m.interfaceA, lossHosts)
-	go m.lossLoop(ctx, m.interfaceB, lossHosts)
-	go m.tcpLoop(ctx, m.interfaceA, tcpHosts)
-	go m.tcpLoop(ctx, m.interfaceB, tcpHosts)
+	for _, st := range m.interfaces {
+		go m.reachLoop(ctx, st, reachHosts)
+		go m.lossLoop(ctx, st, lossHosts)
+		go m.tcpLoop(ctx, st, tcpHosts)
+	}
 
 	m.logf("Starting UI loop")
 	m.uiLoop(ctx)
@@ -306,13 +313,36 @@ func fetchIPInfo(iface string) string {
 	return fmt.Sprintf("%s [%s] %s", r.IP, r.Hostname, r.Org)
 }
 
+// pingArgs builds the arguments for a single reachability ping on the given
+// OS. Linux binds the interface with -I and takes -W in seconds; macOS binds
+// with -b and takes -W in milliseconds.
+func pingArgs(goos, iface, host string) []string {
+	if goos == "darwin" {
+		return []string{"-b", iface, "-c1", "-W1000", host}
+	}
+
+	return []string{"-I", iface, "-c1", "-W1", host}
+}
+
+// lossArgs builds the arguments for a packet-loss ping burst of count pings.
+func lossArgs(goos, iface, host string, count int) []string {
+	c := strconv.Itoa(count)
+	if goos == "darwin" {
+		return []string{"-q", "-i", "0.05", "-c", c, "-W1000", "-b", iface, host}
+	}
+
+	return []string{"-q", "-i", "0.05", "-c", c, "-W1", "-I", iface, host}
+}
+
 // pingOnce performs a single ping over the named interface.
 func (m *Monitor) pingOnce(ctx context.Context, iface, host string) bool {
 	ctx, cancel := context.WithTimeout(ctx, m.ICMPTimeout)
 	defer cancel()
 
+	args := pingArgs(runtime.GOOS, iface, host)
+
 	cmd := exec.CommandContext( //nolint:gosec // G204: fixed argv, operator CLI input
-		ctx, "ping", "-I", iface, "-c1", "-W1", host)
+		ctx, "ping", args...)
 
 	return cmd.Run() == nil
 }
@@ -322,9 +352,10 @@ func (m *Monitor) lossPercent(ctx context.Context, iface, host string) float64 {
 	ctx, cancel := context.WithTimeout(ctx, lossQueryTimeout)
 	defer cancel()
 
+	args := lossArgs(runtime.GOOS, iface, host, m.PacketLossPings)
+
 	cmd := exec.CommandContext( //nolint:gosec // G204: fixed argv, operator CLI input
-		ctx, "ping", "-q", "-i", "0.05",
-		"-c", strconv.Itoa(m.PacketLossPings), "-W1", "-I", iface, host)
+		ctx, "ping", args...)
 
 	out, err := cmd.CombinedOutput()
 	if err != nil {
@@ -375,7 +406,7 @@ func (m *Monitor) tcpDuration(iface, hp string) time.Duration {
 		return m.TCPTimeout
 	}
 
-	d := net.Dialer{Timeout: m.TCPTimeout, LocalAddr: la}
+	d := net.Dialer{Timeout: m.TCPTimeout, LocalAddr: la, Control: bindControl(iface)}
 	st := time.Now()
 
 	c, err := d.Dial("tcp", hp)

internal/monitor/monitor_test.go

@@ -1,5 +1,3 @@
-//go:build linux
-
 package monitor_test
 
 import (
@@ -8,26 +6,33 @@ import (
 	"git.eeqj.de/sneak/rtnetmon/internal/monitor"
 )
 
+// Interface names and hosts reused across the monitor package tests.
+const (
+	ifaceTest0 = "test0"
+	ifaceTest1 = "test1"
+	ifaceEth0  = "eth0"
+	host8888   = "8.8.8.8"
+)
+
 func TestNewMonitor(t *testing.T) {
 	t.Parallel()
 
-	mon := monitor.NewMonitor("test0", "Test Interface A", "test1",
-		"Test Interface B", "/tmp/test.log")
+	mon := monitor.NewMonitor([]monitor.IfaceSpec{
+		{Name: ifaceTest0, Label: "Test Interface A"},
+		{Name: ifaceTest1, Label: "Test Interface B"},
+	}, "/tmp/test.log")
 
-	if mon.InterfaceA() == nil {
-		t.Fatal("interfaceA is nil")
+	ifaces := mon.Interfaces()
+	if len(ifaces) != 2 {
+		t.Fatalf("interfaces = %d, want 2", len(ifaces))
 	}
 
-	if mon.InterfaceB() == nil {
-		t.Fatal("interfaceB is nil")
+	if ifaces[0].Name != ifaceTest0 {
+		t.Errorf("interfaces[0].Name = %q, want %q", ifaces[0].Name, ifaceTest0)
 	}
 
-	if mon.InterfaceA().Name != "test0" {
-		t.Errorf("interfaceA.Name = %q, want %q", mon.InterfaceA().Name, "test0")
-	}
-
-	if mon.InterfaceB().Name != "test1" {
-		t.Errorf("interfaceB.Name = %q, want %q", mon.InterfaceB().Name, "test1")
+	if ifaces[1].Name != ifaceTest1 {
+		t.Errorf("interfaces[1].Name = %q, want %q", ifaces[1].Name, ifaceTest1)
 	}
 
 	if mon.ICMPTimeout.Milliseconds() != 500 {
@@ -51,12 +56,31 @@ func TestNewMonitor(t *testing.T) {
 	}
 }
 
+func TestNewMonitorSingle(t *testing.T) {
+	t.Parallel()
+
+	mon := monitor.NewMonitor(
+		[]monitor.IfaceSpec{{Name: ifaceEth0, Label: "default route"}}, "")
+
+	ifaces := mon.Interfaces()
+	if len(ifaces) != 1 {
+		t.Fatalf("interfaces = %d, want 1", len(ifaces))
+	}
+
+	if ifaces[0].Name != ifaceEth0 {
+		t.Errorf("interfaces[0].Name = %q, want %q", ifaces[0].Name, ifaceEth0)
+	}
+}
+
 func TestAddHosts(t *testing.T) {
 	t.Parallel()
 
-	mon := monitor.NewMonitor("test0", "Test A", "test1", "Test B", "")
+	mon := monitor.NewMonitor([]monitor.IfaceSpec{
+		{Name: ifaceTest0, Label: "Test A"},
+		{Name: ifaceTest1, Label: "Test B"},
+	}, "")
 
-	mon.AddReachabilityHost("8.8.8.8")
+	mon.AddReachabilityHost(host8888)
 	mon.AddReachabilityHost("google.com")
 
 	if len(mon.ReachabilityHosts()) != 2 {

internal/monitor/ping_test.go

@@ -0,0 +1,58 @@
+package monitor_test
+
+import (
+	"reflect"
+	"testing"
+
+	"git.eeqj.de/sneak/rtnetmon/internal/monitor"
+)
+
+func TestPingArgs(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		goos string
+		want []string
+	}{
+		{"linux", []string{"-I", ifaceEth0, "-c1", "-W1", host8888}},
+		{"darwin", []string{"-b", ifaceEth0, "-c1", "-W1000", host8888}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.goos, func(t *testing.T) {
+			t.Parallel()
+
+			got := monitor.PingArgs(tt.goos, ifaceEth0, host8888)
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("PingArgs(%q) = %v, want %v", tt.goos, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestLossArgs(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		goos string
+		want []string
+	}{
+		{"linux", []string{
+			"-q", "-i", "0.05", "-c", "20", "-W1", "-I", ifaceEth0, host8888,
+		}},
+		{"darwin", []string{
+			"-q", "-i", "0.05", "-c", "20", "-W1000", "-b", ifaceEth0, host8888,
+		}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.goos, func(t *testing.T) {
+			t.Parallel()
+
+			got := monitor.LossArgs(tt.goos, ifaceEth0, host8888, 20)
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("LossArgs(%q) = %v, want %v", tt.goos, got, tt.want)
+			}
+		})
+	}
+}

internal/monitor/styles.go

@@ -1,5 +1,3 @@
-//go:build linux
-
 package monitor
 
 import tcell "github.com/gdamore/tcell/v2"

internal/monitor/styles_test.go

@@ -1,5 +1,3 @@
-//go:build linux
-
 package monitor_test
 
 import (

internal/monitor/ui.go

@@ -1,5 +1,3 @@
-//go:build linux
-
 package monitor
 
 import (
@@ -383,9 +381,11 @@ func (m *Monitor) uiLoop(ctx context.Context) {
 		runtime := time.Since(m.startTime).Round(time.Second).String()
 		Put(m.screen, colLeft, rowRuntime, "Runtime: "+runtime, tcell.StyleDefault)
 
+		// Draw one pane per interface; a single interface draws one pane.
 		y := rowFirstIface
-		y = m.DrawInterface(m.screen, y, w, m.interfaceA)
-		_ = m.DrawInterface(m.screen, y, w, m.interfaceB)
+		for _, st := range m.interfaces {
+			y = m.DrawInterface(m.screen, y, w, st)
+		}
 
 		m.screen.Show()
 	}