I wonder how many Ghost Sockets the average user got. I am under an advanced APT (that I am reverse-engineering) and I got around 49 ghost sockets. Which is a lot. Press "o" in the tool to view ghost sockets or refer at the bottom there is a warning showing you the ghost sockets count.
The ultimate network monitoring army knife. If you are tired of switching between lsof, tcpdump, traceroute, netstat, ifconfig etc. this tool has it all. It even detect ghost sockets and has counter-measures baked in. This of it like a htop for networking on steroids.
Looks snazzy. Like htop could this potentially read ~/.config/nethtop/nethtop.rc or something like that to look for preferences such as user-defined targeted tcpdump additional flags -p --dont-verify-checksums -NNnnttv -B131072 -c1000 and user-defined pcap logging directory like /dev/shm to avoid artificially dropping packets due to slow storage?
This is definitely going in the roadmap. Or if you want you can make a PR request and I will integrate the update. Thanks for the poweruser comment. Really appreciated!