TapMap - Watch Your Computer's Network Connections on a Live World Map

You open Activity Monitor. There are 184 connections.

You have no idea where most of them go. Your phone might be talking to seventeen ad networks; your laptop is probably leaking telemetry to four cloud regions you’ve never heard of.

TapMap is the small awareness tool that puts every active connection on a live world map — markers for destinations, arcs from your location, an Insights panel surfacing what’s new and what’s frequent over the last 30 days.

What is TapMap?

TapMap is a local network-connection visualizer. It scans active sockets on your machine, enriches each IP with MaxMind GeoLite2 geolocation, and renders the results on an interactive Dash + Plotly world map. Crucially, it is read-only — an awareness tool, not a firewall. It shows you the world your computer is connecting to; it doesn’t block anything.

“Watch your computer connect across the internet in real time. Discover the world behind your apps.”

TapMap on GitHub TapMap Documentation TapMap on Docker Hub

What makes it different

• 🗺️ Live world map of every outbound connection your machine is making right now
• 📊 30-day Insights + Daily Activity Report — highlights new countries / ASNs / ports / apps, frequent destinations, application patterns, provider concentration, and recent activity timelines
• 🏠 100% local — connection data and GeoIP lookups both happen on your machine
• 🚫 No telemetry — confirmed in the README; the only outbound call is optional public-IP detection, which you can avoid with fixed TAPMAP_LON and TAPMAP_LAT
• 📦 Native binaries + Docker — single-file executable for Windows / Linux / macOS, Docker image for Linux hosts
• 🧭 Network side panels — inspect unmapped public services, LAN/local services, and local open ports
• 🗃️ GeoIP database management — install, update, verify, and switch supported GeoIP providers from the UI
• ⌨️ Keyboard-driven — D opens the Daily Activity Report, I toggles Insights, U unmapped services, L LAN, O open ports, G GeoIP database management, E cache export, C clear cache
• 🆓 MIT licensed — fully open source

How it actually works

socket scan → IP extraction → GeoIP lookup → map rendering

• Socket scan: psutil on Windows/Linux, lsof on macOS — reads the OS-level table of active TCP and UDP connections
• GeoIP lookup: local GeoIP databases. TapMap supports MaxMind GeoLite2 and DB-IP Lite, and current builds include a GeoIP Database Management screen for installation, updates, provider status, and manual rechecks.
• Render: Dash + Plotly serve an interactive map at http://127.0.0.1:8050/ that you open in your browser

The whole thing is a Python 3.10+ process; there’s no packet capture daemon, no system tray dependency, and no kernel module. It reads the OS socket table, not packet payloads.

Self-Hosting TapMap

There are three deployment options depending on your OS and preferences.

Option 1 — Native binary (recommended)

Download from GitHub Releases for your OS. Extract and run:

./tapmap                # Linux / macOS
tapmap.exe              # Windows

The browser tab opens automatically at http://127.0.0.1:8050/. If not, open that URL manually.

First-run security prompts — the binaries are unsigned, so:

• Windows SmartScreen — “More info” → “Run anyway”
• macOS Gatekeeper — System Settings → Privacy & Security → “Open anyway” (or in Terminal: xattr -d com.apple.quarantine tapmap)

Option 2 — Docker (Linux hosts only)

The Docker image needs --network host and --pid host to see the host’s sockets and processes, which Docker Desktop on Windows / macOS doesn’t expose. So this path is Linux-only:

# TapMap stores GeoIP databases and local history here:
mkdir -p ~/tapmap-data

docker run --rm \
  --network host \
  --pid host \
  --cap-add=SYS_PTRACE \
  --security-opt apparmor=unconfined \
  -v ~/tapmap-data:/data \
  -e TAPMAP_IN_DOCKER=1 \
  olalie/tapmap:latest

Open http://127.0.0.1:8050/ on the host.

--cap-add=SYS_PTRACE
--security-opt apparmor=unconfined

Option 3 — From source

Python 3.10+, then:

git clone https://github.com/olalie/tapmap
cd tapmap
python -m venv .venv
source .venv/bin/activate   # or .venv\Scripts\activate on Windows
pip install -r requirements.txt
pip install -e .
python -m tapmap

Getting the GeoIP databases

TapMap does not bundle GeoIP databases. Without a supported database, TapMap still runs, but the map cannot place public IPs geographically.

Current TapMap builds include GeoIP Database Management. If no supported databases are found, the setup window opens automatically. You can also open it later from the Tools menu or with the G keyboard shortcut.

Supported providers:

• MaxMind GeoLite2: recommended for coverage and accuracy. Requires a free MaxMind account, account ID, and license key.
• DB-IP Lite: simpler setup and no account required, but lower coverage and accuracy.

Manual install still works. For MaxMind, download GeoLite2-City.mmdb and GeoLite2-ASN.mmdb. For DB-IP, extract and rename the city/ASN Lite databases to DBIP-City.mmdb and DBIP-ASN.mmdb. Then place them in TapMap’s data folder and click Recheck databases.

The database manager can also check for updates and install newer database files when available.

Configuring the port

Default is 8050. Override at runtime via env var:

TAPMAP_PORT=8060 tapmap

For Docker:

docker run ... -e TAPMAP_PORT=8060 ...

If you do not want TapMap to use public-IP based location detection for the local marker, provide fixed coordinates:

TAPMAP_LON=10.7522 TAPMAP_LAT=59.9139 tapmap

In Docker, pass the same variables with -e.

TapMap vs the Alternatives

TapMap occupies a specific niche — read-only visualization, not enforcement. The category map:

The honest read:

• Pick TapMap if you want to see where your traffic goes without blocking anything — the awareness tool angle
• Pick OpenSnitch if you want per-app interactive blocking on Linux
• Pick Little Snitch if you’re on macOS and want commercial-grade firewalling with a polished UI
• Pick netstat / ss if you don’t need a GUI and just want quick CLI snapshots

The three tools also compose: TapMap to find suspicious destinations, OpenSnitch / Little Snitch to block them.

Conclusion

TapMap fills a small but valuable niche: a polished, cross-platform, local-only network visualizer that doesn’t try to be a firewall. The 30-day Insights panel and Daily Activity Report are the genuinely interesting features — most users don’t know what their machine talks to in steady state, and “new destination this week” is the kind of signal that makes you actually look. The maintainer is upfront about the project’s scope (no blocking, no alerts, no policy) and about the GeoIP database licensing constraints, which is the right way to ship a small open-source tool.

Related tools worth knowing:

• OpenSnitch — Linux per-app interactive firewall; the blocking counterpart to TapMap’s visibility
• Little Snitch — commercial macOS firewall with a similar visibility-then-block model
• GlassWire — Windows-focused network monitor; broader feature set, freemium
• MaxMind GeoLite2 and DB-IP Lite — supported GeoIP database providers for map locations
• Dawarich — different angle: maps where you have been, not where your connections go