1. Network service detector. NWatch is a sniffer but can be conceptualized as a "passive port scanner", in that it is only interested in IP traffic and it organizes results as a port scanner would. The advantage of this tool is that services that is open for a short period of time can be detected with NWatch while successive nmap scans will miss them. The disadvantage is that the service have to be actively used to be detected. From Debian 3.0r0 APT