diff --git a/docs/callgraph.dot b/docs/callgraph.dot
index 2fd021f..0d257a6 100644
--- a/docs/callgraph.dot
+++ b/docs/callgraph.dot
@@ -3,489 +3,501 @@ digraph G {
     subgraph cluster_G {
 
         graph [style="filled,rounded",fillcolor="#80808018", label=""];
-        picosnitch [label="picosnitch", style="filled", fillcolor="#ffffffb2", fontcolor="#000000", group="0"];
-        subgraph cluster_picosnitch {
-
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__BpfEvent [label="BpfEvent", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
-        }
-        subgraph cluster_picosnitch {
-
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__Daemon [label="Daemon", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
-        }
-        subgraph cluster_picosnitch {
-
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__FanotifyEventMetadata [label="FanotifyEventMetadata", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
-        }
-        subgraph cluster_picosnitch {
-
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__NotificationManager [label="NotificationManager", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
-        }
-        subgraph cluster_picosnitch {
-
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__ProcessManager [label="ProcessManager", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
+        picosnitch__cli [label="picosnitch.cli", style="filled", fillcolor="#ffffffb2", fontcolor="#000000", group="0"];
+        picosnitch__daemon [label="picosnitch.daemon", style="filled", fillcolor="#ffffffb2", fontcolor="#000000", group="1"];
+        picosnitch__event_structures [label="picosnitch.event_structures", style="filled", fillcolor="#ffffffb2", fontcolor="#000000", group="2"];
+        picosnitch__main_process [label="picosnitch.main_process", style="filled", fillcolor="#ffffffb2", fontcolor="#000000", group="3"];
+        picosnitch__monitor_subprocess [label="picosnitch.monitor_subprocess", style="filled", fillcolor="#ffffffb2", fontcolor="#000000", group="4"];
+        picosnitch__notifcation_manager [label="picosnitch.notifcation_manager", style="filled", fillcolor="#ffffffb2", fontcolor="#000000", group="5"];
+        picosnitch__primary_subprocess [label="picosnitch.primary_subprocess", style="filled", fillcolor="#ffffffb2", fontcolor="#000000", group="6"];
+        picosnitch__process_manager [label="picosnitch.process_manager", style="filled", fillcolor="#ffffffb2", fontcolor="#000000", group="7"];
+        picosnitch__rfuse_subprocess [label="picosnitch.rfuse_subprocess", style="filled", fillcolor="#ffffffb2", fontcolor="#000000", group="8"];
+        picosnitch__secondary_subprocess [label="picosnitch.secondary_subprocess", style="filled", fillcolor="#ffffffb2", fontcolor="#000000", group="9"];
+        picosnitch__user_interface [label="picosnitch.user_interface", style="filled", fillcolor="#ffffffb2", fontcolor="#000000", group="10"];
+        picosnitch__utils [label="picosnitch.utils", style="filled", fillcolor="#ffffffb2", fontcolor="#000000", group="11"];
+        picosnitch__virustotal_subprocess [label="picosnitch.virustotal_subprocess", style="filled", fillcolor="#ffffffb2", fontcolor="#000000", group="12"];
+        subgraph cluster_picosnitch__cli {
+
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.cli"];
+            picosnitch__cli__main [label="main", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
         }
-        subgraph cluster_picosnitch {
+        subgraph cluster_picosnitch__cli {
 
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__get_fanotify_events [label="get_fanotify_events", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
-        }
-        subgraph cluster_picosnitch {
-
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__get_fstat [label="get_fstat", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
-        }
-        subgraph cluster_picosnitch {
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.cli"];
+            picosnitch__cli__start_picosnitch [label="start_picosnitch", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+            subgraph cluster_picosnitch__cli__start_picosnitch {
 
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__get_sha256_fd [label="get_sha256_fd", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
-        }
-        subgraph cluster_picosnitch {
-
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__get_sha256_fuse [label="get_sha256_fuse", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
-        }
-        subgraph cluster_picosnitch {
-
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__get_sha256_pid [label="get_sha256_pid", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
-        }
-        subgraph cluster_picosnitch {
-
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__get_vt_results [label="get_vt_results", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
-        }
-        subgraph cluster_picosnitch {
-
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__main [label="main", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
-        }
-        subgraph cluster_picosnitch {
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.cli.start_picosnitch"];
+                picosnitch__cli__start_picosnitch__PicoDaemon [label="PicoDaemon", style="filled", fillcolor="#ff6565b2", fontcolor="#000000", group="0"];
+            }
+            subgraph cluster_picosnitch__cli__start_picosnitch {
 
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__main_process [label="main_process", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
-        }
-        subgraph cluster_picosnitch {
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.cli.start_picosnitch"];
+                picosnitch__cli__start_picosnitch__delpid [label="delpid", style="filled", fillcolor="#ff6565b2", fontcolor="#000000", group="0"];
+                subgraph cluster_picosnitch__cli__start_picosnitch__PicoDaemon {
 
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__monitor_subprocess [label="monitor_subprocess", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
+                    graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.cli.start_picosnitch.PicoDaemon"];
+                    picosnitch__cli__start_picosnitch__PicoDaemon__run [label="run", style="filled", fillcolor="#ff3232b2", fontcolor="#000000", group="0"];
+                }
+            }
         }
-        subgraph cluster_picosnitch {
+        subgraph cluster_picosnitch__daemon {
 
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__monitor_subprocess_initial_poll [label="monitor_subprocess_initial_poll", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
-        }
-        subgraph cluster_picosnitch {
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.daemon"];
+            picosnitch__daemon__Daemon [label="Daemon", style="filled", fillcolor="#ffc499b2", fontcolor="#000000", group="1"];
+            subgraph cluster_picosnitch__daemon__Daemon {
 
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__primary_subprocess [label="primary_subprocess", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
-        }
-        subgraph cluster_picosnitch {
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.daemon.Daemon"];
+                picosnitch__daemon__Daemon____init__ [label="__init__", style="filled", fillcolor="#ffa765b2", fontcolor="#000000", group="1"];
+            }
+            subgraph cluster_picosnitch__daemon__Daemon {
 
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__primary_subprocess_helper [label="primary_subprocess_helper", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
-        }
-        subgraph cluster_picosnitch {
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.daemon.Daemon"];
+                picosnitch__daemon__Daemon__daemonize [label="daemonize", style="filled", fillcolor="#ffa765b2", fontcolor="#000000", group="1"];
+            }
+            subgraph cluster_picosnitch__daemon__Daemon {
 
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__read_snitch [label="read_snitch", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
-        }
-        subgraph cluster_picosnitch {
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.daemon.Daemon"];
+                picosnitch__daemon__Daemon__delpid [label="delpid", style="filled", fillcolor="#ffa765b2", fontcolor="#000000", group="1"];
+            }
+            subgraph cluster_picosnitch__daemon__Daemon {
 
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__reverse_dns_lookup [label="reverse_dns_lookup", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
-        }
-        subgraph cluster_picosnitch {
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.daemon.Daemon"];
+                picosnitch__daemon__Daemon__getpid [label="getpid", style="filled", fillcolor="#ffa765b2", fontcolor="#000000", group="1"];
+            }
+            subgraph cluster_picosnitch__daemon__Daemon {
 
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__rfuse_subprocess [label="rfuse_subprocess", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
-        }
-        subgraph cluster_picosnitch {
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.daemon.Daemon"];
+                picosnitch__daemon__Daemon__restart [label="restart", style="filled", fillcolor="#ffa765b2", fontcolor="#000000", group="1"];
+            }
+            subgraph cluster_picosnitch__daemon__Daemon {
 
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__secondary_subprocess [label="secondary_subprocess", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
-        }
-        subgraph cluster_picosnitch {
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.daemon.Daemon"];
+                picosnitch__daemon__Daemon__run [label="run", style="filled", fillcolor="#ffa765b2", fontcolor="#000000", group="1"];
+            }
+            subgraph cluster_picosnitch__daemon__Daemon {
 
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__secondary_subprocess_helper [label="secondary_subprocess_helper", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
-        }
-        subgraph cluster_picosnitch {
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.daemon.Daemon"];
+                picosnitch__daemon__Daemon__start [label="start", style="filled", fillcolor="#ffa765b2", fontcolor="#000000", group="1"];
+            }
+            subgraph cluster_picosnitch__daemon__Daemon {
 
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__secondary_subprocess_sha_wrapper [label="secondary_subprocess_sha_wrapper", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
-        }
-        subgraph cluster_picosnitch {
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.daemon.Daemon"];
+                picosnitch__daemon__Daemon__status [label="status", style="filled", fillcolor="#ffa765b2", fontcolor="#000000", group="1"];
+            }
+            subgraph cluster_picosnitch__daemon__Daemon {
 
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__start_picosnitch [label="start_picosnitch", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.daemon.Daemon"];
+                picosnitch__daemon__Daemon__stop [label="stop", style="filled", fillcolor="#ffa765b2", fontcolor="#000000", group="1"];
+            }
         }
-        subgraph cluster_picosnitch {
+        subgraph cluster_picosnitch__event_structures {
 
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__ui_dash [label="ui_dash", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.event_structures"];
+            picosnitch__event_structures__BpfEvent [label="BpfEvent", style="filled", fillcolor="#fff099b2", fontcolor="#000000", group="2"];
         }
-        subgraph cluster_picosnitch {
+        subgraph cluster_picosnitch__event_structures {
 
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__ui_geoip [label="ui_geoip", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.event_structures"];
+            picosnitch__event_structures__FanotifyEventMetadata [label="FanotifyEventMetadata", style="filled", fillcolor="#fff099b2", fontcolor="#000000", group="2"];
         }
-        subgraph cluster_picosnitch {
+        subgraph cluster_picosnitch__main_process {
 
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__ui_init [label="ui_init", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
-        }
-        subgraph cluster_picosnitch {
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.main_process"];
+            picosnitch__main_process__main_process [label="main_process", style="filled", fillcolor="#e1ff99b2", fontcolor="#000000", group="3"];
+            subgraph cluster_picosnitch__main_process__main_process {
 
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__ui_loop [label="ui_loop", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.main_process.main_process"];
+                picosnitch__main_process__main_process__clean_exit [label="clean_exit", style="filled", fillcolor="#d3ff65b2", fontcolor="#000000", group="3"];
+            }
         }
-        subgraph cluster_picosnitch {
+        subgraph cluster_picosnitch__monitor_subprocess {
 
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__virustotal_subprocess [label="virustotal_subprocess", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.monitor_subprocess"];
+            picosnitch__monitor_subprocess__monitor_subprocess [label="monitor_subprocess", style="filled", fillcolor="#b6ff99b2", fontcolor="#000000", group="4"];
         }
-        subgraph cluster_picosnitch {
+        subgraph cluster_picosnitch__monitor_subprocess {
 
-            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch"];
-            picosnitch__write_snitch [label="write_snitch", style="filled", fillcolor="#feccccb2", fontcolor="#000000", group="0"];
-            subgraph cluster_picosnitch__Daemon {
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.monitor_subprocess"];
+            picosnitch__monitor_subprocess__monitor_subprocess_initial_poll [label="monitor_subprocess_initial_poll", style="filled", fillcolor="#b6ff99b2", fontcolor="#000000", group="4"];
+            subgraph cluster_picosnitch__monitor_subprocess__monitor_subprocess {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.Daemon"];
-                picosnitch__Daemon____init__ [label="__init__", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.monitor_subprocess.monitor_subprocess"];
+                picosnitch__monitor_subprocess__monitor_subprocess__get_cmdline [label="get_cmdline", style="filled", fillcolor="#91ff65b2", fontcolor="#000000", group="4"];
             }
-            subgraph cluster_picosnitch__Daemon {
+            subgraph cluster_picosnitch__monitor_subprocess__monitor_subprocess {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.Daemon"];
-                picosnitch__Daemon__daemonize [label="daemonize", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.monitor_subprocess.monitor_subprocess"];
+                picosnitch__monitor_subprocess__monitor_subprocess__get_fd [label="get_fd", style="filled", fillcolor="#91ff65b2", fontcolor="#000000", group="4"];
             }
-            subgraph cluster_picosnitch__Daemon {
+            subgraph cluster_picosnitch__monitor_subprocess__monitor_subprocess {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.Daemon"];
-                picosnitch__Daemon__delpid [label="delpid", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.monitor_subprocess.monitor_subprocess"];
+                picosnitch__monitor_subprocess__monitor_subprocess__queue_dns_event [label="queue_dns_event", style="filled", fillcolor="#91ff65b2", fontcolor="#000000", group="4"];
             }
-            subgraph cluster_picosnitch__Daemon {
+            subgraph cluster_picosnitch__monitor_subprocess__monitor_subprocess {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.Daemon"];
-                picosnitch__Daemon__getpid [label="getpid", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.monitor_subprocess.monitor_subprocess"];
+                picosnitch__monitor_subprocess__monitor_subprocess__queue_exec_event [label="queue_exec_event", style="filled", fillcolor="#91ff65b2", fontcolor="#000000", group="4"];
             }
-            subgraph cluster_picosnitch__Daemon {
+            subgraph cluster_picosnitch__monitor_subprocess__monitor_subprocess {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.Daemon"];
-                picosnitch__Daemon__restart [label="restart", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.monitor_subprocess.monitor_subprocess"];
+                picosnitch__monitor_subprocess__monitor_subprocess__queue_lost [label="queue_lost", style="filled", fillcolor="#91ff65b2", fontcolor="#000000", group="4"];
             }
-            subgraph cluster_picosnitch__Daemon {
+            subgraph cluster_picosnitch__monitor_subprocess__monitor_subprocess {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.Daemon"];
-                picosnitch__Daemon__run [label="run", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.monitor_subprocess.monitor_subprocess"];
+                picosnitch__monitor_subprocess__monitor_subprocess__queue_recvv4_event [label="queue_recvv4_event", style="filled", fillcolor="#91ff65b2", fontcolor="#000000", group="4"];
             }
-            subgraph cluster_picosnitch__Daemon {
+            subgraph cluster_picosnitch__monitor_subprocess__monitor_subprocess {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.Daemon"];
-                picosnitch__Daemon__start [label="start", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.monitor_subprocess.monitor_subprocess"];
+                picosnitch__monitor_subprocess__monitor_subprocess__queue_recvv6_event [label="queue_recvv6_event", style="filled", fillcolor="#91ff65b2", fontcolor="#000000", group="4"];
             }
-            subgraph cluster_picosnitch__Daemon {
+            subgraph cluster_picosnitch__monitor_subprocess__monitor_subprocess {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.Daemon"];
-                picosnitch__Daemon__status [label="status", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.monitor_subprocess.monitor_subprocess"];
+                picosnitch__monitor_subprocess__monitor_subprocess__queue_sendv4_event [label="queue_sendv4_event", style="filled", fillcolor="#91ff65b2", fontcolor="#000000", group="4"];
             }
-            subgraph cluster_picosnitch__Daemon {
+            subgraph cluster_picosnitch__monitor_subprocess__monitor_subprocess {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.Daemon"];
-                picosnitch__Daemon__stop [label="stop", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.monitor_subprocess.monitor_subprocess"];
+                picosnitch__monitor_subprocess__monitor_subprocess__queue_sendv6_event [label="queue_sendv6_event", style="filled", fillcolor="#91ff65b2", fontcolor="#000000", group="4"];
             }
-            subgraph cluster_picosnitch__NotificationManager {
+        }
+        subgraph cluster_picosnitch__notifcation_manager {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.NotificationManager"];
-                picosnitch__NotificationManager____new__ [label="__new__", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
-            }
-            subgraph cluster_picosnitch__NotificationManager {
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.notifcation_manager"];
+            picosnitch__notifcation_manager__NotificationManager [label="NotificationManager", style="filled", fillcolor="#99ffa7b2", fontcolor="#000000", group="5"];
+            subgraph cluster_picosnitch__notifcation_manager__NotificationManager {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.NotificationManager"];
-                picosnitch__NotificationManager__enable_notifications [label="enable_notifications", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.notifcation_manager.NotificationManager"];
+                picosnitch__notifcation_manager__NotificationManager____new__ [label="__new__", style="filled", fillcolor="#65ff7bb2", fontcolor="#000000", group="5"];
             }
-            subgraph cluster_picosnitch__NotificationManager {
+            subgraph cluster_picosnitch__notifcation_manager__NotificationManager {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.NotificationManager"];
-                picosnitch__NotificationManager__toast [label="toast", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.notifcation_manager.NotificationManager"];
+                picosnitch__notifcation_manager__NotificationManager__enable_notifications [label="enable_notifications", style="filled", fillcolor="#65ff7bb2", fontcolor="#000000", group="5"];
             }
-            subgraph cluster_picosnitch__ProcessManager {
+            subgraph cluster_picosnitch__notifcation_manager__NotificationManager {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.ProcessManager"];
-                picosnitch__ProcessManager____init__ [label="__init__", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.notifcation_manager.NotificationManager"];
+                picosnitch__notifcation_manager__NotificationManager__toast [label="toast", style="filled", fillcolor="#65ff7bb2", fontcolor="#000000", group="5"];
             }
-            subgraph cluster_picosnitch__ProcessManager {
+        }
+        subgraph cluster_picosnitch__primary_subprocess {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.ProcessManager"];
-                picosnitch__ProcessManager__is_alive [label="is_alive", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
-            }
-            subgraph cluster_picosnitch__ProcessManager {
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.primary_subprocess"];
+            picosnitch__primary_subprocess__primary_subprocess [label="primary_subprocess", style="filled", fillcolor="#99ffd3b2", fontcolor="#000000", group="6"];
+        }
+        subgraph cluster_picosnitch__primary_subprocess {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.ProcessManager"];
-                picosnitch__ProcessManager__is_zombie [label="is_zombie", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
-            }
-            subgraph cluster_picosnitch__ProcessManager {
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.primary_subprocess"];
+            picosnitch__primary_subprocess__primary_subprocess_helper [label="primary_subprocess_helper", style="filled", fillcolor="#99ffd3b2", fontcolor="#000000", group="6"];
+            subgraph cluster_picosnitch__primary_subprocess__primary_subprocess {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.ProcessManager"];
-                picosnitch__ProcessManager__memory [label="memory", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.primary_subprocess.primary_subprocess"];
+                picosnitch__primary_subprocess__primary_subprocess__snitch_pipe_thread [label="snitch_pipe_thread", style="filled", fillcolor="#65ffbdb2", fontcolor="#000000", group="6"];
             }
-            subgraph cluster_picosnitch__ProcessManager {
+            subgraph cluster_picosnitch__primary_subprocess__primary_subprocess {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.ProcessManager"];
-                picosnitch__ProcessManager__start [label="start", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.primary_subprocess.primary_subprocess"];
+                picosnitch__primary_subprocess__primary_subprocess__write_snitch_and_exit [label="write_snitch_and_exit", style="filled", fillcolor="#65ffbdb2", fontcolor="#000000", group="6"];
             }
-            subgraph cluster_picosnitch__ProcessManager {
+        }
+        subgraph cluster_picosnitch__process_manager {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.ProcessManager"];
-                picosnitch__ProcessManager__terminate [label="terminate", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
-            }
-            subgraph cluster_picosnitch__main_process {
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.process_manager"];
+            picosnitch__process_manager__ProcessManager [label="ProcessManager", style="filled", fillcolor="#99feffb2", fontcolor="#000000", group="7"];
+            subgraph cluster_picosnitch__process_manager__ProcessManager {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.main_process"];
-                picosnitch__main_process__clean_exit [label="clean_exit", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.process_manager.ProcessManager"];
+                picosnitch__process_manager__ProcessManager____init__ [label="__init__", style="filled", fillcolor="#65feffb2", fontcolor="#000000", group="7"];
             }
-            subgraph cluster_picosnitch__monitor_subprocess {
+            subgraph cluster_picosnitch__process_manager__ProcessManager {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.monitor_subprocess"];
-                picosnitch__monitor_subprocess__get_cmdline [label="get_cmdline", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.process_manager.ProcessManager"];
+                picosnitch__process_manager__ProcessManager__is_alive [label="is_alive", style="filled", fillcolor="#65feffb2", fontcolor="#000000", group="7"];
             }
-            subgraph cluster_picosnitch__monitor_subprocess {
+            subgraph cluster_picosnitch__process_manager__ProcessManager {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.monitor_subprocess"];
-                picosnitch__monitor_subprocess__get_fd [label="get_fd", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.process_manager.ProcessManager"];
+                picosnitch__process_manager__ProcessManager__is_zombie [label="is_zombie", style="filled", fillcolor="#65feffb2", fontcolor="#000000", group="7"];
             }
-            subgraph cluster_picosnitch__monitor_subprocess {
+            subgraph cluster_picosnitch__process_manager__ProcessManager {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.monitor_subprocess"];
-                picosnitch__monitor_subprocess__queue_dns_event [label="queue_dns_event", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.process_manager.ProcessManager"];
+                picosnitch__process_manager__ProcessManager__memory [label="memory", style="filled", fillcolor="#65feffb2", fontcolor="#000000", group="7"];
             }
-            subgraph cluster_picosnitch__monitor_subprocess {
+            subgraph cluster_picosnitch__process_manager__ProcessManager {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.monitor_subprocess"];
-                picosnitch__monitor_subprocess__queue_exec_event [label="queue_exec_event", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.process_manager.ProcessManager"];
+                picosnitch__process_manager__ProcessManager__start [label="start", style="filled", fillcolor="#65feffb2", fontcolor="#000000", group="7"];
             }
-            subgraph cluster_picosnitch__monitor_subprocess {
+            subgraph cluster_picosnitch__process_manager__ProcessManager {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.monitor_subprocess"];
-                picosnitch__monitor_subprocess__queue_lost [label="queue_lost", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.process_manager.ProcessManager"];
+                picosnitch__process_manager__ProcessManager__terminate [label="terminate", style="filled", fillcolor="#65feffb2", fontcolor="#000000", group="7"];
             }
-            subgraph cluster_picosnitch__monitor_subprocess {
+        }
+        subgraph cluster_picosnitch__rfuse_subprocess {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.monitor_subprocess"];
-                picosnitch__monitor_subprocess__queue_recvv4_event [label="queue_recvv4_event", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
-            }
-            subgraph cluster_picosnitch__monitor_subprocess {
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.rfuse_subprocess"];
+            picosnitch__rfuse_subprocess__rfuse_subprocess [label="rfuse_subprocess", style="filled", fillcolor="#99d3ffb2", fontcolor="#000000", group="8"];
+        }
+        subgraph cluster_picosnitch__secondary_subprocess {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.monitor_subprocess"];
-                picosnitch__monitor_subprocess__queue_recvv6_event [label="queue_recvv6_event", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
-            }
-            subgraph cluster_picosnitch__monitor_subprocess {
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.secondary_subprocess"];
+            picosnitch__secondary_subprocess__secondary_subprocess [label="secondary_subprocess", style="filled", fillcolor="#99a7ffb2", fontcolor="#000000", group="9"];
+        }
+        subgraph cluster_picosnitch__secondary_subprocess {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.monitor_subprocess"];
-                picosnitch__monitor_subprocess__queue_sendv4_event [label="queue_sendv4_event", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
-            }
-            subgraph cluster_picosnitch__monitor_subprocess {
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.secondary_subprocess"];
+            picosnitch__secondary_subprocess__secondary_subprocess_helper [label="secondary_subprocess_helper", style="filled", fillcolor="#99a7ffb2", fontcolor="#000000", group="9"];
+        }
+        subgraph cluster_picosnitch__secondary_subprocess {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.monitor_subprocess"];
-                picosnitch__monitor_subprocess__queue_sendv6_event [label="queue_sendv6_event", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
-            }
-            subgraph cluster_picosnitch__primary_subprocess {
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.secondary_subprocess"];
+            picosnitch__secondary_subprocess__secondary_subprocess_sha_wrapper [label="secondary_subprocess_sha_wrapper", style="filled", fillcolor="#99a7ffb2", fontcolor="#000000", group="9"];
+        }
+        subgraph cluster_picosnitch__user_interface {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.primary_subprocess"];
-                picosnitch__primary_subprocess__snitch_pipe_thread [label="snitch_pipe_thread", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
-            }
-            subgraph cluster_picosnitch__primary_subprocess {
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.user_interface"];
+            picosnitch__user_interface__ui_dash [label="ui_dash", style="filled", fillcolor="#b699ffb2", fontcolor="#000000", group="10"];
+        }
+        subgraph cluster_picosnitch__user_interface {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.primary_subprocess"];
-                picosnitch__primary_subprocess__write_snitch_and_exit [label="write_snitch_and_exit", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
-            }
-            subgraph cluster_picosnitch__start_picosnitch {
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.user_interface"];
+            picosnitch__user_interface__ui_geoip [label="ui_geoip", style="filled", fillcolor="#b699ffb2", fontcolor="#000000", group="10"];
+        }
+        subgraph cluster_picosnitch__user_interface {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.start_picosnitch"];
-                picosnitch__start_picosnitch__PicoDaemon [label="PicoDaemon", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
-            }
-            subgraph cluster_picosnitch__start_picosnitch {
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.user_interface"];
+            picosnitch__user_interface__ui_init [label="ui_init", style="filled", fillcolor="#b699ffb2", fontcolor="#000000", group="10"];
+        }
+        subgraph cluster_picosnitch__user_interface {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.start_picosnitch"];
-                picosnitch__start_picosnitch__delpid [label="delpid", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
-                subgraph cluster_picosnitch__start_picosnitch__PicoDaemon {
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.user_interface"];
+            picosnitch__user_interface__ui_loop [label="ui_loop", style="filled", fillcolor="#b699ffb2", fontcolor="#000000", group="10"];
+            subgraph cluster_picosnitch__user_interface__ui_dash {
 
-                    graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.start_picosnitch.PicoDaemon"];
-                    picosnitch__start_picosnitch__PicoDaemon__run [label="run", style="filled", fillcolor="#ff6565b2", fontcolor="#000000", group="0"];
-                }
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.user_interface.ui_dash"];
+                picosnitch__user_interface__ui_dash__display_time_range [label="display_time_range", style="filled", fillcolor="#9165ffb2", fontcolor="#000000", group="10"];
             }
-            subgraph cluster_picosnitch__ui_dash {
+            subgraph cluster_picosnitch__user_interface__ui_dash {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.ui_dash"];
-                picosnitch__ui_dash__display_time_range [label="display_time_range", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.user_interface.ui_dash"];
+                picosnitch__user_interface__ui_dash__exit [label="exit", style="filled", fillcolor="#9165ffb2", fontcolor="#000000", group="10"];
             }
-            subgraph cluster_picosnitch__ui_dash {
+            subgraph cluster_picosnitch__user_interface__ui_dash {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.ui_dash"];
-                picosnitch__ui_dash__exit [label="exit", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.user_interface.ui_dash"];
+                picosnitch__user_interface__ui_dash__get_geoip [label="get_geoip", style="filled", fillcolor="#9165ffb2", fontcolor="#000000", group="10"];
             }
-            subgraph cluster_picosnitch__ui_dash {
+            subgraph cluster_picosnitch__user_interface__ui_dash {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.ui_dash"];
-                picosnitch__ui_dash__get_geoip [label="get_geoip", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.user_interface.ui_dash"];
+                picosnitch__user_interface__ui_dash__get_totals [label="get_totals", style="filled", fillcolor="#9165ffb2", fontcolor="#000000", group="10"];
             }
-            subgraph cluster_picosnitch__ui_dash {
+            subgraph cluster_picosnitch__user_interface__ui_dash {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.ui_dash"];
-                picosnitch__ui_dash__get_totals [label="get_totals", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.user_interface.ui_dash"];
+                picosnitch__user_interface__ui_dash__get_user [label="get_user", style="filled", fillcolor="#9165ffb2", fontcolor="#000000", group="10"];
             }
-            subgraph cluster_picosnitch__ui_dash {
+            subgraph cluster_picosnitch__user_interface__ui_dash {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.ui_dash"];
-                picosnitch__ui_dash__get_user [label="get_user", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.user_interface.ui_dash"];
+                picosnitch__user_interface__ui_dash__serve_layout [label="serve_layout", style="filled", fillcolor="#9165ffb2", fontcolor="#000000", group="10"];
             }
-            subgraph cluster_picosnitch__ui_dash {
+            subgraph cluster_picosnitch__user_interface__ui_dash {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.ui_dash"];
-                picosnitch__ui_dash__serve_layout [label="serve_layout", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.user_interface.ui_dash"];
+                picosnitch__user_interface__ui_dash__toggle_refresh [label="toggle_refresh", style="filled", fillcolor="#9165ffb2", fontcolor="#000000", group="10"];
             }
-            subgraph cluster_picosnitch__ui_dash {
+            subgraph cluster_picosnitch__user_interface__ui_dash {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.ui_dash"];
-                picosnitch__ui_dash__toggle_refresh [label="toggle_refresh", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.user_interface.ui_dash"];
+                picosnitch__user_interface__ui_dash__trim_label [label="trim_label", style="filled", fillcolor="#9165ffb2", fontcolor="#000000", group="10"];
             }
-            subgraph cluster_picosnitch__ui_dash {
+            subgraph cluster_picosnitch__user_interface__ui_dash {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.ui_dash"];
-                picosnitch__ui_dash__trim_label [label="trim_label", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.user_interface.ui_dash"];
+                picosnitch__user_interface__ui_dash__update [label="update", style="filled", fillcolor="#9165ffb2", fontcolor="#000000", group="10"];
             }
-            subgraph cluster_picosnitch__ui_dash {
+            subgraph cluster_picosnitch__user_interface__ui_dash {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.ui_dash"];
-                picosnitch__ui_dash__update [label="update", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.user_interface.ui_dash"];
+                picosnitch__user_interface__ui_dash__update_time_slider_marks [label="update_time_slider_marks", style="filled", fillcolor="#9165ffb2", fontcolor="#000000", group="10"];
             }
-            subgraph cluster_picosnitch__ui_dash {
+            subgraph cluster_picosnitch__user_interface__ui_dash {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.ui_dash"];
-                picosnitch__ui_dash__update_time_slider_marks [label="update_time_slider_marks", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.user_interface.ui_dash"];
+                picosnitch__user_interface__ui_dash__update_time_slider_pos [label="update_time_slider_pos", style="filled", fillcolor="#9165ffb2", fontcolor="#000000", group="10"];
             }
-            subgraph cluster_picosnitch__ui_dash {
+            subgraph cluster_picosnitch__user_interface__ui_loop {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.ui_dash"];
-                picosnitch__ui_dash__update_time_slider_pos [label="update_time_slider_pos", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.user_interface.ui_loop"];
+                picosnitch__user_interface__ui_loop__fetch_query_results [label="fetch_query_results", style="filled", fillcolor="#9165ffb2", fontcolor="#000000", group="10"];
             }
-            subgraph cluster_picosnitch__ui_loop {
+            subgraph cluster_picosnitch__user_interface__ui_loop {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.ui_loop"];
-                picosnitch__ui_loop__fetch_query_results [label="fetch_query_results", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.user_interface.ui_loop"];
+                picosnitch__user_interface__ui_loop__get_geoip [label="get_geoip", style="filled", fillcolor="#9165ffb2", fontcolor="#000000", group="10"];
             }
-            subgraph cluster_picosnitch__ui_loop {
+        }
+        subgraph cluster_picosnitch__utils {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.ui_loop"];
-                picosnitch__ui_loop__get_geoip [label="get_geoip", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
-            }
-            subgraph cluster_picosnitch__virustotal_subprocess {
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.utils"];
+            picosnitch__utils__get_fanotify_events [label="get_fanotify_events", style="filled", fillcolor="#e199ffb2", fontcolor="#000000", group="11"];
+        }
+        subgraph cluster_picosnitch__utils {
+
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.utils"];
+            picosnitch__utils__get_fstat [label="get_fstat", style="filled", fillcolor="#e199ffb2", fontcolor="#000000", group="11"];
+        }
+        subgraph cluster_picosnitch__utils {
+
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.utils"];
+            picosnitch__utils__get_sha256_fd [label="get_sha256_fd", style="filled", fillcolor="#e199ffb2", fontcolor="#000000", group="11"];
+        }
+        subgraph cluster_picosnitch__utils {
+
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.utils"];
+            picosnitch__utils__get_sha256_fuse [label="get_sha256_fuse", style="filled", fillcolor="#e199ffb2", fontcolor="#000000", group="11"];
+        }
+        subgraph cluster_picosnitch__utils {
+
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.utils"];
+            picosnitch__utils__get_sha256_pid [label="get_sha256_pid", style="filled", fillcolor="#e199ffb2", fontcolor="#000000", group="11"];
+        }
+        subgraph cluster_picosnitch__utils {
+
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.utils"];
+            picosnitch__utils__get_vt_results [label="get_vt_results", style="filled", fillcolor="#e199ffb2", fontcolor="#000000", group="11"];
+        }
+        subgraph cluster_picosnitch__utils {
+
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.utils"];
+            picosnitch__utils__read_snitch [label="read_snitch", style="filled", fillcolor="#e199ffb2", fontcolor="#000000", group="11"];
+        }
+        subgraph cluster_picosnitch__utils {
+
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.utils"];
+            picosnitch__utils__reverse_dns_lookup [label="reverse_dns_lookup", style="filled", fillcolor="#e199ffb2", fontcolor="#000000", group="11"];
+        }
+        subgraph cluster_picosnitch__utils {
+
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.utils"];
+            picosnitch__utils__write_snitch [label="write_snitch", style="filled", fillcolor="#e199ffb2", fontcolor="#000000", group="11"];
+        }
+        subgraph cluster_picosnitch__virustotal_subprocess {
+
+            graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.virustotal_subprocess"];
+            picosnitch__virustotal_subprocess__virustotal_subprocess [label="virustotal_subprocess", style="filled", fillcolor="#ff99f0b2", fontcolor="#000000", group="12"];
+            subgraph cluster_picosnitch__virustotal_subprocess__virustotal_subprocess {
 
-                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.virustotal_subprocess"];
-                picosnitch__virustotal_subprocess__get_analysis [label="get_analysis", style="filled", fillcolor="#ff9999b2", fontcolor="#000000", group="0"];
+                graph [style="filled,rounded",fillcolor="#80808018", label="picosnitch.virustotal_subprocess.virustotal_subprocess"];
+                picosnitch__virustotal_subprocess__virustotal_subprocess__get_analysis [label="get_analysis", style="filled", fillcolor="#ff65e9b2", fontcolor="#000000", group="12"];
             }
         }
     }
-        picosnitch -> picosnitch__start_picosnitch [style="solid", color="#000000"];
-        picosnitch__Daemon__daemonize -> picosnitch__Daemon__delpid [style="solid", color="#000000"];
-        picosnitch__Daemon__restart -> picosnitch__Daemon__start [style="solid", color="#000000"];
-        picosnitch__Daemon__restart -> picosnitch__Daemon__stop [style="solid", color="#000000"];
-        picosnitch__Daemon__start -> picosnitch__Daemon__daemonize [style="solid", color="#000000"];
-        picosnitch__Daemon__start -> picosnitch__Daemon__getpid [style="solid", color="#000000"];
-        picosnitch__Daemon__start -> picosnitch__Daemon__run [style="solid", color="#000000"];
-        picosnitch__Daemon__status -> picosnitch__Daemon__getpid [style="solid", color="#000000"];
-        picosnitch__Daemon__stop -> picosnitch__Daemon__getpid [style="solid", color="#000000"];
-        picosnitch__NotificationManager__toast -> picosnitch__NotificationManager__enable_notifications [style="solid", color="#000000"];
-        picosnitch__ProcessManager____init__ -> picosnitch__ProcessManager__start [style="solid", color="#000000"];
-        picosnitch__get_fanotify_events -> picosnitch__FanotifyEventMetadata [style="solid", color="#000000"];
-        picosnitch__get_fanotify_events -> picosnitch__get_fstat [style="solid", color="#000000"];
-        picosnitch__get_sha256_fd -> picosnitch__get_fstat [style="solid", color="#000000"];
-        picosnitch__get_sha256_pid -> picosnitch__get_fstat [style="solid", color="#000000"];
-        picosnitch__main -> picosnitch__main_process [style="solid", color="#000000"];
-        picosnitch__main -> picosnitch__read_snitch [style="solid", color="#000000"];
-        picosnitch__main_process -> picosnitch__ProcessManager [style="solid", color="#000000"];
-        picosnitch__main_process -> picosnitch__ProcessManager____init__ [style="solid", color="#000000"];
-        picosnitch__main_process -> picosnitch__ProcessManager__is_alive [style="solid", color="#000000"];
-        picosnitch__main_process -> picosnitch__ProcessManager__is_zombie [style="solid", color="#000000"];
-        picosnitch__main_process -> picosnitch__ProcessManager__memory [style="solid", color="#000000"];
-        picosnitch__main_process -> picosnitch__ProcessManager__start [style="solid", color="#000000"];
-        picosnitch__main_process -> picosnitch__ProcessManager__terminate [style="solid", color="#000000"];
-        picosnitch__main_process -> picosnitch__main_process__clean_exit [style="solid", color="#000000"];
-        picosnitch__main_process -> picosnitch__monitor_subprocess [style="solid", color="#000000"];
-        picosnitch__main_process -> picosnitch__primary_subprocess [style="solid", color="#000000"];
-        picosnitch__main_process -> picosnitch__rfuse_subprocess [style="solid", color="#000000"];
-        picosnitch__main_process -> picosnitch__secondary_subprocess [style="solid", color="#000000"];
-        picosnitch__main_process -> picosnitch__virustotal_subprocess [style="solid", color="#000000"];
-        picosnitch__main_process__clean_exit -> picosnitch__ProcessManager [style="solid", color="#000000"];
-        picosnitch__main_process__clean_exit -> picosnitch__ProcessManager__terminate [style="solid", color="#000000"];
-        picosnitch__monitor_subprocess -> picosnitch__monitor_subprocess__get_cmdline [style="solid", color="#000000"];
-        picosnitch__monitor_subprocess -> picosnitch__monitor_subprocess__get_fd [style="solid", color="#000000"];
-        picosnitch__monitor_subprocess -> picosnitch__monitor_subprocess__queue_dns_event [style="solid", color="#000000"];
-        picosnitch__monitor_subprocess -> picosnitch__monitor_subprocess__queue_exec_event [style="solid", color="#000000"];
-        picosnitch__monitor_subprocess -> picosnitch__monitor_subprocess__queue_lost [style="solid", color="#000000"];
-        picosnitch__monitor_subprocess -> picosnitch__monitor_subprocess__queue_recvv4_event [style="solid", color="#000000"];
-        picosnitch__monitor_subprocess -> picosnitch__monitor_subprocess__queue_recvv6_event [style="solid", color="#000000"];
-        picosnitch__monitor_subprocess -> picosnitch__monitor_subprocess__queue_sendv4_event [style="solid", color="#000000"];
-        picosnitch__monitor_subprocess -> picosnitch__monitor_subprocess__queue_sendv6_event [style="solid", color="#000000"];
-        picosnitch__monitor_subprocess -> picosnitch__monitor_subprocess_initial_poll [style="solid", color="#000000"];
-        picosnitch__monitor_subprocess__get_fd -> picosnitch__get_fstat [style="solid", color="#000000"];
-        picosnitch__monitor_subprocess__queue_exec_event -> picosnitch__monitor_subprocess__get_cmdline [style="solid", color="#000000"];
-        picosnitch__monitor_subprocess__queue_exec_event -> picosnitch__monitor_subprocess__get_fd [style="solid", color="#000000"];
-        picosnitch__monitor_subprocess__queue_recvv4_event -> picosnitch__monitor_subprocess__get_cmdline [style="solid", color="#000000"];
-        picosnitch__monitor_subprocess__queue_recvv4_event -> picosnitch__monitor_subprocess__get_fd [style="solid", color="#000000"];
-        picosnitch__monitor_subprocess__queue_recvv6_event -> picosnitch__monitor_subprocess__get_cmdline [style="solid", color="#000000"];
-        picosnitch__monitor_subprocess__queue_recvv6_event -> picosnitch__monitor_subprocess__get_fd [style="solid", color="#000000"];
-        picosnitch__monitor_subprocess__queue_sendv4_event -> picosnitch__monitor_subprocess__get_cmdline [style="solid", color="#000000"];
-        picosnitch__monitor_subprocess__queue_sendv4_event -> picosnitch__monitor_subprocess__get_fd [style="solid", color="#000000"];
-        picosnitch__monitor_subprocess__queue_sendv6_event -> picosnitch__monitor_subprocess__get_cmdline [style="solid", color="#000000"];
-        picosnitch__monitor_subprocess__queue_sendv6_event -> picosnitch__monitor_subprocess__get_fd [style="solid", color="#000000"];
-        picosnitch__primary_subprocess -> picosnitch__NotificationManager__enable_notifications [style="solid", color="#000000"];
-        picosnitch__primary_subprocess -> picosnitch__NotificationManager__toast [style="solid", color="#000000"];
-        picosnitch__primary_subprocess -> picosnitch__primary_subprocess__snitch_pipe_thread [style="solid", color="#000000"];
-        picosnitch__primary_subprocess -> picosnitch__primary_subprocess__write_snitch_and_exit [style="solid", color="#000000"];
-        picosnitch__primary_subprocess -> picosnitch__primary_subprocess_helper [style="solid", color="#000000"];
-        picosnitch__primary_subprocess -> picosnitch__write_snitch [style="solid", color="#000000"];
-        picosnitch__primary_subprocess__write_snitch_and_exit -> picosnitch__NotificationManager__toast [style="solid", color="#000000"];
-        picosnitch__primary_subprocess__write_snitch_and_exit -> picosnitch__write_snitch [style="solid", color="#000000"];
-        picosnitch__primary_subprocess_helper -> picosnitch__NotificationManager__toast [style="solid", color="#000000"];
-        picosnitch__read_snitch -> picosnitch__write_snitch [style="solid", color="#000000"];
-        picosnitch__secondary_subprocess -> picosnitch__get_fanotify_events [style="solid", color="#000000"];
-        picosnitch__secondary_subprocess -> picosnitch__get_vt_results [style="solid", color="#000000"];
-        picosnitch__secondary_subprocess -> picosnitch__secondary_subprocess_helper [style="solid", color="#000000"];
-        picosnitch__secondary_subprocess_helper -> picosnitch__reverse_dns_lookup [style="solid", color="#000000"];
-        picosnitch__secondary_subprocess_helper -> picosnitch__secondary_subprocess_sha_wrapper [style="solid", color="#000000"];
-        picosnitch__secondary_subprocess_sha_wrapper -> picosnitch__get_sha256_fd [style="solid", color="#000000"];
-        picosnitch__secondary_subprocess_sha_wrapper -> picosnitch__get_sha256_fuse [style="solid", color="#000000"];
-        picosnitch__secondary_subprocess_sha_wrapper -> picosnitch__get_sha256_pid [style="solid", color="#000000"];
-        picosnitch__start_picosnitch -> picosnitch__Daemon__restart [style="solid", color="#000000"];
-        picosnitch__start_picosnitch -> picosnitch__Daemon__start [style="solid", color="#000000"];
-        picosnitch__start_picosnitch -> picosnitch__Daemon__status [style="solid", color="#000000"];
-        picosnitch__start_picosnitch -> picosnitch__Daemon__stop [style="solid", color="#000000"];
-        picosnitch__start_picosnitch -> picosnitch__ProcessManager__start [style="solid", color="#000000"];
-        picosnitch__start_picosnitch -> picosnitch__main [style="solid", color="#000000"];
-        picosnitch__start_picosnitch -> picosnitch__read_snitch [style="solid", color="#000000"];
-        picosnitch__start_picosnitch -> picosnitch__start_picosnitch__PicoDaemon [style="solid", color="#000000"];
-        picosnitch__start_picosnitch -> picosnitch__start_picosnitch__delpid [style="solid", color="#000000"];
-        picosnitch__start_picosnitch -> picosnitch__ui_dash [style="solid", color="#000000"];
-        picosnitch__start_picosnitch -> picosnitch__ui_init [style="solid", color="#000000"];
-        picosnitch__start_picosnitch__PicoDaemon -> picosnitch__Daemon [style="solid", color="#000000"];
-        picosnitch__start_picosnitch__PicoDaemon__run -> picosnitch__main [style="solid", color="#000000"];
-        picosnitch__ui_dash -> picosnitch__ui_dash__serve_layout [style="solid", color="#000000"];
-        picosnitch__ui_dash -> picosnitch__ui_geoip [style="solid", color="#000000"];
-        picosnitch__ui_dash__update -> picosnitch__ui_dash__get_geoip [style="solid", color="#000000"];
-        picosnitch__ui_dash__update -> picosnitch__ui_dash__get_totals [style="solid", color="#000000"];
-        picosnitch__ui_dash__update -> picosnitch__ui_dash__get_user [style="solid", color="#000000"];
-        picosnitch__ui_dash__update -> picosnitch__ui_dash__trim_label [style="solid", color="#000000"];
-        picosnitch__ui_dash__update -> picosnitch__ui_geoip [style="solid", color="#000000"];
-        picosnitch__ui_init -> picosnitch__ui_loop [style="solid", color="#000000"];
-        picosnitch__ui_loop -> picosnitch__ui_geoip [style="solid", color="#000000"];
-        picosnitch__ui_loop -> picosnitch__ui_loop__fetch_query_results [style="solid", color="#000000"];
-        picosnitch__ui_loop -> picosnitch__ui_loop__get_geoip [style="solid", color="#000000"];
-        picosnitch__virustotal_subprocess -> picosnitch__get_fstat [style="solid", color="#000000"];
-        picosnitch__virustotal_subprocess -> picosnitch__virustotal_subprocess__get_analysis [style="solid", color="#000000"];
-        picosnitch__write_snitch -> picosnitch__NotificationManager__toast [style="solid", color="#000000"];
+        picosnitch__cli -> picosnitch__cli__start_picosnitch [style="solid", color="#000000"];
+        picosnitch__cli__main -> picosnitch__main_process__main_process [style="solid", color="#000000"];
+        picosnitch__cli__main -> picosnitch__utils__read_snitch [style="solid", color="#000000"];
+        picosnitch__cli__start_picosnitch -> picosnitch__cli__main [style="solid", color="#000000"];
+        picosnitch__cli__start_picosnitch -> picosnitch__cli__start_picosnitch__PicoDaemon [style="solid", color="#000000"];
+        picosnitch__cli__start_picosnitch -> picosnitch__cli__start_picosnitch__delpid [style="solid", color="#000000"];
+        picosnitch__cli__start_picosnitch -> picosnitch__daemon__Daemon__restart [style="solid", color="#000000"];
+        picosnitch__cli__start_picosnitch -> picosnitch__daemon__Daemon__start [style="solid", color="#000000"];
+        picosnitch__cli__start_picosnitch -> picosnitch__daemon__Daemon__status [style="solid", color="#000000"];
+        picosnitch__cli__start_picosnitch -> picosnitch__daemon__Daemon__stop [style="solid", color="#000000"];
+        picosnitch__cli__start_picosnitch -> picosnitch__process_manager__ProcessManager__start [style="solid", color="#000000"];
+        picosnitch__cli__start_picosnitch -> picosnitch__user_interface__ui_dash [style="solid", color="#000000"];
+        picosnitch__cli__start_picosnitch -> picosnitch__user_interface__ui_init [style="solid", color="#000000"];
+        picosnitch__cli__start_picosnitch -> picosnitch__utils__read_snitch [style="solid", color="#000000"];
+        picosnitch__cli__start_picosnitch__PicoDaemon -> picosnitch__daemon__Daemon [style="solid", color="#000000"];
+        picosnitch__cli__start_picosnitch__PicoDaemon__run -> picosnitch__cli__main [style="solid", color="#000000"];
+        picosnitch__daemon__Daemon__daemonize -> picosnitch__daemon__Daemon__delpid [style="solid", color="#000000"];
+        picosnitch__daemon__Daemon__restart -> picosnitch__daemon__Daemon__start [style="solid", color="#000000"];
+        picosnitch__daemon__Daemon__restart -> picosnitch__daemon__Daemon__stop [style="solid", color="#000000"];
+        picosnitch__daemon__Daemon__start -> picosnitch__daemon__Daemon__daemonize [style="solid", color="#000000"];
+        picosnitch__daemon__Daemon__start -> picosnitch__daemon__Daemon__getpid [style="solid", color="#000000"];
+        picosnitch__daemon__Daemon__start -> picosnitch__daemon__Daemon__run [style="solid", color="#000000"];
+        picosnitch__daemon__Daemon__status -> picosnitch__daemon__Daemon__getpid [style="solid", color="#000000"];
+        picosnitch__daemon__Daemon__stop -> picosnitch__daemon__Daemon__getpid [style="solid", color="#000000"];
+        picosnitch__main_process__main_process -> picosnitch__main_process__main_process__clean_exit [style="solid", color="#000000"];
+        picosnitch__main_process__main_process -> picosnitch__monitor_subprocess__monitor_subprocess [style="solid", color="#000000"];
+        picosnitch__main_process__main_process -> picosnitch__primary_subprocess__primary_subprocess [style="solid", color="#000000"];
+        picosnitch__main_process__main_process -> picosnitch__process_manager__ProcessManager [style="solid", color="#000000"];
+        picosnitch__main_process__main_process -> picosnitch__process_manager__ProcessManager____init__ [style="solid", color="#000000"];
+        picosnitch__main_process__main_process -> picosnitch__process_manager__ProcessManager__is_alive [style="solid", color="#000000"];
+        picosnitch__main_process__main_process -> picosnitch__process_manager__ProcessManager__is_zombie [style="solid", color="#000000"];
+        picosnitch__main_process__main_process -> picosnitch__process_manager__ProcessManager__memory [style="solid", color="#000000"];
+        picosnitch__main_process__main_process -> picosnitch__process_manager__ProcessManager__start [style="solid", color="#000000"];
+        picosnitch__main_process__main_process -> picosnitch__process_manager__ProcessManager__terminate [style="solid", color="#000000"];
+        picosnitch__main_process__main_process -> picosnitch__rfuse_subprocess__rfuse_subprocess [style="solid", color="#000000"];
+        picosnitch__main_process__main_process -> picosnitch__secondary_subprocess__secondary_subprocess [style="solid", color="#000000"];
+        picosnitch__main_process__main_process -> picosnitch__virustotal_subprocess__virustotal_subprocess [style="solid", color="#000000"];
+        picosnitch__main_process__main_process__clean_exit -> picosnitch__process_manager__ProcessManager [style="solid", color="#000000"];
+        picosnitch__main_process__main_process__clean_exit -> picosnitch__process_manager__ProcessManager__terminate [style="solid", color="#000000"];
+        picosnitch__monitor_subprocess__monitor_subprocess -> picosnitch__monitor_subprocess__monitor_subprocess__get_cmdline [style="solid", color="#000000"];
+        picosnitch__monitor_subprocess__monitor_subprocess -> picosnitch__monitor_subprocess__monitor_subprocess__get_fd [style="solid", color="#000000"];
+        picosnitch__monitor_subprocess__monitor_subprocess -> picosnitch__monitor_subprocess__monitor_subprocess__queue_dns_event [style="solid", color="#000000"];
+        picosnitch__monitor_subprocess__monitor_subprocess -> picosnitch__monitor_subprocess__monitor_subprocess__queue_exec_event [style="solid", color="#000000"];
+        picosnitch__monitor_subprocess__monitor_subprocess -> picosnitch__monitor_subprocess__monitor_subprocess__queue_lost [style="solid", color="#000000"];
+        picosnitch__monitor_subprocess__monitor_subprocess -> picosnitch__monitor_subprocess__monitor_subprocess__queue_recvv4_event [style="solid", color="#000000"];
+        picosnitch__monitor_subprocess__monitor_subprocess -> picosnitch__monitor_subprocess__monitor_subprocess__queue_recvv6_event [style="solid", color="#000000"];
+        picosnitch__monitor_subprocess__monitor_subprocess -> picosnitch__monitor_subprocess__monitor_subprocess__queue_sendv4_event [style="solid", color="#000000"];
+        picosnitch__monitor_subprocess__monitor_subprocess -> picosnitch__monitor_subprocess__monitor_subprocess__queue_sendv6_event [style="solid", color="#000000"];
+        picosnitch__monitor_subprocess__monitor_subprocess -> picosnitch__monitor_subprocess__monitor_subprocess_initial_poll [style="solid", color="#000000"];
+        picosnitch__monitor_subprocess__monitor_subprocess__get_fd -> picosnitch__utils__get_fstat [style="solid", color="#000000"];
+        picosnitch__monitor_subprocess__monitor_subprocess__queue_exec_event -> picosnitch__monitor_subprocess__monitor_subprocess__get_cmdline [style="solid", color="#000000"];
+        picosnitch__monitor_subprocess__monitor_subprocess__queue_exec_event -> picosnitch__monitor_subprocess__monitor_subprocess__get_fd [style="solid", color="#000000"];
+        picosnitch__monitor_subprocess__monitor_subprocess__queue_recvv4_event -> picosnitch__monitor_subprocess__monitor_subprocess__get_cmdline [style="solid", color="#000000"];
+        picosnitch__monitor_subprocess__monitor_subprocess__queue_recvv4_event -> picosnitch__monitor_subprocess__monitor_subprocess__get_fd [style="solid", color="#000000"];
+        picosnitch__monitor_subprocess__monitor_subprocess__queue_recvv6_event -> picosnitch__monitor_subprocess__monitor_subprocess__get_cmdline [style="solid", color="#000000"];
+        picosnitch__monitor_subprocess__monitor_subprocess__queue_recvv6_event -> picosnitch__monitor_subprocess__monitor_subprocess__get_fd [style="solid", color="#000000"];
+        picosnitch__monitor_subprocess__monitor_subprocess__queue_sendv4_event -> picosnitch__monitor_subprocess__monitor_subprocess__get_cmdline [style="solid", color="#000000"];
+        picosnitch__monitor_subprocess__monitor_subprocess__queue_sendv4_event -> picosnitch__monitor_subprocess__monitor_subprocess__get_fd [style="solid", color="#000000"];
+        picosnitch__monitor_subprocess__monitor_subprocess__queue_sendv6_event -> picosnitch__monitor_subprocess__monitor_subprocess__get_cmdline [style="solid", color="#000000"];
+        picosnitch__monitor_subprocess__monitor_subprocess__queue_sendv6_event -> picosnitch__monitor_subprocess__monitor_subprocess__get_fd [style="solid", color="#000000"];
+        picosnitch__notifcation_manager__NotificationManager__toast -> picosnitch__notifcation_manager__NotificationManager__enable_notifications [style="solid", color="#000000"];
+        picosnitch__primary_subprocess__primary_subprocess -> picosnitch__notifcation_manager__NotificationManager__enable_notifications [style="solid", color="#000000"];
+        picosnitch__primary_subprocess__primary_subprocess -> picosnitch__notifcation_manager__NotificationManager__toast [style="solid", color="#000000"];
+        picosnitch__primary_subprocess__primary_subprocess -> picosnitch__primary_subprocess__primary_subprocess__snitch_pipe_thread [style="solid", color="#000000"];
+        picosnitch__primary_subprocess__primary_subprocess -> picosnitch__primary_subprocess__primary_subprocess__write_snitch_and_exit [style="solid", color="#000000"];
+        picosnitch__primary_subprocess__primary_subprocess -> picosnitch__primary_subprocess__primary_subprocess_helper [style="solid", color="#000000"];
+        picosnitch__primary_subprocess__primary_subprocess -> picosnitch__utils__write_snitch [style="solid", color="#000000"];
+        picosnitch__primary_subprocess__primary_subprocess__write_snitch_and_exit -> picosnitch__notifcation_manager__NotificationManager__toast [style="solid", color="#000000"];
+        picosnitch__primary_subprocess__primary_subprocess__write_snitch_and_exit -> picosnitch__utils__write_snitch [style="solid", color="#000000"];
+        picosnitch__primary_subprocess__primary_subprocess_helper -> picosnitch__notifcation_manager__NotificationManager__toast [style="solid", color="#000000"];
+        picosnitch__process_manager__ProcessManager____init__ -> picosnitch__process_manager__ProcessManager__start [style="solid", color="#000000"];
+        picosnitch__secondary_subprocess__secondary_subprocess -> picosnitch__secondary_subprocess__secondary_subprocess_helper [style="solid", color="#000000"];
+        picosnitch__secondary_subprocess__secondary_subprocess -> picosnitch__utils__get_fanotify_events [style="solid", color="#000000"];
+        picosnitch__secondary_subprocess__secondary_subprocess -> picosnitch__utils__get_vt_results [style="solid", color="#000000"];
+        picosnitch__secondary_subprocess__secondary_subprocess_helper -> picosnitch__secondary_subprocess__secondary_subprocess_sha_wrapper [style="solid", color="#000000"];
+        picosnitch__secondary_subprocess__secondary_subprocess_helper -> picosnitch__utils__reverse_dns_lookup [style="solid", color="#000000"];
+        picosnitch__secondary_subprocess__secondary_subprocess_sha_wrapper -> picosnitch__utils__get_sha256_fd [style="solid", color="#000000"];
+        picosnitch__secondary_subprocess__secondary_subprocess_sha_wrapper -> picosnitch__utils__get_sha256_fuse [style="solid", color="#000000"];
+        picosnitch__secondary_subprocess__secondary_subprocess_sha_wrapper -> picosnitch__utils__get_sha256_pid [style="solid", color="#000000"];
+        picosnitch__user_interface__ui_dash -> picosnitch__user_interface__ui_dash__serve_layout [style="solid", color="#000000"];
+        picosnitch__user_interface__ui_dash -> picosnitch__user_interface__ui_geoip [style="solid", color="#000000"];
+        picosnitch__user_interface__ui_dash__update -> picosnitch__user_interface__ui_dash__get_geoip [style="solid", color="#000000"];
+        picosnitch__user_interface__ui_dash__update -> picosnitch__user_interface__ui_dash__get_totals [style="solid", color="#000000"];
+        picosnitch__user_interface__ui_dash__update -> picosnitch__user_interface__ui_dash__get_user [style="solid", color="#000000"];
+        picosnitch__user_interface__ui_dash__update -> picosnitch__user_interface__ui_dash__trim_label [style="solid", color="#000000"];
+        picosnitch__user_interface__ui_dash__update -> picosnitch__user_interface__ui_geoip [style="solid", color="#000000"];
+        picosnitch__user_interface__ui_init -> picosnitch__user_interface__ui_loop [style="solid", color="#000000"];
+        picosnitch__user_interface__ui_loop -> picosnitch__user_interface__ui_geoip [style="solid", color="#000000"];
+        picosnitch__user_interface__ui_loop -> picosnitch__user_interface__ui_loop__fetch_query_results [style="solid", color="#000000"];
+        picosnitch__user_interface__ui_loop -> picosnitch__user_interface__ui_loop__get_geoip [style="solid", color="#000000"];
+        picosnitch__utils__get_fanotify_events -> picosnitch__event_structures__FanotifyEventMetadata [style="solid", color="#000000"];
+        picosnitch__utils__get_fanotify_events -> picosnitch__utils__get_fstat [style="solid", color="#000000"];
+        picosnitch__utils__get_sha256_fd -> picosnitch__utils__get_fstat [style="solid", color="#000000"];
+        picosnitch__utils__get_sha256_pid -> picosnitch__utils__get_fstat [style="solid", color="#000000"];
+        picosnitch__utils__read_snitch -> picosnitch__utils__write_snitch [style="solid", color="#000000"];
+        picosnitch__utils__write_snitch -> picosnitch__notifcation_manager__NotificationManager__toast [style="solid", color="#000000"];
+        picosnitch__virustotal_subprocess__virustotal_subprocess -> picosnitch__utils__get_fstat [style="solid", color="#000000"];
+        picosnitch__virustotal_subprocess__virustotal_subprocess -> picosnitch__virustotal_subprocess__virustotal_subprocess__get_analysis [style="solid", color="#000000"];
     }
diff --git a/docs/callgraph.py b/docs/callgraph.py
index 4fee917..954d7c4 100644
--- a/docs/callgraph.py
+++ b/docs/callgraph.py
@@ -4,7 +4,7 @@
 # generate call graph using pyan3==1.0.4
 print("Generating call graph for picosnitch")
 os.chdir(os.path.dirname(__file__))
-os.system("pyan3 ../picosnitch.py --no-defines --uses --colored --nested-groups --dot > callgraph.dot")
+os.system("pyan3 ../picosnitch/*.py --no-defines --uses --colored --nested-groups --dot > callgraph.dot")
 
 # sort edges so output is deterministic
 with open("callgraph.dot", "r") as f:
diff --git a/docs/callgraph.svg b/docs/callgraph.svg
index a9945fc..750a567 100644
--- a/docs/callgraph.svg
+++ b/docs/callgraph.svg
@@ -4,1130 +4,1262 @@
 <!-- Generated by graphviz version 2.43.0 (0)
  -->
 <!-- Title: G Pages: 1 -->
-<svg width="4327pt" height="832pt"
- viewBox="0.00 0.00 4327.00 832.00" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
-<g id="graph0" class="graph" transform="scale(1 1) rotate(0) translate(4 828)">
+<svg width="4809pt" height="1158pt"
+ viewBox="0.00 0.00 4809.00 1158.00" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<g id="graph0" class="graph" transform="scale(1 1) rotate(0) translate(4 1154)">
 <title>G</title>
-<polygon fill="white" stroke="transparent" points="-4,4 -4,-828 4323,-828 4323,4 -4,4"/>
+<polygon fill="white" stroke="transparent" points="-4,4 -4,-1154 4805,-1154 4805,4 -4,4"/>
 <g id="clust1" class="cluster">
 <title>cluster_G</title>
-<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M20,-8C20,-8 4299,-8 4299,-8 4305,-8 4311,-14 4311,-20 4311,-20 4311,-804 4311,-804 4311,-810 4305,-816 4299,-816 4299,-816 20,-816 20,-816 14,-816 8,-810 8,-804 8,-804 8,-20 8,-20 8,-14 14,-8 20,-8"/>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M20,-8C20,-8 4781,-8 4781,-8 4787,-8 4793,-14 4793,-20 4793,-20 4793,-1130 4793,-1130 4793,-1136 4787,-1142 4781,-1142 4781,-1142 20,-1142 20,-1142 14,-1142 8,-1136 8,-1130 8,-1130 8,-20 8,-20 8,-14 14,-8 20,-8"/>
 </g>
 <g id="clust2" class="cluster">
-<title>cluster_picosnitch</title>
-<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M28,-16C28,-16 4291,-16 4291,-16 4297,-16 4303,-22 4303,-28 4303,-28 4303,-752 4303,-752 4303,-758 4297,-764 4291,-764 4291,-764 28,-764 28,-764 22,-764 16,-758 16,-752 16,-752 16,-28 16,-28 16,-22 22,-16 28,-16"/>
-<text text-anchor="middle" x="2159.5" y="-748.8" font-family="Times,serif" font-size="14.00">picosnitch</text>
+<title>cluster_picosnitch__cli</title>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M1993,-787C1993,-787 2575,-787 2575,-787 2581,-787 2587,-793 2587,-799 2587,-799 2587,-1078 2587,-1078 2587,-1084 2581,-1090 2575,-1090 2575,-1090 1993,-1090 1993,-1090 1987,-1090 1981,-1084 1981,-1078 1981,-1078 1981,-799 1981,-799 1981,-793 1987,-787 1993,-787"/>
+<text text-anchor="middle" x="2284" y="-1074.8" font-family="Times,serif" font-size="14.00">picosnitch.cli</text>
 </g>
 <g id="clust3" class="cluster">
-<title>cluster_picosnitch__Daemon</title>
-<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M2948,-334C2948,-334 3230,-334 3230,-334 3236,-334 3242,-340 3242,-346 3242,-346 3242,-646 3242,-646 3242,-652 3236,-658 3230,-658 3230,-658 2948,-658 2948,-658 2942,-658 2936,-652 2936,-646 2936,-646 2936,-346 2936,-346 2936,-340 2942,-334 2948,-334"/>
-<text text-anchor="middle" x="3089" y="-642.8" font-family="Times,serif" font-size="14.00">picosnitch.Daemon</text>
+<title>cluster_picosnitch__cli__start_picosnitch</title>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M2011,-901C2011,-901 2567,-901 2567,-901 2573,-901 2579,-907 2579,-913 2579,-913 2579,-1003 2579,-1003 2579,-1009 2573,-1015 2567,-1015 2567,-1015 2011,-1015 2011,-1015 2005,-1015 1999,-1009 1999,-1003 1999,-1003 1999,-913 1999,-913 1999,-907 2005,-901 2011,-901"/>
+<text text-anchor="middle" x="2289" y="-999.8" font-family="Times,serif" font-size="14.00">picosnitch.cli.start_picosnitch</text>
 </g>
 <g id="clust4" class="cluster">
-<title>cluster_picosnitch__NotificationManager</title>
-<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M147,-24C147,-24 365,-24 365,-24 371,-24 377,-30 377,-36 377,-36 377,-159 377,-159 377,-165 371,-171 365,-171 365,-171 147,-171 147,-171 141,-171 135,-165 135,-159 135,-159 135,-36 135,-36 135,-30 141,-24 147,-24"/>
-<text text-anchor="middle" x="256" y="-155.8" font-family="Times,serif" font-size="14.00">picosnitch.NotificationManager</text>
+<title>cluster_picosnitch__cli__start_picosnitch__PicoDaemon</title>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M2019,-909C2019,-909 2317,-909 2317,-909 2323,-909 2329,-915 2329,-921 2329,-921 2329,-972 2329,-972 2329,-978 2323,-984 2317,-984 2317,-984 2019,-984 2019,-984 2013,-984 2007,-978 2007,-972 2007,-972 2007,-921 2007,-921 2007,-915 2013,-909 2019,-909"/>
+<text text-anchor="middle" x="2168" y="-968.8" font-family="Times,serif" font-size="14.00">picosnitch.cli.start_picosnitch.PicoDaemon</text>
 </g>
 <g id="clust5" class="cluster">
-<title>cluster_picosnitch__ProcessManager</title>
-<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M1649,-179C1649,-179 2215,-179 2215,-179 2221,-179 2227,-185 2227,-191 2227,-191 2227,-314 2227,-314 2227,-320 2221,-326 2215,-326 2215,-326 1649,-326 1649,-326 1643,-326 1637,-320 1637,-314 1637,-314 1637,-191 1637,-191 1637,-185 1643,-179 1649,-179"/>
-<text text-anchor="middle" x="1932" y="-310.8" font-family="Times,serif" font-size="14.00">picosnitch.ProcessManager</text>
+<title>cluster_picosnitch__daemon</title>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M4369,-483C4369,-483 4773,-483 4773,-483 4779,-483 4785,-489 4785,-495 4785,-495 4785,-881 4785,-881 4785,-887 4779,-893 4773,-893 4773,-893 4369,-893 4369,-893 4363,-893 4357,-887 4357,-881 4357,-881 4357,-495 4357,-495 4357,-489 4363,-483 4369,-483"/>
+<text text-anchor="middle" x="4571" y="-877.8" font-family="Times,serif" font-size="14.00">picosnitch.daemon</text>
 </g>
 <g id="clust6" class="cluster">
-<title>cluster_picosnitch__main_process</title>
-<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M2103,-334C2103,-334 2270,-334 2270,-334 2276,-334 2282,-340 2282,-346 2282,-346 2282,-397 2282,-397 2282,-403 2276,-409 2270,-409 2270,-409 2103,-409 2103,-409 2097,-409 2091,-403 2091,-397 2091,-397 2091,-346 2091,-346 2091,-340 2097,-334 2103,-334"/>
-<text text-anchor="middle" x="2186.5" y="-393.8" font-family="Times,serif" font-size="14.00">picosnitch.main_process</text>
+<title>cluster_picosnitch__daemon__Daemon</title>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M4483,-491C4483,-491 4765,-491 4765,-491 4771,-491 4777,-497 4777,-503 4777,-503 4777,-850 4777,-850 4777,-856 4771,-862 4765,-862 4765,-862 4483,-862 4483,-862 4477,-862 4471,-856 4471,-850 4471,-850 4471,-503 4471,-503 4471,-497 4477,-491 4483,-491"/>
+<text text-anchor="middle" x="4624" y="-846.8" font-family="Times,serif" font-size="14.00">picosnitch.daemon.Daemon</text>
 </g>
 <g id="clust7" class="cluster">
-<title>cluster_picosnitch__monitor_subprocess</title>
-<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M2847,-179C2847,-179 4283,-179 4283,-179 4289,-179 4295,-185 4295,-191 4295,-191 4295,-314 4295,-314 4295,-320 4289,-326 4283,-326 4283,-326 2847,-326 2847,-326 2841,-326 2835,-320 2835,-314 2835,-314 2835,-191 2835,-191 2835,-185 2841,-179 2847,-179"/>
-<text text-anchor="middle" x="3565" y="-310.8" font-family="Times,serif" font-size="14.00">picosnitch.monitor_subprocess</text>
+<title>cluster_picosnitch__event_structures</title>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M462,-218C462,-218 820,-218 820,-218 826,-218 832,-224 832,-230 832,-230 832,-281 832,-281 832,-287 826,-293 820,-293 820,-293 462,-293 462,-293 456,-293 450,-287 450,-281 450,-281 450,-230 450,-230 450,-224 456,-218 462,-218"/>
+<text text-anchor="middle" x="641" y="-277.8" font-family="Times,serif" font-size="14.00">picosnitch.event_structures</text>
 </g>
 <g id="clust8" class="cluster">
-<title>cluster_picosnitch__primary_subprocess</title>
-<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M88,-251C88,-251 518,-251 518,-251 524,-251 530,-257 530,-263 530,-263 530,-314 530,-314 530,-320 524,-326 518,-326 518,-326 88,-326 88,-326 82,-326 76,-320 76,-314 76,-314 76,-263 76,-263 76,-257 82,-251 88,-251"/>
-<text text-anchor="middle" x="303" y="-310.8" font-family="Times,serif" font-size="14.00">picosnitch.primary_subprocess</text>
+<title>cluster_picosnitch__main_process</title>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M1163,-605C1163,-605 1447,-605 1447,-605 1453,-605 1459,-611 1459,-617 1459,-617 1459,-767 1459,-767 1459,-773 1453,-779 1447,-779 1447,-779 1163,-779 1163,-779 1157,-779 1151,-773 1151,-767 1151,-767 1151,-617 1151,-617 1151,-611 1157,-605 1163,-605"/>
+<text text-anchor="middle" x="1305" y="-763.8" font-family="Times,serif" font-size="14.00">picosnitch.main_process</text>
 </g>
 <g id="clust9" class="cluster">
-<title>cluster_picosnitch__start_picosnitch</title>
-<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M1894,-575C1894,-575 2429,-575 2429,-575 2435,-575 2441,-581 2441,-587 2441,-587 2441,-677 2441,-677 2441,-683 2435,-689 2429,-689 2429,-689 1894,-689 1894,-689 1888,-689 1882,-683 1882,-677 1882,-677 1882,-587 1882,-587 1882,-581 1888,-575 1894,-575"/>
-<text text-anchor="middle" x="2161.5" y="-673.8" font-family="Times,serif" font-size="14.00">picosnitch.start_picosnitch</text>
+<title>cluster_picosnitch__main_process__main_process</title>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M1171,-613C1171,-613 1439,-613 1439,-613 1445,-613 1451,-619 1451,-625 1451,-625 1451,-676 1451,-676 1451,-682 1445,-688 1439,-688 1439,-688 1171,-688 1171,-688 1165,-688 1159,-682 1159,-676 1159,-676 1159,-625 1159,-625 1159,-619 1165,-613 1171,-613"/>
+<text text-anchor="middle" x="1305" y="-672.8" font-family="Times,serif" font-size="14.00">picosnitch.main_process.main_process</text>
 </g>
 <g id="clust10" class="cluster">
-<title>cluster_picosnitch__start_picosnitch__PicoDaemon</title>
-<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M1902,-583C1902,-583 2179,-583 2179,-583 2185,-583 2191,-589 2191,-595 2191,-595 2191,-646 2191,-646 2191,-652 2185,-658 2179,-658 2179,-658 1902,-658 1902,-658 1896,-658 1890,-652 1890,-646 1890,-646 1890,-595 1890,-595 1890,-589 1896,-583 1902,-583"/>
-<text text-anchor="middle" x="2040.5" y="-642.8" font-family="Times,serif" font-size="14.00">picosnitch.start_picosnitch.PicoDaemon</text>
+<title>cluster_picosnitch__monitor_subprocess</title>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M2166,-301C2166,-301 3973,-301 3973,-301 3979,-301 3985,-307 3985,-313 3985,-313 3985,-554 3985,-554 3985,-560 3979,-566 3973,-566 3973,-566 2166,-566 2166,-566 2160,-566 2154,-560 2154,-554 2154,-554 2154,-313 2154,-313 2154,-307 2160,-301 2166,-301"/>
+<text text-anchor="middle" x="3069.5" y="-550.8" font-family="Times,serif" font-size="14.00">picosnitch.monitor_subprocess</text>
 </g>
 <g id="clust11" class="cluster">
-<title>cluster_picosnitch__ui_dash</title>
-<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M57,-417C57,-417 1301,-417 1301,-417 1307,-417 1313,-423 1313,-429 1313,-429 1313,-555 1313,-555 1313,-561 1307,-567 1301,-567 1301,-567 57,-567 57,-567 51,-567 45,-561 45,-555 45,-555 45,-429 45,-429 45,-423 51,-417 57,-417"/>
-<text text-anchor="middle" x="679" y="-551.8" font-family="Times,serif" font-size="14.00">picosnitch.ui_dash</text>
+<title>cluster_picosnitch__monitor_subprocess__monitor_subprocess</title>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M2497,-309C2497,-309 3933,-309 3933,-309 3939,-309 3945,-315 3945,-321 3945,-321 3945,-463 3945,-463 3945,-469 3939,-475 3933,-475 3933,-475 2497,-475 2497,-475 2491,-475 2485,-469 2485,-463 2485,-463 2485,-321 2485,-321 2485,-315 2491,-309 2497,-309"/>
+<text text-anchor="middle" x="3215" y="-459.8" font-family="Times,serif" font-size="14.00">picosnitch.monitor_subprocess.monitor_subprocess</text>
 </g>
 <g id="clust12" class="cluster">
-<title>cluster_picosnitch__ui_loop</title>
-<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M1441,-417C1441,-417 1767,-417 1767,-417 1773,-417 1779,-423 1779,-429 1779,-429 1779,-480 1779,-480 1779,-486 1773,-492 1767,-492 1767,-492 1441,-492 1441,-492 1435,-492 1429,-486 1429,-480 1429,-480 1429,-429 1429,-429 1429,-423 1435,-417 1441,-417"/>
-<text text-anchor="middle" x="1604" y="-476.8" font-family="Times,serif" font-size="14.00">picosnitch.ui_loop</text>
+<title>cluster_picosnitch__notifcation_manager</title>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M3784,-16C3784,-16 4389,-16 4389,-16 4395,-16 4401,-22 4401,-28 4401,-28 4401,-190 4401,-190 4401,-196 4395,-202 4389,-202 4389,-202 3784,-202 3784,-202 3778,-202 3772,-196 3772,-190 3772,-190 3772,-28 3772,-28 3772,-22 3778,-16 3784,-16"/>
+<text text-anchor="middle" x="4086.5" y="-186.8" font-family="Times,serif" font-size="14.00">picosnitch.notifcation_manager</text>
 </g>
 <g id="clust13" class="cluster">
+<title>cluster_picosnitch__notifcation_manager__NotificationManager</title>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M4014,-24C4014,-24 4381,-24 4381,-24 4387,-24 4393,-30 4393,-36 4393,-36 4393,-159 4393,-159 4393,-165 4387,-171 4381,-171 4381,-171 4014,-171 4014,-171 4008,-171 4002,-165 4002,-159 4002,-159 4002,-36 4002,-36 4002,-30 4008,-24 4014,-24"/>
+<text text-anchor="middle" x="4197.5" y="-155.8" font-family="Times,serif" font-size="14.00">picosnitch.notifcation_manager.NotificationManager</text>
+</g>
+<g id="clust14" class="cluster">
+<title>cluster_picosnitch__primary_subprocess</title>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M4029,-301C4029,-301 4761,-301 4761,-301 4767,-301 4773,-307 4773,-313 4773,-313 4773,-463 4773,-463 4773,-469 4767,-475 4761,-475 4761,-475 4029,-475 4029,-475 4023,-475 4017,-469 4017,-463 4017,-463 4017,-313 4017,-313 4017,-307 4023,-301 4029,-301"/>
+<text text-anchor="middle" x="4395" y="-459.8" font-family="Times,serif" font-size="14.00">picosnitch.primary_subprocess</text>
+</g>
+<g id="clust15" class="cluster">
+<title>cluster_picosnitch__primary_subprocess__primary_subprocess</title>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M4037,-309C4037,-309 4467,-309 4467,-309 4473,-309 4479,-315 4479,-321 4479,-321 4479,-372 4479,-372 4479,-378 4473,-384 4467,-384 4467,-384 4037,-384 4037,-384 4031,-384 4025,-378 4025,-372 4025,-372 4025,-321 4025,-321 4025,-315 4031,-309 4037,-309"/>
+<text text-anchor="middle" x="4252" y="-368.8" font-family="Times,serif" font-size="14.00">picosnitch.primary_subprocess.primary_subprocess</text>
+</g>
+<g id="clust16" class="cluster">
+<title>cluster_picosnitch__process_manager</title>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M691,-392C691,-392 1459,-392 1459,-392 1465,-392 1471,-398 1471,-404 1471,-404 1471,-585 1471,-585 1471,-591 1465,-597 1459,-597 1459,-597 691,-597 691,-597 685,-597 679,-591 679,-585 679,-585 679,-404 679,-404 679,-398 685,-392 691,-392"/>
+<text text-anchor="middle" x="1075" y="-581.8" font-family="Times,serif" font-size="14.00">picosnitch.process_manager</text>
+</g>
+<g id="clust17" class="cluster">
+<title>cluster_picosnitch__process_manager__ProcessManager</title>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M885,-400C885,-400 1451,-400 1451,-400 1457,-400 1463,-406 1463,-412 1463,-412 1463,-554 1463,-554 1463,-560 1457,-566 1451,-566 1451,-566 885,-566 885,-566 879,-566 873,-560 873,-554 873,-554 873,-412 873,-412 873,-406 879,-400 885,-400"/>
+<text text-anchor="middle" x="1168" y="-550.8" font-family="Times,serif" font-size="14.00">picosnitch.process_manager.ProcessManager</text>
+</g>
+<g id="clust18" class="cluster">
+<title>cluster_picosnitch__rfuse_subprocess</title>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M937,-613C937,-613 1131,-613 1131,-613 1137,-613 1143,-619 1143,-625 1143,-625 1143,-676 1143,-676 1143,-682 1137,-688 1131,-688 1131,-688 937,-688 937,-688 931,-688 925,-682 925,-676 925,-676 925,-625 925,-625 925,-619 931,-613 937,-613"/>
+<text text-anchor="middle" x="1034" y="-672.8" font-family="Times,serif" font-size="14.00">picosnitch.rfuse_subprocess</text>
+</g>
+<g id="clust19" class="cluster">
+<title>cluster_picosnitch__secondary_subprocess</title>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M1523,-400C1523,-400 1873,-400 1873,-400 1879,-400 1885,-406 1885,-412 1885,-412 1885,-676 1885,-676 1885,-682 1879,-688 1873,-688 1873,-688 1523,-688 1523,-688 1517,-688 1511,-682 1511,-676 1511,-676 1511,-412 1511,-412 1511,-406 1517,-400 1523,-400"/>
+<text text-anchor="middle" x="1698" y="-672.8" font-family="Times,serif" font-size="14.00">picosnitch.secondary_subprocess</text>
+</g>
+<g id="clust20" class="cluster">
+<title>cluster_picosnitch__user_interface</title>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M2611,-696C2611,-696 4337,-696 4337,-696 4343,-696 4349,-702 4349,-708 4349,-708 4349,-972 4349,-972 4349,-978 4343,-984 4337,-984 4337,-984 2611,-984 2611,-984 2605,-984 2599,-978 2599,-972 2599,-972 2599,-708 2599,-708 2599,-702 2605,-696 2611,-696"/>
+<text text-anchor="middle" x="3474" y="-968.8" font-family="Times,serif" font-size="14.00">picosnitch.user_interface</text>
+</g>
+<g id="clust21" class="cluster">
+<title>cluster_picosnitch__user_interface__ui_dash</title>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M3085,-704C3085,-704 4329,-704 4329,-704 4335,-704 4341,-710 4341,-716 4341,-716 4341,-850 4341,-850 4341,-856 4335,-862 4329,-862 4329,-862 3085,-862 3085,-862 3079,-862 3073,-856 3073,-850 3073,-850 3073,-716 3073,-716 3073,-710 3079,-704 3085,-704"/>
+<text text-anchor="middle" x="3707" y="-846.8" font-family="Times,serif" font-size="14.00">picosnitch.user_interface.ui_dash</text>
+</g>
+<g id="clust22" class="cluster">
+<title>cluster_picosnitch__user_interface__ui_loop</title>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M2619,-704C2619,-704 2945,-704 2945,-704 2951,-704 2957,-710 2957,-716 2957,-716 2957,-767 2957,-767 2957,-773 2951,-779 2945,-779 2945,-779 2619,-779 2619,-779 2613,-779 2607,-773 2607,-767 2607,-767 2607,-716 2607,-716 2607,-710 2613,-704 2619,-704"/>
+<text text-anchor="middle" x="2782" y="-763.8" font-family="Times,serif" font-size="14.00">picosnitch.user_interface.ui_loop</text>
+</g>
+<g id="clust23" class="cluster">
+<title>cluster_picosnitch__utils</title>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M852,-218C852,-218 2134,-218 2134,-218 2140,-218 2146,-224 2146,-230 2146,-230 2146,-372 2146,-372 2146,-378 2140,-384 2134,-384 2134,-384 852,-384 852,-384 846,-384 840,-378 840,-372 840,-372 840,-230 840,-230 840,-224 846,-218 852,-218"/>
+<text text-anchor="middle" x="1493" y="-368.8" font-family="Times,serif" font-size="14.00">picosnitch.utils</text>
+</g>
+<g id="clust24" class="cluster">
 <title>cluster_picosnitch__virustotal_subprocess</title>
-<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M1391,-251C1391,-251 1617,-251 1617,-251 1623,-251 1629,-257 1629,-263 1629,-263 1629,-314 1629,-314 1629,-320 1623,-326 1617,-326 1617,-326 1391,-326 1391,-326 1385,-326 1379,-320 1379,-314 1379,-314 1379,-263 1379,-263 1379,-257 1385,-251 1391,-251"/>
-<text text-anchor="middle" x="1504" y="-310.8" font-family="Times,serif" font-size="14.00">picosnitch.virustotal_subprocess</text>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M28,-210C28,-210 430,-210 430,-210 436,-210 442,-216 442,-222 442,-222 442,-372 442,-372 442,-378 436,-384 430,-384 430,-384 28,-384 28,-384 22,-384 16,-378 16,-372 16,-372 16,-222 16,-222 16,-216 22,-210 28,-210"/>
+<text text-anchor="middle" x="229" y="-368.8" font-family="Times,serif" font-size="14.00">picosnitch.virustotal_subprocess</text>
+</g>
+<g id="clust25" class="cluster">
+<title>cluster_picosnitch__virustotal_subprocess__virustotal_subprocess</title>
+<path fill="#808080" fill-opacity="0.094118" stroke="black" d="M36,-218C36,-218 422,-218 422,-218 428,-218 434,-224 434,-230 434,-230 434,-281 434,-281 434,-287 428,-293 422,-293 422,-293 36,-293 36,-293 30,-293 24,-287 24,-281 24,-281 24,-230 24,-230 24,-224 30,-218 36,-218"/>
+<text text-anchor="middle" x="229" y="-277.8" font-family="Times,serif" font-size="14.00">picosnitch.virustotal_subprocess.virustotal_subprocess</text>
 </g>
-<!-- picosnitch -->
+<!-- picosnitch__cli -->
 <g id="node1" class="node">
-<title>picosnitch</title>
-<ellipse fill="#ffffff" fill-opacity="0.698039" stroke="black" cx="2365" cy="-790" rx="57.69" ry="18"/>
-<text text-anchor="middle" x="2365" y="-786.3" font-family="Times,serif" font-size="14.00" fill="#000000">picosnitch</text>
+<title>picosnitch__cli</title>
+<ellipse fill="#ffffff" fill-opacity="0.698039" stroke="black" cx="3594" cy="-1116" rx="71.49" ry="18"/>
+<text text-anchor="middle" x="3594" y="-1112.3" font-family="Times,serif" font-size="14.00" fill="#000000">picosnitch.cli</text>
 </g>
-<!-- picosnitch__start_picosnitch -->
-<g id="node25" class="node">
-<title>picosnitch__start_picosnitch</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="2365" cy="-715" rx="85.29" ry="18"/>
-<text text-anchor="middle" x="2365" y="-711.3" font-family="Times,serif" font-size="14.00" fill="#000000">start_picosnitch</text>
+<!-- picosnitch__cli__start_picosnitch -->
+<g id="node15" class="node">
+<title>picosnitch__cli__start_picosnitch</title>
+<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="2494" cy="-1041" rx="85.29" ry="18"/>
+<text text-anchor="middle" x="2494" y="-1037.3" font-family="Times,serif" font-size="14.00" fill="#000000">start_picosnitch</text>
 </g>
-<!-- picosnitch&#45;&gt;picosnitch__start_picosnitch -->
+<!-- picosnitch__cli&#45;&gt;picosnitch__cli__start_picosnitch -->
 <g id="edge1" class="edge">
-<title>picosnitch&#45;&gt;picosnitch__start_picosnitch</title>
-<path fill="none" stroke="#000000" d="M2365,-771.7C2365,-763.25 2365,-752.87 2365,-743.37"/>
-<polygon fill="#000000" stroke="#000000" points="2368.5,-743.18 2365,-733.18 2361.5,-743.18 2368.5,-743.18"/>
+<title>picosnitch__cli&#45;&gt;picosnitch__cli__start_picosnitch</title>
+<path fill="none" stroke="#000000" d="M3543.65,-1103.2C3533.55,-1101.18 3522.97,-1099.31 3513,-1098 3175.09,-1053.52 2769.65,-1044.27 2588.95,-1042.41"/>
+<polygon fill="#000000" stroke="#000000" points="2588.98,-1038.91 2578.95,-1042.32 2588.91,-1045.91 2588.98,-1038.91"/>
 </g>
-<!-- picosnitch__BpfEvent -->
+<!-- picosnitch__daemon -->
 <g id="node2" class="node">
-<title>picosnitch__BpfEvent</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="3869" cy="-715" rx="53.89" ry="18"/>
-<text text-anchor="middle" x="3869" y="-711.3" font-family="Times,serif" font-size="14.00" fill="#000000">BpfEvent</text>
+<title>picosnitch__daemon</title>
+<ellipse fill="#ffffff" fill-opacity="0.698039" stroke="black" cx="3407" cy="-1116" rx="97.48" ry="18"/>
+<text text-anchor="middle" x="3407" y="-1112.3" font-family="Times,serif" font-size="14.00" fill="#000000">picosnitch.daemon</text>
 </g>
-<!-- picosnitch__Daemon -->
+<!-- picosnitch__event_structures -->
 <g id="node3" class="node">
-<title>picosnitch__Daemon</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="2365" cy="-518" rx="48.99" ry="18"/>
-<text text-anchor="middle" x="2365" y="-514.3" font-family="Times,serif" font-size="14.00" fill="#000000">Daemon</text>
+<title>picosnitch__event_structures</title>
+<ellipse fill="#ffffff" fill-opacity="0.698039" stroke="black" cx="3152" cy="-1116" rx="139.98" ry="18"/>
+<text text-anchor="middle" x="3152" y="-1112.3" font-family="Times,serif" font-size="14.00" fill="#000000">picosnitch.event_structures</text>
 </g>
-<!-- picosnitch__FanotifyEventMetadata -->
+<!-- picosnitch__main_process -->
 <g id="node4" class="node">
-<title>picosnitch__FanotifyEventMetadata</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="1250" cy="-205" rx="120.48" ry="18"/>
-<text text-anchor="middle" x="1250" y="-201.3" font-family="Times,serif" font-size="14.00" fill="#000000">FanotifyEventMetadata</text>
+<title>picosnitch__main_process</title>
+<ellipse fill="#ffffff" fill-opacity="0.698039" stroke="black" cx="2870" cy="-1116" rx="124.28" ry="18"/>
+<text text-anchor="middle" x="2870" y="-1112.3" font-family="Times,serif" font-size="14.00" fill="#000000">picosnitch.main_process</text>
 </g>
-<!-- picosnitch__NotificationManager -->
+<!-- picosnitch__monitor_subprocess -->
 <g id="node5" class="node">
-<title>picosnitch__NotificationManager</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="3318" cy="-715" rx="106.68" ry="18"/>
-<text text-anchor="middle" x="3318" y="-711.3" font-family="Times,serif" font-size="14.00" fill="#000000">NotificationManager</text>
+<title>picosnitch__monitor_subprocess</title>
+<ellipse fill="#ffffff" fill-opacity="0.698039" stroke="black" cx="2574" cy="-1116" rx="154.07" ry="18"/>
+<text text-anchor="middle" x="2574" y="-1112.3" font-family="Times,serif" font-size="14.00" fill="#000000">picosnitch.monitor_subprocess</text>
 </g>
-<!-- picosnitch__ProcessManager -->
+<!-- picosnitch__notifcation_manager -->
 <g id="node6" class="node">
-<title>picosnitch__ProcessManager</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="2325" cy="-277" rx="88.28" ry="18"/>
-<text text-anchor="middle" x="2325" y="-273.3" font-family="Times,serif" font-size="14.00" fill="#000000">ProcessManager</text>
+<title>picosnitch__notifcation_manager</title>
+<ellipse fill="#ffffff" fill-opacity="0.698039" stroke="black" cx="2246" cy="-1116" rx="155.97" ry="18"/>
+<text text-anchor="middle" x="2246" y="-1112.3" font-family="Times,serif" font-size="14.00" fill="#000000">picosnitch.notifcation_manager</text>
 </g>
-<!-- picosnitch__get_fanotify_events -->
+<!-- picosnitch__primary_subprocess -->
 <g id="node7" class="node">
-<title>picosnitch__get_fanotify_events</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="1250" cy="-277" rx="100.98" ry="18"/>
-<text text-anchor="middle" x="1250" y="-273.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_fanotify_events</text>
-</g>
-<!-- picosnitch__get_fanotify_events&#45;&gt;picosnitch__FanotifyEventMetadata -->
-<g id="edge12" class="edge">
-<title>picosnitch__get_fanotify_events&#45;&gt;picosnitch__FanotifyEventMetadata</title>
-<path fill="none" stroke="#000000" d="M1250,-258.7C1250,-250.98 1250,-241.71 1250,-233.11"/>
-<polygon fill="#000000" stroke="#000000" points="1253.5,-233.1 1250,-223.1 1246.5,-233.1 1253.5,-233.1"/>
+<title>picosnitch__primary_subprocess</title>
+<ellipse fill="#ffffff" fill-opacity="0.698039" stroke="black" cx="1917" cy="-1116" rx="154.87" ry="18"/>
+<text text-anchor="middle" x="1917" y="-1112.3" font-family="Times,serif" font-size="14.00" fill="#000000">picosnitch.primary_subprocess</text>
 </g>
-<!-- picosnitch__get_fstat -->
+<!-- picosnitch__process_manager -->
 <g id="node8" class="node">
-<title>picosnitch__get_fstat</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="1389" cy="-50" rx="51.99" ry="18"/>
-<text text-anchor="middle" x="1389" y="-46.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_fstat</text>
+<title>picosnitch__process_manager</title>
+<ellipse fill="#ffffff" fill-opacity="0.698039" stroke="black" cx="1603" cy="-1116" rx="141.88" ry="18"/>
+<text text-anchor="middle" x="1603" y="-1112.3" font-family="Times,serif" font-size="14.00" fill="#000000">picosnitch.process_manager</text>
 </g>
-<!-- picosnitch__get_fanotify_events&#45;&gt;picosnitch__get_fstat -->
-<g id="edge13" class="edge">
-<title>picosnitch__get_fanotify_events&#45;&gt;picosnitch__get_fstat</title>
-<path fill="none" stroke="#000000" d="M1317.64,-263.59C1340.81,-255.85 1364.52,-243.3 1379,-223 1409.67,-180 1402.79,-114.49 1395.57,-77.98"/>
-<polygon fill="#000000" stroke="#000000" points="1398.96,-77.12 1393.45,-68.07 1392.11,-78.58 1398.96,-77.12"/>
-</g>
-<!-- picosnitch__get_sha256_fd -->
+<!-- picosnitch__rfuse_subprocess -->
 <g id="node9" class="node">
-<title>picosnitch__get_sha256_fd</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="1108" cy="-122" rx="77.19" ry="18"/>
-<text text-anchor="middle" x="1108" y="-118.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_sha256_fd</text>
-</g>
-<!-- picosnitch__get_sha256_fd&#45;&gt;picosnitch__get_fstat -->
-<g id="edge14" class="edge">
-<title>picosnitch__get_sha256_fd&#45;&gt;picosnitch__get_fstat</title>
-<path fill="none" stroke="#000000" d="M1158.89,-108.32C1209.74,-95.65 1287.49,-76.29 1338.28,-63.63"/>
-<polygon fill="#000000" stroke="#000000" points="1339.21,-67.01 1348.07,-61.2 1337.52,-60.22 1339.21,-67.01"/>
+<title>picosnitch__rfuse_subprocess</title>
+<ellipse fill="#ffffff" fill-opacity="0.698039" stroke="black" cx="1302" cy="-1116" rx="141.88" ry="18"/>
+<text text-anchor="middle" x="1302" y="-1112.3" font-family="Times,serif" font-size="14.00" fill="#000000">picosnitch.rfuse_subprocess</text>
 </g>
-<!-- picosnitch__get_sha256_fuse -->
+<!-- picosnitch__secondary_subprocess -->
 <g id="node10" class="node">
-<title>picosnitch__get_sha256_fuse</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="925" cy="-122" rx="87.99" ry="18"/>
-<text text-anchor="middle" x="925" y="-118.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_sha256_fuse</text>
+<title>picosnitch__secondary_subprocess</title>
+<ellipse fill="#ffffff" fill-opacity="0.698039" stroke="black" cx="977" cy="-1116" rx="165.17" ry="18"/>
+<text text-anchor="middle" x="977" y="-1112.3" font-family="Times,serif" font-size="14.00" fill="#000000">picosnitch.secondary_subprocess</text>
 </g>
-<!-- picosnitch__get_sha256_pid -->
+<!-- picosnitch__user_interface -->
 <g id="node11" class="node">
-<title>picosnitch__get_sha256_pid</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="1287" cy="-122" rx="83.39" ry="18"/>
-<text text-anchor="middle" x="1287" y="-118.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_sha256_pid</text>
+<title>picosnitch__user_interface</title>
+<ellipse fill="#ffffff" fill-opacity="0.698039" stroke="black" cx="667" cy="-1116" rx="127.28" ry="18"/>
+<text text-anchor="middle" x="667" y="-1112.3" font-family="Times,serif" font-size="14.00" fill="#000000">picosnitch.user_interface</text>
 </g>
-<!-- picosnitch__get_sha256_pid&#45;&gt;picosnitch__get_fstat -->
-<g id="edge15" class="edge">
-<title>picosnitch__get_sha256_pid&#45;&gt;picosnitch__get_fstat</title>
-<path fill="none" stroke="#000000" d="M1310.91,-104.59C1324.99,-94.93 1342.95,-82.6 1358.09,-72.21"/>
-<polygon fill="#000000" stroke="#000000" points="1360.37,-74.89 1366.63,-66.35 1356.41,-69.12 1360.37,-74.89"/>
-</g>
-<!-- picosnitch__get_vt_results -->
+<!-- picosnitch__utils -->
 <g id="node12" class="node">
-<title>picosnitch__get_vt_results</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="1055" cy="-277" rx="76.09" ry="18"/>
-<text text-anchor="middle" x="1055" y="-273.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_vt_results</text>
+<title>picosnitch__utils</title>
+<ellipse fill="#ffffff" fill-opacity="0.698039" stroke="black" cx="440" cy="-1116" rx="81.49" ry="18"/>
+<text text-anchor="middle" x="440" y="-1112.3" font-family="Times,serif" font-size="14.00" fill="#000000">picosnitch.utils</text>
 </g>
-<!-- picosnitch__main -->
+<!-- picosnitch__virustotal_subprocess -->
 <g id="node13" class="node">
-<title>picosnitch__main</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="1916" cy="-518" rx="33.6" ry="18"/>
-<text text-anchor="middle" x="1916" y="-514.3" font-family="Times,serif" font-size="14.00" fill="#000000">main</text>
+<title>picosnitch__virustotal_subprocess</title>
+<ellipse fill="#ffffff" fill-opacity="0.698039" stroke="black" cx="178" cy="-1116" rx="162.47" ry="18"/>
+<text text-anchor="middle" x="178" y="-1112.3" font-family="Times,serif" font-size="14.00" fill="#000000">picosnitch.virustotal_subprocess</text>
 </g>
-<!-- picosnitch__main_process -->
+<!-- picosnitch__cli__main -->
 <g id="node14" class="node">
-<title>picosnitch__main_process</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="2009" cy="-443" rx="73.39" ry="18"/>
-<text text-anchor="middle" x="2009" y="-439.3" font-family="Times,serif" font-size="14.00" fill="#000000">main_process</text>
+<title>picosnitch__cli__main</title>
+<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="2033" cy="-813" rx="33.6" ry="18"/>
+<text text-anchor="middle" x="2033" y="-809.3" font-family="Times,serif" font-size="14.00" fill="#000000">main</text>
 </g>
-<!-- picosnitch__main&#45;&gt;picosnitch__main_process -->
-<g id="edge16" class="edge">
-<title>picosnitch__main&#45;&gt;picosnitch__main_process</title>
-<path fill="none" stroke="#000000" d="M1934.37,-502.58C1947.42,-492.34 1965.19,-478.39 1980.11,-466.67"/>
-<polygon fill="#000000" stroke="#000000" points="1982.36,-469.36 1988.07,-460.43 1978.04,-463.85 1982.36,-469.36"/>
+<!-- picosnitch__main_process__main_process -->
+<g id="node31" class="node">
+<title>picosnitch__main_process__main_process</title>
+<ellipse fill="#e1ff99" fill-opacity="0.698039" stroke="black" cx="1232" cy="-730" rx="73.39" ry="18"/>
+<text text-anchor="middle" x="1232" y="-726.3" font-family="Times,serif" font-size="14.00" fill="#000000">main_process</text>
 </g>
-<!-- picosnitch__read_snitch -->
-<g id="node19" class="node">
-<title>picosnitch__read_snitch</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="1853" cy="-443" rx="64.19" ry="18"/>
-<text text-anchor="middle" x="1853" y="-439.3" font-family="Times,serif" font-size="14.00" fill="#000000">read_snitch</text>
+<!-- picosnitch__cli__main&#45;&gt;picosnitch__main_process__main_process -->
+<g id="edge2" class="edge">
+<title>picosnitch__cli__main&#45;&gt;picosnitch__main_process__main_process</title>
+<path fill="none" stroke="#000000" d="M2000.11,-808.67C1882.18,-796.75 1478.63,-755.94 1308.56,-738.74"/>
+<polygon fill="#000000" stroke="#000000" points="1308.73,-735.24 1298.43,-737.72 1308.03,-742.21 1308.73,-735.24"/>
 </g>
-<!-- picosnitch__main&#45;&gt;picosnitch__read_snitch -->
-<g id="edge17" class="edge">
-<title>picosnitch__main&#45;&gt;picosnitch__read_snitch</title>
-<path fill="none" stroke="#000000" d="M1902.33,-501.16C1894.08,-491.6 1883.4,-479.23 1874.09,-468.44"/>
-<polygon fill="#000000" stroke="#000000" points="1876.48,-465.85 1867.3,-460.57 1871.18,-470.43 1876.48,-465.85"/>
+<!-- picosnitch__utils__read_snitch -->
+<g id="node86" class="node">
+<title>picosnitch__utils__read_snitch</title>
+<ellipse fill="#e199ff" fill-opacity="0.698039" stroke="black" cx="2074" cy="-335" rx="64.19" ry="18"/>
+<text text-anchor="middle" x="2074" y="-331.3" font-family="Times,serif" font-size="14.00" fill="#000000">read_snitch</text>
 </g>
-<!-- picosnitch__main_process&#45;&gt;picosnitch__ProcessManager -->
-<g id="edge18" class="edge">
-<title>picosnitch__main_process&#45;&gt;picosnitch__ProcessManager</title>
-<path fill="none" stroke="#000000" d="M2082.47,-442.12C2153.99,-440.71 2256.14,-434.15 2286,-409 2316.23,-383.54 2323.63,-335.76 2325.11,-305.48"/>
-<polygon fill="#000000" stroke="#000000" points="2328.62,-305.29 2325.42,-295.19 2321.62,-305.08 2328.62,-305.29"/>
+<!-- picosnitch__cli__main&#45;&gt;picosnitch__utils__read_snitch -->
+<g id="edge3" class="edge">
+<title>picosnitch__cli__main&#45;&gt;picosnitch__utils__read_snitch</title>
+<path fill="none" stroke="#000000" d="M2047.86,-796.37C2073.42,-767.76 2123,-704.03 2123,-640 2123,-640 2123,-640 2123,-516 2123,-459.7 2100.4,-396.86 2085.9,-362.32"/>
+<polygon fill="#000000" stroke="#000000" points="2089.04,-360.76 2081.87,-352.96 2082.61,-363.53 2089.04,-360.76"/>
 </g>
-<!-- picosnitch__monitor_subprocess -->
-<g id="node15" class="node">
-<title>picosnitch__monitor_subprocess</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="2824" cy="-360" rx="103.98" ry="18"/>
-<text text-anchor="middle" x="2824" y="-356.3" font-family="Times,serif" font-size="14.00" fill="#000000">monitor_subprocess</text>
+<!-- picosnitch__cli__start_picosnitch&#45;&gt;picosnitch__cli__main -->
+<g id="edge4" class="edge">
+<title>picosnitch__cli__start_picosnitch&#45;&gt;picosnitch__cli__main</title>
+<path fill="none" stroke="#000000" d="M2409.49,-1038.69C2272.74,-1036.14 2016.75,-1029.47 2003,-1015 1957.47,-967.09 1994.64,-881.67 2017.85,-839.29"/>
+<polygon fill="#000000" stroke="#000000" points="2020.98,-840.87 2022.84,-830.44 2014.88,-837.43 2020.98,-840.87"/>
 </g>
-<!-- picosnitch__main_process&#45;&gt;picosnitch__monitor_subprocess -->
-<g id="edge26" class="edge">
-<title>picosnitch__main_process&#45;&gt;picosnitch__monitor_subprocess</title>
-<path fill="none" stroke="#000000" d="M2079.15,-437.59C2164,-432.03 2311.13,-421.65 2437,-409 2539.34,-398.71 2656.52,-383.73 2734.87,-373.25"/>
-<polygon fill="#000000" stroke="#000000" points="2735.74,-376.66 2745.18,-371.86 2734.81,-369.73 2735.74,-376.66"/>
+<!-- picosnitch__cli__start_picosnitch__PicoDaemon -->
+<g id="node16" class="node">
+<title>picosnitch__cli__start_picosnitch__PicoDaemon</title>
+<ellipse fill="#ff6565" fill-opacity="0.698039" stroke="black" cx="2503" cy="-935" rx="68.49" ry="18"/>
+<text text-anchor="middle" x="2503" y="-931.3" font-family="Times,serif" font-size="14.00" fill="#000000">PicoDaemon</text>
 </g>
-<!-- picosnitch__primary_subprocess -->
+<!-- picosnitch__cli__start_picosnitch&#45;&gt;picosnitch__cli__start_picosnitch__PicoDaemon -->
+<g id="edge5" class="edge">
+<title>picosnitch__cli__start_picosnitch&#45;&gt;picosnitch__cli__start_picosnitch__PicoDaemon</title>
+<path fill="none" stroke="#000000" d="M2495.49,-1022.83C2496.89,-1006.64 2499.01,-982.13 2500.64,-963.27"/>
+<polygon fill="#000000" stroke="#000000" points="2504.14,-963.46 2501.51,-953.2 2497.16,-962.86 2504.14,-963.46"/>
+</g>
+<!-- picosnitch__cli__start_picosnitch__delpid -->
 <g id="node17" class="node">
-<title>picosnitch__primary_subprocess</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="423" cy="-360" rx="104.78" ry="18"/>
-<text text-anchor="middle" x="423" y="-356.3" font-family="Times,serif" font-size="14.00" fill="#000000">primary_subprocess</text>
+<title>picosnitch__cli__start_picosnitch__delpid</title>
+<ellipse fill="#ff6565" fill-opacity="0.698039" stroke="black" cx="2377" cy="-935" rx="39.79" ry="18"/>
+<text text-anchor="middle" x="2377" y="-931.3" font-family="Times,serif" font-size="14.00" fill="#000000">delpid</text>
 </g>
-<!-- picosnitch__main_process&#45;&gt;picosnitch__primary_subprocess -->
-<g id="edge27" class="edge">
-<title>picosnitch__main_process&#45;&gt;picosnitch__primary_subprocess</title>
-<path fill="none" stroke="#000000" d="M1969.84,-427.71C1956.16,-423.39 1940.58,-419.21 1926,-417 1871.12,-408.69 982.43,-411.86 927,-409 783.15,-401.59 616.95,-384 515.95,-372.3"/>
-<polygon fill="#000000" stroke="#000000" points="516.12,-368.79 505.78,-371.11 515.31,-375.74 516.12,-368.79"/>
+<!-- picosnitch__cli__start_picosnitch&#45;&gt;picosnitch__cli__start_picosnitch__delpid -->
+<g id="edge6" class="edge">
+<title>picosnitch__cli__start_picosnitch&#45;&gt;picosnitch__cli__start_picosnitch__delpid</title>
+<path fill="none" stroke="#000000" d="M2444.33,-1026.22C2437.78,-1023.15 2431.46,-1019.45 2426,-1015 2408.85,-1001.02 2396.02,-979.36 2387.79,-962.25"/>
+<polygon fill="#000000" stroke="#000000" points="2390.82,-960.44 2383.49,-952.8 2384.45,-963.35 2390.82,-960.44"/>
 </g>
-<!-- picosnitch__rfuse_subprocess -->
-<g id="node21" class="node">
-<title>picosnitch__rfuse_subprocess</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="1027" cy="-360" rx="90.98" ry="18"/>
-<text text-anchor="middle" x="1027" y="-356.3" font-family="Times,serif" font-size="14.00" fill="#000000">rfuse_subprocess</text>
+<!-- picosnitch__daemon__Daemon__restart -->
+<g id="node24" class="node">
+<title>picosnitch__daemon__Daemon__restart</title>
+<ellipse fill="#ffa765" fill-opacity="0.698039" stroke="black" cx="4559" cy="-813" rx="42.79" ry="18"/>
+<text text-anchor="middle" x="4559" y="-809.3" font-family="Times,serif" font-size="14.00" fill="#000000">restart</text>
 </g>
-<!-- picosnitch__main_process&#45;&gt;picosnitch__rfuse_subprocess -->
-<g id="edge28" class="edge">
-<title>picosnitch__main_process&#45;&gt;picosnitch__rfuse_subprocess</title>
-<path fill="none" stroke="#000000" d="M1969.84,-427.73C1956.16,-423.41 1940.58,-419.22 1926,-417 1882.12,-410.31 1170.23,-419.07 1127,-409 1104.22,-403.69 1080.54,-392.62 1061.94,-382.44"/>
-<polygon fill="#000000" stroke="#000000" points="1063.42,-379.25 1052.99,-377.39 1059.98,-385.35 1063.42,-379.25"/>
+<!-- picosnitch__cli__start_picosnitch&#45;&gt;picosnitch__daemon__Daemon__restart -->
+<g id="edge7" class="edge">
+<title>picosnitch__cli__start_picosnitch&#45;&gt;picosnitch__daemon__Daemon__restart</title>
+<path fill="none" stroke="#000000" d="M2578.99,-1039.58C2937.6,-1037.74 4310.59,-1029.71 4353,-1015 4437.15,-985.8 4452.83,-959.58 4512,-893 4526.18,-877.04 4538.37,-856.2 4546.78,-839.92"/>
+<polygon fill="#000000" stroke="#000000" points="4549.93,-841.45 4551.28,-830.94 4543.67,-838.31 4549.93,-841.45"/>
 </g>
-<!-- picosnitch__secondary_subprocess -->
-<g id="node22" class="node">
-<title>picosnitch__secondary_subprocess</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="1250" cy="-360" rx="114.28" ry="18"/>
-<text text-anchor="middle" x="1250" y="-356.3" font-family="Times,serif" font-size="14.00" fill="#000000">secondary_subprocess</text>
+<!-- picosnitch__daemon__Daemon__start -->
+<g id="node26" class="node">
+<title>picosnitch__daemon__Daemon__start</title>
+<ellipse fill="#ffa765" fill-opacity="0.698039" stroke="black" cx="4559" cy="-730" rx="33.29" ry="18"/>
+<text text-anchor="middle" x="4559" y="-726.3" font-family="Times,serif" font-size="14.00" fill="#000000">start</text>
 </g>
-<!-- picosnitch__main_process&#45;&gt;picosnitch__secondary_subprocess -->
-<g id="edge29" class="edge">
-<title>picosnitch__main_process&#45;&gt;picosnitch__secondary_subprocess</title>
-<path fill="none" stroke="#000000" d="M1969.83,-427.77C1956.15,-423.45 1940.57,-419.26 1926,-417 1811.14,-399.18 1517.76,-427.48 1403,-409 1367.56,-403.29 1329.02,-391.16 1299.48,-380.52"/>
-<polygon fill="#000000" stroke="#000000" points="1300.42,-377.14 1289.82,-376.98 1298.01,-383.71 1300.42,-377.14"/>
+<!-- picosnitch__cli__start_picosnitch&#45;&gt;picosnitch__daemon__Daemon__start -->
+<g id="edge8" class="edge">
+<title>picosnitch__cli__start_picosnitch&#45;&gt;picosnitch__daemon__Daemon__start</title>
+<path fill="none" stroke="#000000" d="M2579.25,-1039.83C2941.71,-1038.97 4340.37,-1034.4 4432,-1015 4566.79,-986.45 4641.13,-1008.01 4717,-893 4742.94,-853.68 4749.15,-821.44 4717,-787 4699.37,-768.11 4624.15,-790.48 4601,-779 4590.48,-773.78 4581.46,-764.64 4574.51,-755.73"/>
+<polygon fill="#000000" stroke="#000000" points="4577.19,-753.46 4568.5,-747.39 4571.51,-757.55 4577.19,-753.46"/>
 </g>
-<!-- picosnitch__virustotal_subprocess -->
-<g id="node30" class="node">
-<title>picosnitch__virustotal_subprocess</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="1524" cy="-360" rx="112.38" ry="18"/>
-<text text-anchor="middle" x="1524" y="-356.3" font-family="Times,serif" font-size="14.00" fill="#000000">virustotal_subprocess</text>
+<!-- picosnitch__daemon__Daemon__status -->
+<g id="node27" class="node">
+<title>picosnitch__daemon__Daemon__status</title>
+<ellipse fill="#ffa765" fill-opacity="0.698039" stroke="black" cx="4729" cy="-730" rx="39.79" ry="18"/>
+<text text-anchor="middle" x="4729" y="-726.3" font-family="Times,serif" font-size="14.00" fill="#000000">status</text>
 </g>
-<!-- picosnitch__main_process&#45;&gt;picosnitch__virustotal_subprocess -->
-<g id="edge30" class="edge">
-<title>picosnitch__main_process&#45;&gt;picosnitch__virustotal_subprocess</title>
-<path fill="none" stroke="#000000" d="M1968.48,-427.91C1955.1,-423.76 1940.05,-419.64 1926,-417 1881.75,-408.68 1869.71,-414.33 1825,-409 1750.21,-400.09 1665.55,-386.25 1605.1,-375.72"/>
-<polygon fill="#000000" stroke="#000000" points="1605.69,-372.27 1595.24,-373.99 1604.48,-379.16 1605.69,-372.27"/>
+<!-- picosnitch__cli__start_picosnitch&#45;&gt;picosnitch__daemon__Daemon__status -->
+<g id="edge9" class="edge">
+<title>picosnitch__cli__start_picosnitch&#45;&gt;picosnitch__daemon__Daemon__status</title>
+<path fill="none" stroke="#000000" d="M2578.96,-1039.72C2963.94,-1038.36 4528.16,-1031.81 4576,-1015 4659.04,-985.83 4693.43,-972.12 4732,-893 4753.13,-849.65 4744.61,-791.7 4736.68,-758.16"/>
+<polygon fill="#000000" stroke="#000000" points="4740,-757.01 4734.16,-748.17 4733.21,-758.72 4740,-757.01"/>
 </g>
-<!-- picosnitch__ProcessManager____init__ -->
-<g id="node44" class="node">
-<title>picosnitch__ProcessManager____init__</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="2043" cy="-277" rx="44.39" ry="18"/>
-<text text-anchor="middle" x="2043" y="-273.3" font-family="Times,serif" font-size="14.00" fill="#000000">__init__</text>
+<!-- picosnitch__daemon__Daemon__stop -->
+<g id="node28" class="node">
+<title>picosnitch__daemon__Daemon__stop</title>
+<ellipse fill="#ffa765" fill-opacity="0.698039" stroke="black" cx="4641" cy="-730" rx="30.59" ry="18"/>
+<text text-anchor="middle" x="4641" y="-726.3" font-family="Times,serif" font-size="14.00" fill="#000000">stop</text>
+</g>
+<!-- picosnitch__cli__start_picosnitch&#45;&gt;picosnitch__daemon__Daemon__stop -->
+<g id="edge10" class="edge">
+<title>picosnitch__cli__start_picosnitch&#45;&gt;picosnitch__daemon__Daemon__stop</title>
+<path fill="none" stroke="#000000" d="M2578.96,-1039.72C2963.94,-1038.36 4528.16,-1031.81 4576,-1015 4659.04,-985.83 4693.43,-972.12 4732,-893 4752.64,-850.65 4762.68,-822.76 4732,-787 4716.77,-769.25 4700.29,-790.63 4680,-779 4670.36,-773.47 4662.14,-764.57 4655.77,-755.92"/>
+<polygon fill="#000000" stroke="#000000" points="4658.55,-753.79 4650.03,-747.5 4652.76,-757.73 4658.55,-753.79"/>
+</g>
+<!-- picosnitch__process_manager__ProcessManager__start -->
+<g id="node57" class="node">
+<title>picosnitch__process_manager__ProcessManager__start</title>
+<ellipse fill="#65feff" fill-opacity="0.698039" stroke="black" cx="1057" cy="-426" rx="33.29" ry="18"/>
+<text text-anchor="middle" x="1057" y="-422.3" font-family="Times,serif" font-size="14.00" fill="#000000">start</text>
+</g>
+<!-- picosnitch__cli__start_picosnitch&#45;&gt;picosnitch__process_manager__ProcessManager__start -->
+<g id="edge11" class="edge">
+<title>picosnitch__cli__start_picosnitch&#45;&gt;picosnitch__process_manager__ProcessManager__start</title>
+<path fill="none" stroke="#000000" d="M2409.28,-1038.66C2047.18,-1031.85 648,-993.9 648,-814 648,-814 648,-814 648,-638 648,-569.08 606.9,-534.24 653,-483 700.25,-430.49 919.25,-425.81 1013.58,-426.31"/>
+<polygon fill="#000000" stroke="#000000" points="1013.62,-429.81 1023.65,-426.38 1013.68,-422.81 1013.62,-429.81"/>
+</g>
+<!-- picosnitch__user_interface__ui_dash -->
+<g id="node63" class="node">
+<title>picosnitch__user_interface__ui_dash</title>
+<ellipse fill="#b699ff" fill-opacity="0.698039" stroke="black" cx="3016" cy="-935" rx="46.29" ry="18"/>
+<text text-anchor="middle" x="3016" y="-931.3" font-family="Times,serif" font-size="14.00" fill="#000000">ui_dash</text>
+</g>
+<!-- picosnitch__cli__start_picosnitch&#45;&gt;picosnitch__user_interface__ui_dash -->
+<g id="edge12" class="edge">
+<title>picosnitch__cli__start_picosnitch&#45;&gt;picosnitch__user_interface__ui_dash</title>
+<path fill="none" stroke="#000000" d="M2579.21,-1039.82C2679.44,-1038.71 2839.37,-1033.9 2896,-1015 2932.03,-1002.97 2967.66,-977.3 2990.62,-958.47"/>
+<polygon fill="#000000" stroke="#000000" points="2993.06,-960.98 2998.48,-951.88 2988.57,-955.62 2993.06,-960.98"/>
+</g>
+<!-- picosnitch__user_interface__ui_init -->
+<g id="node65" class="node">
+<title>picosnitch__user_interface__ui_init</title>
+<ellipse fill="#b699ff" fill-opacity="0.698039" stroke="black" cx="2847" cy="-935" rx="39.79" ry="18"/>
+<text text-anchor="middle" x="2847" y="-931.3" font-family="Times,serif" font-size="14.00" fill="#000000">ui_init</text>
+</g>
+<!-- picosnitch__cli__start_picosnitch&#45;&gt;picosnitch__user_interface__ui_init -->
+<g id="edge13" class="edge">
+<title>picosnitch__cli__start_picosnitch&#45;&gt;picosnitch__user_interface__ui_init</title>
+<path fill="none" stroke="#000000" d="M2548.67,-1027.11C2563.73,-1023.39 2580.04,-1019.19 2595,-1015 2670.17,-993.93 2756.83,-965.94 2806.44,-949.56"/>
+<polygon fill="#000000" stroke="#000000" points="2807.75,-952.81 2816.15,-946.34 2805.55,-946.16 2807.75,-952.81"/>
+</g>
+<!-- picosnitch__cli__start_picosnitch&#45;&gt;picosnitch__utils__read_snitch -->
+<g id="edge14" class="edge">
+<title>picosnitch__cli__start_picosnitch&#45;&gt;picosnitch__utils__read_snitch</title>
+<path fill="none" stroke="#000000" d="M2563.44,-1030.56C2571.04,-1026.82 2577.86,-1021.78 2583,-1015 2598.3,-994.81 2594.68,-923.48 2583,-901 2474.56,-692.36 2276.61,-795.14 2150,-597 2137.54,-577.5 2121.87,-413.38 2113,-392 2108.48,-381.11 2101.58,-370.22 2094.83,-360.98"/>
+<polygon fill="#000000" stroke="#000000" points="2097.6,-358.84 2088.75,-353.01 2092.03,-363.08 2097.6,-358.84"/>
+</g>
+<!-- picosnitch__daemon__Daemon -->
+<g id="node19" class="node">
+<title>picosnitch__daemon__Daemon</title>
+<ellipse fill="#ffc499" fill-opacity="0.698039" stroke="black" cx="4414" cy="-813" rx="48.99" ry="18"/>
+<text text-anchor="middle" x="4414" y="-809.3" font-family="Times,serif" font-size="14.00" fill="#000000">Daemon</text>
 </g>
-<!-- picosnitch__main_process&#45;&gt;picosnitch__ProcessManager____init__ -->
+<!-- picosnitch__cli__start_picosnitch__PicoDaemon&#45;&gt;picosnitch__daemon__Daemon -->
+<g id="edge15" class="edge">
+<title>picosnitch__cli__start_picosnitch__PicoDaemon&#45;&gt;picosnitch__daemon__Daemon</title>
+<path fill="none" stroke="#000000" d="M2535.9,-919.12C2553.12,-912.13 2574.78,-904.56 2595,-901 2618.94,-896.78 4322.89,-903.1 4345,-893 4369.05,-882.01 4388.02,-858.06 4399.94,-839.4"/>
+<polygon fill="#000000" stroke="#000000" points="4403,-841.1 4405.21,-830.74 4397.02,-837.46 4403,-841.1"/>
+</g>
+<!-- picosnitch__cli__start_picosnitch__PicoDaemon__run -->
+<g id="node18" class="node">
+<title>picosnitch__cli__start_picosnitch__PicoDaemon__run</title>
+<ellipse fill="#ff3232" fill-opacity="0.698039" stroke="black" cx="2042" cy="-935" rx="27" ry="18"/>
+<text text-anchor="middle" x="2042" y="-931.3" font-family="Times,serif" font-size="14.00" fill="#000000">run</text>
+</g>
+<!-- picosnitch__cli__start_picosnitch__PicoDaemon__run&#45;&gt;picosnitch__cli__main -->
+<g id="edge16" class="edge">
+<title>picosnitch__cli__start_picosnitch__PicoDaemon__run&#45;&gt;picosnitch__cli__main</title>
+<path fill="none" stroke="#000000" d="M2040.71,-916.81C2039.23,-897.11 2036.79,-864.58 2035.05,-841.39"/>
+<polygon fill="#000000" stroke="#000000" points="2038.53,-840.87 2034.29,-831.16 2031.54,-841.39 2038.53,-840.87"/>
+</g>
+<!-- picosnitch__daemon__Daemon____init__ -->
+<g id="node20" class="node">
+<title>picosnitch__daemon__Daemon____init__</title>
+<ellipse fill="#ffa765" fill-opacity="0.698039" stroke="black" cx="4664" cy="-813" rx="44.39" ry="18"/>
+<text text-anchor="middle" x="4664" y="-809.3" font-family="Times,serif" font-size="14.00" fill="#000000">__init__</text>
+</g>
+<!-- picosnitch__daemon__Daemon__daemonize -->
+<g id="node21" class="node">
+<title>picosnitch__daemon__Daemon__daemonize</title>
+<ellipse fill="#ffa765" fill-opacity="0.698039" stroke="black" cx="4539" cy="-639" rx="60.39" ry="18"/>
+<text text-anchor="middle" x="4539" y="-635.3" font-family="Times,serif" font-size="14.00" fill="#000000">daemonize</text>
+</g>
+<!-- picosnitch__daemon__Daemon__delpid -->
+<g id="node22" class="node">
+<title>picosnitch__daemon__Daemon__delpid</title>
+<ellipse fill="#ffa765" fill-opacity="0.698039" stroke="black" cx="4539" cy="-517" rx="39.79" ry="18"/>
+<text text-anchor="middle" x="4539" y="-513.3" font-family="Times,serif" font-size="14.00" fill="#000000">delpid</text>
+</g>
+<!-- picosnitch__daemon__Daemon__daemonize&#45;&gt;picosnitch__daemon__Daemon__delpid -->
+<g id="edge17" class="edge">
+<title>picosnitch__daemon__Daemon__daemonize&#45;&gt;picosnitch__daemon__Daemon__delpid</title>
+<path fill="none" stroke="#000000" d="M4539,-620.81C4539,-601.11 4539,-568.58 4539,-545.39"/>
+<polygon fill="#000000" stroke="#000000" points="4542.5,-545.16 4539,-535.16 4535.5,-545.16 4542.5,-545.16"/>
+</g>
+<!-- picosnitch__daemon__Daemon__getpid -->
+<g id="node23" class="node">
+<title>picosnitch__daemon__Daemon__getpid</title>
+<ellipse fill="#ffa765" fill-opacity="0.698039" stroke="black" cx="4729" cy="-639" rx="40.09" ry="18"/>
+<text text-anchor="middle" x="4729" y="-635.3" font-family="Times,serif" font-size="14.00" fill="#000000">getpid</text>
+</g>
+<!-- picosnitch__daemon__Daemon__restart&#45;&gt;picosnitch__daemon__Daemon__start -->
+<g id="edge18" class="edge">
+<title>picosnitch__daemon__Daemon__restart&#45;&gt;picosnitch__daemon__Daemon__start</title>
+<path fill="none" stroke="#000000" d="M4559,-794.82C4559,-784.19 4559,-770.31 4559,-758.2"/>
+<polygon fill="#000000" stroke="#000000" points="4562.5,-758.15 4559,-748.15 4555.5,-758.15 4562.5,-758.15"/>
+</g>
+<!-- picosnitch__daemon__Daemon__restart&#45;&gt;picosnitch__daemon__Daemon__stop -->
 <g id="edge19" class="edge">
-<title>picosnitch__main_process&#45;&gt;picosnitch__ProcessManager____init__</title>
-<path fill="none" stroke="#000000" d="M2012.57,-424.76C2018.48,-396.26 2030.33,-339.12 2037.37,-305.16"/>
-<polygon fill="#000000" stroke="#000000" points="2040.87,-305.51 2039.47,-295.01 2034.02,-304.09 2040.87,-305.51"/>
+<title>picosnitch__daemon__Daemon__restart&#45;&gt;picosnitch__daemon__Daemon__stop</title>
+<path fill="none" stroke="#000000" d="M4579.8,-797.04C4586.8,-791.65 4594.48,-785.33 4601,-779 4608.62,-771.59 4616.27,-762.83 4622.8,-754.82"/>
+<polygon fill="#000000" stroke="#000000" points="4625.66,-756.85 4629.17,-746.85 4620.19,-752.49 4625.66,-756.85"/>
 </g>
-<!-- picosnitch__ProcessManager__is_alive -->
-<g id="node45" class="node">
-<title>picosnitch__ProcessManager__is_alive</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="1690" cy="-277" rx="44.69" ry="18"/>
-<text text-anchor="middle" x="1690" y="-273.3" font-family="Times,serif" font-size="14.00" fill="#000000">is_alive</text>
+<!-- picosnitch__daemon__Daemon__run -->
+<g id="node25" class="node">
+<title>picosnitch__daemon__Daemon__run</title>
+<ellipse fill="#ffa765" fill-opacity="0.698039" stroke="black" cx="4644" cy="-639" rx="27" ry="18"/>
+<text text-anchor="middle" x="4644" y="-635.3" font-family="Times,serif" font-size="14.00" fill="#000000">run</text>
 </g>
-<!-- picosnitch__main_process&#45;&gt;picosnitch__ProcessManager__is_alive -->
+<!-- picosnitch__daemon__Daemon__start&#45;&gt;picosnitch__daemon__Daemon__daemonize -->
 <g id="edge20" class="edge">
-<title>picosnitch__main_process&#45;&gt;picosnitch__ProcessManager__is_alive</title>
-<path fill="none" stroke="#000000" d="M1967.55,-428.07C1954.38,-424.04 1939.68,-419.94 1926,-417 1899.27,-411.26 1890.53,-418.78 1865,-409 1802.6,-385.1 1743.25,-332.1 1712.27,-301.34"/>
-<polygon fill="#000000" stroke="#000000" points="1714.55,-298.67 1705.03,-294.03 1709.58,-303.6 1714.55,-298.67"/>
-</g>
-<!-- picosnitch__ProcessManager__is_zombie -->
-<g id="node46" class="node">
-<title>picosnitch__ProcessManager__is_zombie</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="1809" cy="-277" rx="55.79" ry="18"/>
-<text text-anchor="middle" x="1809" y="-273.3" font-family="Times,serif" font-size="14.00" fill="#000000">is_zombie</text>
+<title>picosnitch__daemon__Daemon__start&#45;&gt;picosnitch__daemon__Daemon__daemonize</title>
+<path fill="none" stroke="#000000" d="M4555.14,-711.84C4552.29,-699.16 4548.36,-681.64 4545.08,-667.08"/>
+<polygon fill="#000000" stroke="#000000" points="4548.45,-666.1 4542.84,-657.11 4541.62,-667.63 4548.45,-666.1"/>
 </g>
-<!-- picosnitch__main_process&#45;&gt;picosnitch__ProcessManager__is_zombie -->
+<!-- picosnitch__daemon__Daemon__start&#45;&gt;picosnitch__daemon__Daemon__getpid -->
 <g id="edge21" class="edge">
-<title>picosnitch__main_process&#45;&gt;picosnitch__ProcessManager__is_zombie</title>
-<path fill="none" stroke="#000000" d="M1981.17,-426.32C1972.56,-421.12 1963.2,-415.1 1955,-409 1909.06,-374.8 1860.46,-328.99 1832.53,-301.59"/>
-<polygon fill="#000000" stroke="#000000" points="1834.8,-298.91 1825.22,-294.38 1829.88,-303.89 1834.8,-298.91"/>
+<title>picosnitch__daemon__Daemon__start&#45;&gt;picosnitch__daemon__Daemon__getpid</title>
+<path fill="none" stroke="#000000" d="M4573.99,-713.8C4581.47,-707.18 4591.02,-700.02 4601,-696 4633.73,-682.8 4648.04,-702.97 4680,-688 4691.68,-682.53 4702.24,-673.1 4710.55,-664.04"/>
+<polygon fill="#000000" stroke="#000000" points="4713.36,-666.14 4717.24,-656.28 4708.06,-661.57 4713.36,-666.14"/>
 </g>
-<!-- picosnitch__ProcessManager__memory -->
-<g id="node47" class="node">
-<title>picosnitch__ProcessManager__memory</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="1932" cy="-277" rx="48.99" ry="18"/>
-<text text-anchor="middle" x="1932" y="-273.3" font-family="Times,serif" font-size="14.00" fill="#000000">memory</text>
-</g>
-<!-- picosnitch__main_process&#45;&gt;picosnitch__ProcessManager__memory -->
+<!-- picosnitch__daemon__Daemon__start&#45;&gt;picosnitch__daemon__Daemon__run -->
 <g id="edge22" class="edge">
-<title>picosnitch__main_process&#45;&gt;picosnitch__ProcessManager__memory</title>
-<path fill="none" stroke="#000000" d="M2001.05,-425.07C1987.62,-396.46 1960.35,-338.38 1944.39,-304.4"/>
-<polygon fill="#000000" stroke="#000000" points="1947.44,-302.65 1940.02,-295.09 1941.1,-305.63 1947.44,-302.65"/>
-</g>
-<!-- picosnitch__ProcessManager__start -->
-<g id="node48" class="node">
-<title>picosnitch__ProcessManager__start</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="2186" cy="-205" rx="33.29" ry="18"/>
-<text text-anchor="middle" x="2186" y="-201.3" font-family="Times,serif" font-size="14.00" fill="#000000">start</text>
+<title>picosnitch__daemon__Daemon__start&#45;&gt;picosnitch__daemon__Daemon__run</title>
+<path fill="none" stroke="#000000" d="M4578.04,-714.76C4587.5,-707.27 4598.84,-697.66 4608,-688 4614.95,-680.67 4621.8,-672.01 4627.62,-664.08"/>
+<polygon fill="#000000" stroke="#000000" points="4630.53,-666.02 4633.5,-655.85 4624.84,-661.95 4630.53,-666.02"/>
 </g>
-<!-- picosnitch__main_process&#45;&gt;picosnitch__ProcessManager__start -->
+<!-- picosnitch__daemon__Daemon__status&#45;&gt;picosnitch__daemon__Daemon__getpid -->
 <g id="edge23" class="edge">
-<title>picosnitch__main_process&#45;&gt;picosnitch__ProcessManager__start</title>
-<path fill="none" stroke="#000000" d="M2080.25,-438.36C2155.23,-433.77 2267.82,-424.57 2308,-409 2366.44,-386.36 2393.57,-381.86 2422,-326 2437.12,-296.29 2443.25,-276.68 2422,-251 2398,-221.99 2290.46,-211.51 2229.16,-207.86"/>
-<polygon fill="#000000" stroke="#000000" points="2229.19,-204.36 2219.01,-207.29 2228.8,-211.35 2229.19,-204.36"/>
-</g>
-<!-- picosnitch__ProcessManager__terminate -->
-<g id="node49" class="node">
-<title>picosnitch__ProcessManager__terminate</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="2162" cy="-277" rx="56.59" ry="18"/>
-<text text-anchor="middle" x="2162" y="-273.3" font-family="Times,serif" font-size="14.00" fill="#000000">terminate</text>
+<title>picosnitch__daemon__Daemon__status&#45;&gt;picosnitch__daemon__Daemon__getpid</title>
+<path fill="none" stroke="#000000" d="M4729,-711.84C4729,-699.28 4729,-681.98 4729,-667.5"/>
+<polygon fill="#000000" stroke="#000000" points="4732.5,-667.11 4729,-657.11 4725.5,-667.11 4732.5,-667.11"/>
 </g>
-<!-- picosnitch__main_process&#45;&gt;picosnitch__ProcessManager__terminate -->
+<!-- picosnitch__daemon__Daemon__stop&#45;&gt;picosnitch__daemon__Daemon__getpid -->
 <g id="edge24" class="edge">
-<title>picosnitch__main_process&#45;&gt;picosnitch__ProcessManager__terminate</title>
-<path fill="none" stroke="#000000" d="M2018.96,-425.07C2032.58,-402.72 2058.61,-362.85 2087,-334 2094.49,-326.39 2114.07,-311.82 2131.35,-299.45"/>
-<polygon fill="#000000" stroke="#000000" points="2133.46,-302.25 2139.58,-293.6 2129.4,-296.54 2133.46,-302.25"/>
+<title>picosnitch__daemon__Daemon__stop&#45;&gt;picosnitch__daemon__Daemon__getpid</title>
+<path fill="none" stroke="#000000" d="M4655.93,-713.9C4669.67,-700.01 4690.25,-679.19 4706.07,-663.19"/>
+<polygon fill="#000000" stroke="#000000" points="4708.86,-665.34 4713.41,-655.77 4703.89,-660.42 4708.86,-665.34"/>
 </g>
-<!-- picosnitch__main_process__clean_exit -->
-<g id="node50" class="node">
-<title>picosnitch__main_process__clean_exit</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="2162" cy="-360" rx="57.39" ry="18"/>
-<text text-anchor="middle" x="2162" y="-356.3" font-family="Times,serif" font-size="14.00" fill="#000000">clean_exit</text>
+<!-- picosnitch__event_structures__BpfEvent -->
+<g id="node29" class="node">
+<title>picosnitch__event_structures__BpfEvent</title>
+<ellipse fill="#fff099" fill-opacity="0.698039" stroke="black" cx="770" cy="-244" rx="53.89" ry="18"/>
+<text text-anchor="middle" x="770" y="-240.3" font-family="Times,serif" font-size="14.00" fill="#000000">BpfEvent</text>
+</g>
+<!-- picosnitch__event_structures__FanotifyEventMetadata -->
+<g id="node30" class="node">
+<title>picosnitch__event_structures__FanotifyEventMetadata</title>
+<ellipse fill="#fff099" fill-opacity="0.698039" stroke="black" cx="578" cy="-244" rx="120.48" ry="18"/>
+<text text-anchor="middle" x="578" y="-240.3" font-family="Times,serif" font-size="14.00" fill="#000000">FanotifyEventMetadata</text>
+</g>
+<!-- picosnitch__main_process__main_process__clean_exit -->
+<g id="node32" class="node">
+<title>picosnitch__main_process__main_process__clean_exit</title>
+<ellipse fill="#d3ff65" fill-opacity="0.698039" stroke="black" cx="1232" cy="-639" rx="57.39" ry="18"/>
+<text text-anchor="middle" x="1232" y="-635.3" font-family="Times,serif" font-size="14.00" fill="#000000">clean_exit</text>
 </g>
-<!-- picosnitch__main_process&#45;&gt;picosnitch__main_process__clean_exit -->
+<!-- picosnitch__main_process__main_process&#45;&gt;picosnitch__main_process__main_process__clean_exit -->
 <g id="edge25" class="edge">
-<title>picosnitch__main_process&#45;&gt;picosnitch__main_process__clean_exit</title>
-<path fill="none" stroke="#000000" d="M2054.72,-428.85C2069.9,-423.64 2086.6,-416.97 2101,-409 2113.47,-402.1 2126.04,-392.71 2136.51,-384.07"/>
-<polygon fill="#000000" stroke="#000000" points="2139.05,-386.5 2144.41,-377.36 2134.52,-381.16 2139.05,-386.5"/>
+<title>picosnitch__main_process__main_process&#45;&gt;picosnitch__main_process__main_process__clean_exit</title>
+<path fill="none" stroke="#000000" d="M1232,-711.84C1232,-699.28 1232,-681.98 1232,-667.5"/>
+<polygon fill="#000000" stroke="#000000" points="1235.5,-667.11 1232,-657.11 1228.5,-667.11 1235.5,-667.11"/>
 </g>
-<!-- picosnitch__monitor_subprocess_initial_poll -->
-<g id="node16" class="node">
-<title>picosnitch__monitor_subprocess_initial_poll</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="2628" cy="-277" rx="156.77" ry="18"/>
-<text text-anchor="middle" x="2628" y="-273.3" font-family="Times,serif" font-size="14.00" fill="#000000">monitor_subprocess_initial_poll</text>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess -->
+<g id="node33" class="node">
+<title>picosnitch__monitor_subprocess__monitor_subprocess</title>
+<ellipse fill="#b6ff99" fill-opacity="0.698039" stroke="black" cx="3266" cy="-517" rx="103.98" ry="18"/>
+<text text-anchor="middle" x="3266" y="-513.3" font-family="Times,serif" font-size="14.00" fill="#000000">monitor_subprocess</text>
 </g>
-<!-- picosnitch__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess_initial_poll -->
-<g id="edge42" class="edge">
-<title>picosnitch__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess_initial_poll</title>
-<path fill="none" stroke="#000000" d="M2785.74,-343.19C2754.82,-330.41 2711.06,-312.32 2677.47,-298.44"/>
-<polygon fill="#000000" stroke="#000000" points="2678.42,-295.05 2667.84,-294.47 2675.75,-301.52 2678.42,-295.05"/>
+<!-- picosnitch__main_process__main_process&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess -->
+<g id="edge26" class="edge">
+<title>picosnitch__main_process__main_process&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess</title>
+<path fill="none" stroke="#000000" d="M1304.78,-727.34C1451.81,-723.53 1779.57,-712.49 1889,-688 1986.53,-666.17 2000.6,-627.41 2098,-605 2297.12,-559.18 2903.39,-531.68 3154.87,-521.98"/>
+<polygon fill="#000000" stroke="#000000" points="3155.26,-525.47 3165.12,-521.59 3155,-518.47 3155.26,-525.47"/>
 </g>
-<!-- picosnitch__monitor_subprocess__get_cmdline -->
-<g id="node51" class="node">
-<title>picosnitch__monitor_subprocess__get_cmdline</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="3179" cy="-205" rx="66.89" ry="18"/>
-<text text-anchor="middle" x="3179" y="-201.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_cmdline</text>
+<!-- picosnitch__primary_subprocess__primary_subprocess -->
+<g id="node48" class="node">
+<title>picosnitch__primary_subprocess__primary_subprocess</title>
+<ellipse fill="#99ffd3" fill-opacity="0.698039" stroke="black" cx="4372" cy="-426" rx="104.78" ry="18"/>
+<text text-anchor="middle" x="4372" y="-422.3" font-family="Times,serif" font-size="14.00" fill="#000000">primary_subprocess</text>
 </g>
-<!-- picosnitch__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__get_cmdline -->
-<g id="edge33" class="edge">
-<title>picosnitch__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__get_cmdline</title>
-<path fill="none" stroke="#000000" d="M2816.73,-342.01C2807.94,-318.48 2796.89,-276.05 2819,-251 2837.54,-230 3004.14,-216.46 3104.09,-210.15"/>
-<polygon fill="#000000" stroke="#000000" points="3104.37,-213.64 3114.14,-209.52 3103.94,-206.65 3104.37,-213.64"/>
+<!-- picosnitch__main_process__main_process&#45;&gt;picosnitch__primary_subprocess__primary_subprocess -->
+<g id="edge27" class="edge">
+<title>picosnitch__main_process__main_process&#45;&gt;picosnitch__primary_subprocess__primary_subprocess</title>
+<path fill="none" stroke="#000000" d="M1304.57,-727.12C1713.49,-716.34 3721.19,-660.5 3989,-597 4123.54,-565.1 4269.41,-486.87 4335.64,-448.68"/>
+<polygon fill="#000000" stroke="#000000" points="4337.55,-451.61 4344.44,-443.56 4334.04,-445.56 4337.55,-451.61"/>
 </g>
-<!-- picosnitch__monitor_subprocess__get_fd -->
+<!-- picosnitch__process_manager__ProcessManager -->
 <g id="node52" class="node">
-<title>picosnitch__monitor_subprocess__get_fd</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="3304" cy="-205" rx="39.79" ry="18"/>
-<text text-anchor="middle" x="3304" y="-201.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_fd</text>
+<title>picosnitch__process_manager__ProcessManager</title>
+<ellipse fill="#99feff" fill-opacity="0.698039" stroke="black" cx="775" cy="-517" rx="88.28" ry="18"/>
+<text text-anchor="middle" x="775" y="-513.3" font-family="Times,serif" font-size="14.00" fill="#000000">ProcessManager</text>
 </g>
-<!-- picosnitch__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__get_fd -->
-<g id="edge34" class="edge">
-<title>picosnitch__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__get_fd</title>
-<path fill="none" stroke="#000000" d="M2823.02,-341.93C2821.86,-314.7 2821.46,-263.22 2834,-251 2867.58,-218.28 3209.06,-232.32 3255,-223 3258.41,-222.31 3261.91,-221.44 3265.4,-220.46"/>
-<polygon fill="#000000" stroke="#000000" points="3266.56,-223.76 3275.08,-217.46 3264.49,-217.07 3266.56,-223.76"/>
+<!-- picosnitch__main_process__main_process&#45;&gt;picosnitch__process_manager__ProcessManager -->
+<g id="edge28" class="edge">
+<title>picosnitch__main_process__main_process&#45;&gt;picosnitch__process_manager__ProcessManager</title>
+<path fill="none" stroke="#000000" d="M1160.61,-725.55C1054.47,-719.83 864.83,-707.07 840,-688 794.99,-653.43 781.14,-583.69 776.89,-545.14"/>
+<polygon fill="#000000" stroke="#000000" points="780.37,-544.77 775.92,-535.15 773.4,-545.44 780.37,-544.77"/>
 </g>
-<!-- picosnitch__monitor_subprocess__queue_dns_event -->
+<!-- picosnitch__process_manager__ProcessManager____init__ -->
 <g id="node53" class="node">
-<title>picosnitch__monitor_subprocess__queue_dns_event</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="4197" cy="-277" rx="90.18" ry="18"/>
-<text text-anchor="middle" x="4197" y="-273.3" font-family="Times,serif" font-size="14.00" fill="#000000">queue_dns_event</text>
+<title>picosnitch__process_manager__ProcessManager____init__</title>
+<ellipse fill="#65feff" fill-opacity="0.698039" stroke="black" cx="1057" cy="-517" rx="44.39" ry="18"/>
+<text text-anchor="middle" x="1057" y="-513.3" font-family="Times,serif" font-size="14.00" fill="#000000">__init__</text>
 </g>
-<!-- picosnitch__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__queue_dns_event -->
-<g id="edge35" class="edge">
-<title>picosnitch__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__queue_dns_event</title>
-<path fill="none" stroke="#000000" d="M2876.33,-344.44C2893.88,-340.22 2913.65,-336.16 2932,-334 2996.34,-326.43 4034.91,-340.72 4098,-326 4120.6,-320.73 4144.04,-309.65 4162.44,-299.47"/>
-<polygon fill="#000000" stroke="#000000" points="4164.35,-302.41 4171.3,-294.41 4160.88,-296.33 4164.35,-302.41"/>
+<!-- picosnitch__main_process__main_process&#45;&gt;picosnitch__process_manager__ProcessManager____init__ -->
+<g id="edge29" class="edge">
+<title>picosnitch__main_process__main_process&#45;&gt;picosnitch__process_manager__ProcessManager____init__</title>
+<path fill="none" stroke="#000000" d="M1160.38,-725.65C1063.13,-720.35 899.23,-708.48 881,-688 856.48,-660.44 855.78,-631.92 881,-605 899.73,-585.01 980.26,-610.67 1004,-597 1024.17,-585.39 1038.19,-562.63 1046.72,-544.5"/>
+<polygon fill="#000000" stroke="#000000" points="1050.08,-545.58 1050.9,-535.02 1043.67,-542.76 1050.08,-545.58"/>
 </g>
-<!-- picosnitch__monitor_subprocess__queue_exec_event -->
+<!-- picosnitch__process_manager__ProcessManager__is_alive -->
 <g id="node54" class="node">
-<title>picosnitch__monitor_subprocess__queue_exec_event</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="3397" cy="-277" rx="94.78" ry="18"/>
-<text text-anchor="middle" x="3397" y="-273.3" font-family="Times,serif" font-size="14.00" fill="#000000">queue_exec_event</text>
+<title>picosnitch__process_manager__ProcessManager__is_alive</title>
+<ellipse fill="#65feff" fill-opacity="0.698039" stroke="black" cx="1164" cy="-517" rx="44.69" ry="18"/>
+<text text-anchor="middle" x="1164" y="-513.3" font-family="Times,serif" font-size="14.00" fill="#000000">is_alive</text>
 </g>
-<!-- picosnitch__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__queue_exec_event -->
-<g id="edge36" class="edge">
-<title>picosnitch__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__queue_exec_event</title>
-<path fill="none" stroke="#000000" d="M2876.89,-344.47C2894.31,-340.31 2913.86,-336.28 2932,-334 3011.62,-324.01 3214.82,-344.08 3293,-326 3316.75,-320.51 3341.6,-309.27 3361.05,-299.05"/>
-<polygon fill="#000000" stroke="#000000" points="3362.73,-302.12 3369.86,-294.29 3359.4,-295.96 3362.73,-302.12"/>
+<!-- picosnitch__main_process__main_process&#45;&gt;picosnitch__process_manager__ProcessManager__is_alive -->
+<g id="edge30" class="edge">
+<title>picosnitch__main_process__main_process&#45;&gt;picosnitch__process_manager__ProcessManager__is_alive</title>
+<path fill="none" stroke="#000000" d="M1160.96,-725.13C1068.85,-719.38 917.92,-707.15 901,-688 876.57,-660.36 875.42,-631.58 901,-605 917.12,-588.26 1089.66,-608.24 1110,-597 1130.58,-585.63 1144.92,-562.68 1153.62,-544.43"/>
+<polygon fill="#000000" stroke="#000000" points="1156.88,-545.7 1157.76,-535.14 1150.49,-542.84 1156.88,-545.7"/>
 </g>
-<!-- picosnitch__monitor_subprocess__queue_lost -->
+<!-- picosnitch__process_manager__ProcessManager__is_zombie -->
 <g id="node55" class="node">
-<title>picosnitch__monitor_subprocess__queue_lost</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="3801" cy="-277" rx="60.39" ry="18"/>
-<text text-anchor="middle" x="3801" y="-273.3" font-family="Times,serif" font-size="14.00" fill="#000000">queue_lost</text>
+<title>picosnitch__process_manager__ProcessManager__is_zombie</title>
+<ellipse fill="#65feff" fill-opacity="0.698039" stroke="black" cx="1283" cy="-517" rx="55.79" ry="18"/>
+<text text-anchor="middle" x="1283" y="-513.3" font-family="Times,serif" font-size="14.00" fill="#000000">is_zombie</text>
 </g>
-<!-- picosnitch__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__queue_lost -->
-<g id="edge37" class="edge">
-<title>picosnitch__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__queue_lost</title>
-<path fill="none" stroke="#000000" d="M2876.6,-344.41C2894.09,-340.21 2913.75,-336.18 2932,-334 2976.13,-328.73 3689.66,-339.51 3732,-326 3748.04,-320.88 3763.64,-310.63 3775.93,-300.91"/>
-<polygon fill="#000000" stroke="#000000" points="3778.41,-303.4 3783.88,-294.33 3773.95,-298.01 3778.41,-303.4"/>
+<!-- picosnitch__main_process__main_process&#45;&gt;picosnitch__process_manager__ProcessManager__is_zombie -->
+<g id="edge31" class="edge">
+<title>picosnitch__main_process__main_process&#45;&gt;picosnitch__process_manager__ProcessManager__is_zombie</title>
+<path fill="none" stroke="#000000" d="M1161.9,-724.58C1075.08,-718.39 936.64,-705.84 921,-688 896.68,-660.26 895.27,-631.43 921,-605 932.51,-593.17 1203.17,-604.25 1218,-597 1240.93,-585.79 1258.6,-562.27 1269.69,-543.79"/>
+<polygon fill="#000000" stroke="#000000" points="1272.82,-545.36 1274.74,-534.94 1266.75,-541.89 1272.82,-545.36"/>
 </g>
-<!-- picosnitch__monitor_subprocess__queue_recvv4_event -->
+<!-- picosnitch__process_manager__ProcessManager__memory -->
 <g id="node56" class="node">
-<title>picosnitch__monitor_subprocess__queue_recvv4_event</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="3179" cy="-277" rx="104.78" ry="18"/>
-<text text-anchor="middle" x="3179" y="-273.3" font-family="Times,serif" font-size="14.00" fill="#000000">queue_recvv4_event</text>
+<title>picosnitch__process_manager__ProcessManager__memory</title>
+<ellipse fill="#65feff" fill-opacity="0.698039" stroke="black" cx="1406" cy="-517" rx="48.99" ry="18"/>
+<text text-anchor="middle" x="1406" y="-513.3" font-family="Times,serif" font-size="14.00" fill="#000000">memory</text>
 </g>
-<!-- picosnitch__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__queue_recvv4_event -->
-<g id="edge38" class="edge">
-<title>picosnitch__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__queue_recvv4_event</title>
-<path fill="none" stroke="#000000" d="M2878.05,-344.62C2895.19,-340.56 2914.29,-336.56 2932,-334 2991.05,-325.46 3007.92,-339.64 3066,-326 3091.31,-320.06 3118.14,-308.88 3139.31,-298.81"/>
-<polygon fill="#000000" stroke="#000000" points="3140.85,-301.95 3148.32,-294.43 3137.79,-295.66 3140.85,-301.95"/>
-</g>
-<!-- picosnitch__monitor_subprocess__queue_recvv6_event -->
-<g id="node57" class="node">
-<title>picosnitch__monitor_subprocess__queue_recvv6_event</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="3984" cy="-277" rx="104.78" ry="18"/>
-<text text-anchor="middle" x="3984" y="-273.3" font-family="Times,serif" font-size="14.00" fill="#000000">queue_recvv6_event</text>
+<!-- picosnitch__main_process__main_process&#45;&gt;picosnitch__process_manager__ProcessManager__memory -->
+<g id="edge32" class="edge">
+<title>picosnitch__main_process__main_process&#45;&gt;picosnitch__process_manager__ProcessManager__memory</title>
+<path fill="none" stroke="#000000" d="M1303.31,-725.56C1361.07,-721.1 1435.89,-710.95 1455,-688 1490.34,-645.57 1451.88,-578.9 1425.85,-542.96"/>
+<polygon fill="#000000" stroke="#000000" points="1428.34,-540.44 1419.55,-534.52 1422.72,-544.63 1428.34,-540.44"/>
 </g>
-<!-- picosnitch__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__queue_recvv6_event -->
-<g id="edge39" class="edge">
-<title>picosnitch__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__queue_recvv6_event</title>
-<path fill="none" stroke="#000000" d="M2876.6,-344.39C2894.08,-340.19 2913.75,-336.16 2932,-334 2983.75,-327.86 3818.96,-336.53 3870,-326 3896.01,-320.63 3923.5,-309.24 3944.97,-298.91"/>
-<polygon fill="#000000" stroke="#000000" points="3946.66,-301.98 3954.08,-294.41 3943.56,-295.7 3946.66,-301.98"/>
+<!-- picosnitch__main_process__main_process&#45;&gt;picosnitch__process_manager__ProcessManager__start -->
+<g id="edge33" class="edge">
+<title>picosnitch__main_process__main_process&#45;&gt;picosnitch__process_manager__ProcessManager__start</title>
+<path fill="none" stroke="#000000" d="M1158.87,-727.51C1049.92,-724.41 850.74,-715.12 785,-688 726.35,-663.8 702.02,-654.41 675,-597 653.43,-551.16 641.87,-521.34 675,-483 718.37,-432.81 923,-426.75 1013.62,-426.59"/>
+<polygon fill="#000000" stroke="#000000" points="1013.83,-430.09 1023.83,-426.6 1013.84,-423.09 1013.83,-430.09"/>
 </g>
-<!-- picosnitch__monitor_subprocess__queue_sendv4_event -->
+<!-- picosnitch__process_manager__ProcessManager__terminate -->
 <g id="node58" class="node">
-<title>picosnitch__monitor_subprocess__queue_sendv4_event</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="3616" cy="-277" rx="106.68" ry="18"/>
-<text text-anchor="middle" x="3616" y="-273.3" font-family="Times,serif" font-size="14.00" fill="#000000">queue_sendv4_event</text>
+<title>picosnitch__process_manager__ProcessManager__terminate</title>
+<ellipse fill="#65feff" fill-opacity="0.698039" stroke="black" cx="938" cy="-517" rx="56.59" ry="18"/>
+<text text-anchor="middle" x="938" y="-513.3" font-family="Times,serif" font-size="14.00" fill="#000000">terminate</text>
 </g>
-<!-- picosnitch__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__queue_sendv4_event -->
-<g id="edge40" class="edge">
-<title>picosnitch__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__queue_sendv4_event</title>
-<path fill="none" stroke="#000000" d="M2876.61,-344.45C2894.09,-340.26 2913.75,-336.21 2932,-334 2994.77,-326.38 3439.09,-338.85 3501,-326 3527.2,-320.56 3554.93,-309.17 3576.6,-298.85"/>
-<polygon fill="#000000" stroke="#000000" points="3578.34,-301.89 3585.79,-294.36 3575.27,-295.6 3578.34,-301.89"/>
+<!-- picosnitch__main_process__main_process&#45;&gt;picosnitch__process_manager__ProcessManager__terminate -->
+<g id="edge34" class="edge">
+<title>picosnitch__main_process__main_process&#45;&gt;picosnitch__process_manager__ProcessManager__terminate</title>
+<path fill="none" stroke="#000000" d="M1160.17,-726.13C1057.92,-721.29 880.56,-709.84 861,-688 836.39,-660.52 841.61,-636.38 861,-605 865.18,-598.24 870.86,-602.05 877,-597 895.29,-581.95 911.44,-560.45 922.52,-543.68"/>
+<polygon fill="#000000" stroke="#000000" points="925.68,-545.23 928.13,-534.92 919.79,-541.45 925.68,-545.23"/>
 </g>
-<!-- picosnitch__monitor_subprocess__queue_sendv6_event -->
+<!-- picosnitch__rfuse_subprocess__rfuse_subprocess -->
 <g id="node59" class="node">
-<title>picosnitch__monitor_subprocess__queue_sendv6_event</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="2950" cy="-277" rx="106.68" ry="18"/>
-<text text-anchor="middle" x="2950" y="-273.3" font-family="Times,serif" font-size="14.00" fill="#000000">queue_sendv6_event</text>
+<title>picosnitch__rfuse_subprocess__rfuse_subprocess</title>
+<ellipse fill="#99d3ff" fill-opacity="0.698039" stroke="black" cx="1044" cy="-639" rx="90.98" ry="18"/>
+<text text-anchor="middle" x="1044" y="-635.3" font-family="Times,serif" font-size="14.00" fill="#000000">rfuse_subprocess</text>
 </g>
-<!-- picosnitch__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__queue_sendv6_event -->
-<g id="edge41" class="edge">
-<title>picosnitch__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__queue_sendv6_event</title>
-<path fill="none" stroke="#000000" d="M2849.8,-342.41C2868.83,-330.18 2894.9,-313.42 2915.69,-300.06"/>
-<polygon fill="#000000" stroke="#000000" points="2917.71,-302.92 2924.23,-294.56 2913.93,-297.03 2917.71,-302.92"/>
+<!-- picosnitch__main_process__main_process&#45;&gt;picosnitch__rfuse_subprocess__rfuse_subprocess -->
+<g id="edge35" class="edge">
+<title>picosnitch__main_process__main_process&#45;&gt;picosnitch__rfuse_subprocess__rfuse_subprocess</title>
+<path fill="none" stroke="#000000" d="M1199.68,-713.7C1168.49,-698.94 1121.09,-676.49 1086.78,-660.25"/>
+<polygon fill="#000000" stroke="#000000" points="1088.01,-656.96 1077.48,-655.85 1085.02,-663.29 1088.01,-656.96"/>
 </g>
-<!-- picosnitch__primary_subprocess_helper -->
-<g id="node18" class="node">
-<title>picosnitch__primary_subprocess_helper</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="356" cy="-205" rx="138.38" ry="18"/>
-<text text-anchor="middle" x="356" y="-201.3" font-family="Times,serif" font-size="14.00" fill="#000000">primary_subprocess_helper</text>
+<!-- picosnitch__secondary_subprocess__secondary_subprocess -->
+<g id="node60" class="node">
+<title>picosnitch__secondary_subprocess__secondary_subprocess</title>
+<ellipse fill="#99a7ff" fill-opacity="0.698039" stroke="black" cx="1698" cy="-639" rx="114.28" ry="18"/>
+<text text-anchor="middle" x="1698" y="-635.3" font-family="Times,serif" font-size="14.00" fill="#000000">secondary_subprocess</text>
 </g>
-<!-- picosnitch__primary_subprocess&#45;&gt;picosnitch__primary_subprocess_helper -->
-<g id="edge58" class="edge">
-<title>picosnitch__primary_subprocess&#45;&gt;picosnitch__primary_subprocess_helper</title>
-<path fill="none" stroke="#000000" d="M503.95,-348.44C515.69,-343.42 526.37,-336.23 534,-326 553.93,-299.28 554.48,-277.3 534,-251 523.66,-237.72 491.58,-227.74 457.44,-220.6"/>
-<polygon fill="#000000" stroke="#000000" points="457.78,-217.1 447.29,-218.57 456.41,-223.96 457.78,-217.1"/>
+<!-- picosnitch__main_process__main_process&#45;&gt;picosnitch__secondary_subprocess__secondary_subprocess -->
+<g id="edge36" class="edge">
+<title>picosnitch__main_process__main_process&#45;&gt;picosnitch__secondary_subprocess__secondary_subprocess</title>
+<path fill="none" stroke="#000000" d="M1293.53,-720.1C1344.88,-712.42 1419.91,-700.6 1485,-688 1533.24,-678.67 1587.23,-666.48 1628.78,-656.72"/>
+<polygon fill="#000000" stroke="#000000" points="1629.6,-660.13 1638.53,-654.42 1627.99,-653.31 1629.6,-660.13"/>
 </g>
-<!-- picosnitch__write_snitch -->
-<g id="node31" class="node">
-<title>picosnitch__write_snitch</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="112" cy="-205" rx="67.69" ry="18"/>
-<text text-anchor="middle" x="112" y="-201.3" font-family="Times,serif" font-size="14.00" fill="#000000">write_snitch</text>
+<!-- picosnitch__virustotal_subprocess__virustotal_subprocess -->
+<g id="node89" class="node">
+<title>picosnitch__virustotal_subprocess__virustotal_subprocess</title>
+<ellipse fill="#ff99f0" fill-opacity="0.698039" stroke="black" cx="322" cy="-335" rx="112.38" ry="18"/>
+<text text-anchor="middle" x="322" y="-331.3" font-family="Times,serif" font-size="14.00" fill="#000000">virustotal_subprocess</text>
 </g>
-<!-- picosnitch__primary_subprocess&#45;&gt;picosnitch__write_snitch -->
-<g id="edge59" class="edge">
-<title>picosnitch__primary_subprocess&#45;&gt;picosnitch__write_snitch</title>
-<path fill="none" stroke="#000000" d="M320.26,-356.25C222.72,-352.55 88.56,-344.19 72,-326 49.56,-301.35 60.15,-282.16 72,-251 74.93,-243.31 79.84,-236.09 85.23,-229.78"/>
-<polygon fill="#000000" stroke="#000000" points="87.95,-232 92.22,-222.31 82.83,-227.22 87.95,-232"/>
+<!-- picosnitch__main_process__main_process&#45;&gt;picosnitch__virustotal_subprocess__virustotal_subprocess -->
+<g id="edge37" class="edge">
+<title>picosnitch__main_process__main_process&#45;&gt;picosnitch__virustotal_subprocess__virustotal_subprocess</title>
+<path fill="none" stroke="#000000" d="M1304.12,-726.31C1365.34,-722.32 1446.45,-712.45 1467,-688 1488.16,-662.82 1490.11,-415.4 1467,-392 1460.84,-385.76 844.75,-384.46 836,-384 690.7,-376.31 522.98,-359.07 419.71,-347.48"/>
+<polygon fill="#000000" stroke="#000000" points="419.94,-343.99 409.61,-346.35 419.15,-350.94 419.94,-343.99"/>
 </g>
-<!-- picosnitch__NotificationManager__enable_notifications -->
-<g id="node42" class="node">
-<title>picosnitch__NotificationManager__enable_notifications</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="256" cy="-50" rx="103.18" ry="18"/>
-<text text-anchor="middle" x="256" y="-46.3" font-family="Times,serif" font-size="14.00" fill="#000000">enable_notifications</text>
+<!-- picosnitch__main_process__main_process__clean_exit&#45;&gt;picosnitch__process_manager__ProcessManager -->
+<g id="edge38" class="edge">
+<title>picosnitch__main_process__main_process__clean_exit&#45;&gt;picosnitch__process_manager__ProcessManager</title>
+<path fill="none" stroke="#000000" d="M1202.07,-623.49C1186.12,-616.5 1165.93,-608.83 1147,-605 1116.71,-598.87 897.88,-608 869,-597 839.71,-585.85 813.07,-561.46 795.68,-542.7"/>
+<polygon fill="#000000" stroke="#000000" points="798.11,-540.17 788.82,-535.07 792.9,-544.85 798.11,-540.17"/>
 </g>
-<!-- picosnitch__primary_subprocess&#45;&gt;picosnitch__NotificationManager__enable_notifications -->
-<g id="edge54" class="edge">
-<title>picosnitch__primary_subprocess&#45;&gt;picosnitch__NotificationManager__enable_notifications</title>
-<path fill="none" stroke="#000000" d="M496.2,-347.1C518.63,-341.86 539.2,-334.86 546,-326 566.29,-299.55 557.24,-282.38 546,-251 540.57,-235.84 531.52,-236.67 523,-223 511.64,-204.77 517.59,-194.77 503,-179 456.11,-128.34 428.39,-135.55 367,-104 345.09,-92.74 320.4,-80.87 299.87,-71.22"/>
-<polygon fill="#000000" stroke="#000000" points="301.3,-68.03 290.75,-66.96 298.33,-74.37 301.3,-68.03"/>
+<!-- picosnitch__main_process__main_process__clean_exit&#45;&gt;picosnitch__process_manager__ProcessManager__terminate -->
+<g id="edge39" class="edge">
+<title>picosnitch__main_process__main_process__clean_exit&#45;&gt;picosnitch__process_manager__ProcessManager__terminate</title>
+<path fill="none" stroke="#000000" d="M1201.64,-623.53C1185.73,-616.64 1165.72,-609.05 1147,-605 1115.89,-598.27 1032.44,-611.28 1004,-597 981.05,-585.47 963.06,-561.99 951.7,-543.61"/>
+<polygon fill="#000000" stroke="#000000" points="954.61,-541.65 946.52,-534.81 948.58,-545.2 954.61,-541.65"/>
 </g>
-<!-- picosnitch__NotificationManager__toast -->
-<g id="node43" class="node">
-<title>picosnitch__NotificationManager__toast</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="199" cy="-122" rx="34.39" ry="18"/>
-<text text-anchor="middle" x="199" y="-118.3" font-family="Times,serif" font-size="14.00" fill="#000000">toast</text>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess_initial_poll -->
+<g id="node34" class="node">
+<title>picosnitch__monitor_subprocess__monitor_subprocess_initial_poll</title>
+<ellipse fill="#b6ff99" fill-opacity="0.698039" stroke="black" cx="2319" cy="-426" rx="156.77" ry="18"/>
+<text text-anchor="middle" x="2319" y="-422.3" font-family="Times,serif" font-size="14.00" fill="#000000">monitor_subprocess_initial_poll</text>
 </g>
-<!-- picosnitch__primary_subprocess&#45;&gt;picosnitch__NotificationManager__toast -->
-<g id="edge55" class="edge">
-<title>picosnitch__primary_subprocess&#45;&gt;picosnitch__NotificationManager__toast</title>
-<path fill="none" stroke="#000000" d="M320.74,-356.05C218.73,-352.13 74.43,-343.54 55,-326 6.05,-281.82 -3.36,-232.63 35,-179 61.99,-141.26 115.98,-128.67 154.64,-124.62"/>
-<polygon fill="#000000" stroke="#000000" points="154.96,-128.11 164.61,-123.73 154.34,-121.13 154.96,-128.11"/>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess_initial_poll -->
+<g id="edge49" class="edge">
+<title>picosnitch__monitor_subprocess__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess_initial_poll</title>
+<path fill="none" stroke="#000000" d="M3163.65,-513.65C2981.74,-508.98 2609.2,-497.02 2481,-475 2444.48,-468.73 2404.55,-456.96 2373.48,-446.64"/>
+<polygon fill="#000000" stroke="#000000" points="2374.31,-443.23 2363.71,-443.35 2372.07,-449.86 2374.31,-443.23"/>
 </g>
-<!-- picosnitch__primary_subprocess__snitch_pipe_thread -->
-<g id="node60" class="node">
-<title>picosnitch__primary_subprocess__snitch_pipe_thread</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="423" cy="-277" rx="98.58" ry="18"/>
-<text text-anchor="middle" x="423" y="-273.3" font-family="Times,serif" font-size="14.00" fill="#000000">snitch_pipe_thread</text>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess__get_cmdline -->
+<g id="node35" class="node">
+<title>picosnitch__monitor_subprocess__monitor_subprocess__get_cmdline</title>
+<ellipse fill="#91ff65" fill-opacity="0.698039" stroke="black" cx="3047" cy="-335" rx="66.89" ry="18"/>
+<text text-anchor="middle" x="3047" y="-331.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_cmdline</text>
 </g>
-<!-- picosnitch__primary_subprocess&#45;&gt;picosnitch__primary_subprocess__snitch_pipe_thread -->
-<g id="edge56" class="edge">
-<title>picosnitch__primary_subprocess&#45;&gt;picosnitch__primary_subprocess__snitch_pipe_thread</title>
-<path fill="none" stroke="#000000" d="M423,-341.82C423,-331.19 423,-317.31 423,-305.2"/>
-<polygon fill="#000000" stroke="#000000" points="426.5,-305.15 423,-295.15 419.5,-305.15 426.5,-305.15"/>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__get_cmdline -->
+<g id="edge40" class="edge">
+<title>picosnitch__monitor_subprocess__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__get_cmdline</title>
+<path fill="none" stroke="#000000" d="M3368.24,-513.48C3553.29,-508.41 3926.53,-495.68 3946,-475 3958.64,-461.57 3958.98,-405.11 3946,-392 3929.91,-375.76 3144.93,-390.46 3123,-384 3105.4,-378.81 3087.93,-368.26 3074.19,-358.37"/>
+<polygon fill="#000000" stroke="#000000" points="3076.25,-355.54 3066.14,-352.35 3072.05,-361.15 3076.25,-355.54"/>
 </g>
-<!-- picosnitch__primary_subprocess__write_snitch_and_exit -->
-<g id="node61" class="node">
-<title>picosnitch__primary_subprocess__write_snitch_and_exit</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="195" cy="-277" rx="111.28" ry="18"/>
-<text text-anchor="middle" x="195" y="-273.3" font-family="Times,serif" font-size="14.00" fill="#000000">write_snitch_and_exit</text>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess__get_fd -->
+<g id="node36" class="node">
+<title>picosnitch__monitor_subprocess__monitor_subprocess__get_fd</title>
+<ellipse fill="#91ff65" fill-opacity="0.698039" stroke="black" cx="3172" cy="-335" rx="39.79" ry="18"/>
+<text text-anchor="middle" x="3172" y="-331.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_fd</text>
 </g>
-<!-- picosnitch__primary_subprocess&#45;&gt;picosnitch__primary_subprocess__write_snitch_and_exit -->
-<g id="edge57" class="edge">
-<title>picosnitch__primary_subprocess&#45;&gt;picosnitch__primary_subprocess__write_snitch_and_exit</title>
-<path fill="none" stroke="#000000" d="M371.62,-344.26C353.61,-338.84 333.31,-332.45 315,-326 290.66,-317.43 263.98,-306.88 241.97,-297.85"/>
-<polygon fill="#000000" stroke="#000000" points="243.1,-294.53 232.52,-293.95 240.43,-301 243.1,-294.53"/>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__get_fd -->
+<g id="edge41" class="edge">
+<title>picosnitch__monitor_subprocess__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__get_fd</title>
+<path fill="none" stroke="#000000" d="M3368.29,-513.62C3556.63,-508.73 3941.01,-496.2 3961,-475 3986.3,-448.16 3986.14,-418.99 3961,-392 3910.65,-337.95 3387.64,-335.2 3222.01,-335.69"/>
+<polygon fill="#000000" stroke="#000000" points="3221.61,-332.2 3211.63,-335.73 3221.64,-339.2 3221.61,-332.2"/>
 </g>
-<!-- picosnitch__primary_subprocess_helper&#45;&gt;picosnitch__NotificationManager__toast -->
-<g id="edge62" class="edge">
-<title>picosnitch__primary_subprocess_helper&#45;&gt;picosnitch__NotificationManager__toast</title>
-<path fill="none" stroke="#000000" d="M296.14,-188.73C282.18,-184.02 267.7,-178.14 255,-171 242.85,-164.17 230.9,-154.46 221.18,-145.56"/>
-<polygon fill="#000000" stroke="#000000" points="223.57,-143.01 213.91,-138.67 218.76,-148.09 223.57,-143.01"/>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess__queue_dns_event -->
+<g id="node37" class="node">
+<title>picosnitch__monitor_subprocess__monitor_subprocess__queue_dns_event</title>
+<ellipse fill="#91ff65" fill-opacity="0.698039" stroke="black" cx="3847" cy="-426" rx="90.18" ry="18"/>
+<text text-anchor="middle" x="3847" y="-422.3" font-family="Times,serif" font-size="14.00" fill="#000000">queue_dns_event</text>
 </g>
-<!-- picosnitch__read_snitch&#45;&gt;picosnitch__write_snitch -->
-<g id="edge63" class="edge">
-<title>picosnitch__read_snitch&#45;&gt;picosnitch__write_snitch</title>
-<path fill="none" stroke="#000000" d="M1819.8,-427.56C1808.36,-423.28 1795.33,-419.17 1783,-417 1702.35,-402.8 389.84,-422.1 309,-409 191.77,-390 124.73,-422.14 55,-326 35.43,-299.02 40.46,-281 55,-251 59.45,-241.81 66.8,-233.93 74.75,-227.45"/>
-<polygon fill="#000000" stroke="#000000" points="76.89,-230.22 82.83,-221.44 72.72,-224.6 76.89,-230.22"/>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__queue_dns_event -->
+<g id="edge42" class="edge">
+<title>picosnitch__monitor_subprocess__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__queue_dns_event</title>
+<path fill="none" stroke="#000000" d="M3365.66,-511.81C3485.28,-506.03 3678.46,-494.11 3748,-475 3770.06,-468.94 3793.15,-458.04 3811.47,-448.16"/>
+<polygon fill="#000000" stroke="#000000" points="3813.26,-451.17 3820.32,-443.27 3809.88,-445.04 3813.26,-451.17"/>
 </g>
-<!-- picosnitch__reverse_dns_lookup -->
-<g id="node20" class="node">
-<title>picosnitch__reverse_dns_lookup</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="634" cy="-205" rx="102.08" ry="18"/>
-<text text-anchor="middle" x="634" y="-201.3" font-family="Times,serif" font-size="14.00" fill="#000000">reverse_dns_lookup</text>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess__queue_exec_event -->
+<g id="node38" class="node">
+<title>picosnitch__monitor_subprocess__monitor_subprocess__queue_exec_event</title>
+<ellipse fill="#91ff65" fill-opacity="0.698039" stroke="black" cx="3047" cy="-426" rx="94.78" ry="18"/>
+<text text-anchor="middle" x="3047" y="-422.3" font-family="Times,serif" font-size="14.00" fill="#000000">queue_exec_event</text>
 </g>
-<!-- picosnitch__secondary_subprocess&#45;&gt;picosnitch__get_fanotify_events -->
-<g id="edge64" class="edge">
-<title>picosnitch__secondary_subprocess&#45;&gt;picosnitch__get_fanotify_events</title>
-<path fill="none" stroke="#000000" d="M1250,-341.82C1250,-331.19 1250,-317.31 1250,-305.2"/>
-<polygon fill="#000000" stroke="#000000" points="1253.5,-305.15 1250,-295.15 1246.5,-305.15 1253.5,-305.15"/>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__queue_exec_event -->
+<g id="edge43" class="edge">
+<title>picosnitch__monitor_subprocess__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__queue_exec_event</title>
+<path fill="none" stroke="#000000" d="M3219.89,-500.84C3198.46,-493.51 3172.74,-484.29 3150,-475 3129.38,-466.57 3106.91,-456.24 3088.23,-447.32"/>
+<polygon fill="#000000" stroke="#000000" points="3089.65,-444.12 3079.12,-442.94 3086.61,-450.43 3089.65,-444.12"/>
 </g>
-<!-- picosnitch__secondary_subprocess&#45;&gt;picosnitch__get_vt_results -->
-<g id="edge65" class="edge">
-<title>picosnitch__secondary_subprocess&#45;&gt;picosnitch__get_vt_results</title>
-<path fill="none" stroke="#000000" d="M1192.62,-344.41C1175.42,-339.34 1156.69,-333.11 1140,-326 1122.41,-318.5 1103.8,-308.29 1088.5,-299.21"/>
-<polygon fill="#000000" stroke="#000000" points="1090.28,-296.19 1079.91,-294.02 1086.66,-302.19 1090.28,-296.19"/>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess__queue_lost -->
+<g id="node39" class="node">
+<title>picosnitch__monitor_subprocess__monitor_subprocess__queue_lost</title>
+<ellipse fill="#91ff65" fill-opacity="0.698039" stroke="black" cx="3451" cy="-426" rx="60.39" ry="18"/>
+<text text-anchor="middle" x="3451" y="-422.3" font-family="Times,serif" font-size="14.00" fill="#000000">queue_lost</text>
 </g>
-<!-- picosnitch__secondary_subprocess_helper -->
-<g id="node23" class="node">
-<title>picosnitch__secondary_subprocess_helper</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="812" cy="-277" rx="148.67" ry="18"/>
-<text text-anchor="middle" x="812" y="-273.3" font-family="Times,serif" font-size="14.00" fill="#000000">secondary_subprocess_helper</text>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__queue_lost -->
+<g id="edge44" class="edge">
+<title>picosnitch__monitor_subprocess__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__queue_lost</title>
+<path fill="none" stroke="#000000" d="M3316.9,-501.29C3337.62,-494.47 3361.47,-485.52 3382,-475 3396.11,-467.77 3410.67,-458.03 3422.75,-449.22"/>
+<polygon fill="#000000" stroke="#000000" points="3425.15,-451.79 3431.08,-443.01 3420.97,-446.18 3425.15,-451.79"/>
 </g>
-<!-- picosnitch__secondary_subprocess&#45;&gt;picosnitch__secondary_subprocess_helper -->
-<g id="edge66" class="edge">
-<title>picosnitch__secondary_subprocess&#45;&gt;picosnitch__secondary_subprocess_helper</title>
-<path fill="none" stroke="#000000" d="M1188.99,-344.72C1169.3,-340.62 1147.32,-336.57 1127,-334 1057.68,-325.24 1038.83,-338.02 970,-326 934.2,-319.75 895.1,-307.91 864.76,-297.56"/>
-<polygon fill="#000000" stroke="#000000" points="865.83,-294.23 855.23,-294.26 863.54,-300.84 865.83,-294.23"/>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess__queue_recvv4_event -->
+<g id="node40" class="node">
+<title>picosnitch__monitor_subprocess__monitor_subprocess__queue_recvv4_event</title>
+<ellipse fill="#91ff65" fill-opacity="0.698039" stroke="black" cx="2829" cy="-426" rx="104.78" ry="18"/>
+<text text-anchor="middle" x="2829" y="-422.3" font-family="Times,serif" font-size="14.00" fill="#000000">queue_recvv4_event</text>
 </g>
-<!-- picosnitch__secondary_subprocess_helper&#45;&gt;picosnitch__reverse_dns_lookup -->
-<g id="edge67" class="edge">
-<title>picosnitch__secondary_subprocess_helper&#45;&gt;picosnitch__reverse_dns_lookup</title>
-<path fill="none" stroke="#000000" d="M770.27,-259.59C744.16,-249.32 710.41,-236.05 683.03,-225.28"/>
-<polygon fill="#000000" stroke="#000000" points="684.23,-221.99 673.64,-221.59 681.66,-228.51 684.23,-221.99"/>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__queue_recvv4_event -->
+<g id="edge45" class="edge">
+<title>picosnitch__monitor_subprocess__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__queue_recvv4_event</title>
+<path fill="none" stroke="#000000" d="M3168.56,-510.56C3103.76,-505.27 3017.24,-494.94 2943,-475 2918.07,-468.3 2891.41,-457.31 2870.15,-447.54"/>
+<polygon fill="#000000" stroke="#000000" points="2871.63,-444.36 2861.09,-443.29 2868.66,-450.7 2871.63,-444.36"/>
 </g>
-<!-- picosnitch__secondary_subprocess_sha_wrapper -->
-<g id="node24" class="node">
-<title>picosnitch__secondary_subprocess_sha_wrapper</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="933" cy="-205" rx="178.97" ry="18"/>
-<text text-anchor="middle" x="933" y="-201.3" font-family="Times,serif" font-size="14.00" fill="#000000">secondary_subprocess_sha_wrapper</text>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess__queue_recvv6_event -->
+<g id="node41" class="node">
+<title>picosnitch__monitor_subprocess__monitor_subprocess__queue_recvv6_event</title>
+<ellipse fill="#91ff65" fill-opacity="0.698039" stroke="black" cx="3634" cy="-426" rx="104.78" ry="18"/>
+<text text-anchor="middle" x="3634" y="-422.3" font-family="Times,serif" font-size="14.00" fill="#000000">queue_recvv6_event</text>
 </g>
-<!-- picosnitch__secondary_subprocess_helper&#45;&gt;picosnitch__secondary_subprocess_sha_wrapper -->
-<g id="edge68" class="edge">
-<title>picosnitch__secondary_subprocess_helper&#45;&gt;picosnitch__secondary_subprocess_sha_wrapper</title>
-<path fill="none" stroke="#000000" d="M840.98,-259.23C857.18,-249.86 877.55,-238.08 895.01,-227.98"/>
-<polygon fill="#000000" stroke="#000000" points="896.93,-230.91 903.83,-222.87 893.43,-224.85 896.93,-230.91"/>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__queue_recvv6_event -->
+<g id="edge46" class="edge">
+<title>picosnitch__monitor_subprocess__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__queue_recvv6_event</title>
+<path fill="none" stroke="#000000" d="M3353.24,-507.13C3402.78,-500.81 3465.58,-490.61 3520,-475 3544.52,-467.97 3570.84,-457.12 3592,-447.52"/>
+<polygon fill="#000000" stroke="#000000" points="3593.72,-450.58 3601.33,-443.22 3590.79,-444.23 3593.72,-450.58"/>
 </g>
-<!-- picosnitch__secondary_subprocess_sha_wrapper&#45;&gt;picosnitch__get_sha256_fd -->
-<g id="edge69" class="edge">
-<title>picosnitch__secondary_subprocess_sha_wrapper&#45;&gt;picosnitch__get_sha256_fd</title>
-<path fill="none" stroke="#000000" d="M981.59,-187.52C994.86,-182.61 1009.13,-176.93 1022,-171 1039.26,-163.04 1057.75,-152.94 1073.15,-144.06"/>
-<polygon fill="#000000" stroke="#000000" points="1074.95,-147.06 1081.82,-139 1071.42,-141.02 1074.95,-147.06"/>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess__queue_sendv4_event -->
+<g id="node42" class="node">
+<title>picosnitch__monitor_subprocess__monitor_subprocess__queue_sendv4_event</title>
+<ellipse fill="#91ff65" fill-opacity="0.698039" stroke="black" cx="3266" cy="-426" rx="106.68" ry="18"/>
+<text text-anchor="middle" x="3266" y="-422.3" font-family="Times,serif" font-size="14.00" fill="#000000">queue_sendv4_event</text>
 </g>
-<!-- picosnitch__secondary_subprocess_sha_wrapper&#45;&gt;picosnitch__get_sha256_fuse -->
-<g id="edge70" class="edge">
-<title>picosnitch__secondary_subprocess_sha_wrapper&#45;&gt;picosnitch__get_sha256_fuse</title>
-<path fill="none" stroke="#000000" d="M931.3,-186.82C930.25,-176.19 928.88,-162.31 927.69,-150.2"/>
-<polygon fill="#000000" stroke="#000000" points="931.16,-149.76 926.69,-140.15 924.19,-150.45 931.16,-149.76"/>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__queue_sendv4_event -->
+<g id="edge47" class="edge">
+<title>picosnitch__monitor_subprocess__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__queue_sendv4_event</title>
+<path fill="none" stroke="#000000" d="M3266,-498.84C3266,-486.28 3266,-468.98 3266,-454.5"/>
+<polygon fill="#000000" stroke="#000000" points="3269.5,-454.11 3266,-444.11 3262.5,-454.11 3269.5,-454.11"/>
 </g>
-<!-- picosnitch__secondary_subprocess_sha_wrapper&#45;&gt;picosnitch__get_sha256_pid -->
-<g id="edge71" class="edge">
-<title>picosnitch__secondary_subprocess_sha_wrapper&#45;&gt;picosnitch__get_sha256_pid</title>
-<path fill="none" stroke="#000000" d="M1033.93,-190.14C1062.1,-186.39 1092.73,-182.43 1121,-179 1153.4,-175.07 1162.75,-180.42 1194,-171 1214.4,-164.85 1235.63,-154.26 1252.64,-144.59"/>
-<polygon fill="#000000" stroke="#000000" points="1254.76,-147.41 1261.63,-139.35 1251.23,-141.36 1254.76,-147.41"/>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess__queue_sendv6_event -->
+<g id="node43" class="node">
+<title>picosnitch__monitor_subprocess__monitor_subprocess__queue_sendv6_event</title>
+<ellipse fill="#91ff65" fill-opacity="0.698039" stroke="black" cx="2600" cy="-426" rx="106.68" ry="18"/>
+<text text-anchor="middle" x="2600" y="-422.3" font-family="Times,serif" font-size="14.00" fill="#000000">queue_sendv6_event</text>
 </g>
-<!-- picosnitch__start_picosnitch&#45;&gt;picosnitch__main -->
-<g id="edge77" class="edge">
-<title>picosnitch__start_picosnitch&#45;&gt;picosnitch__main</title>
-<path fill="none" stroke="#000000" d="M2280.4,-712.57C2146.48,-709.89 1899.34,-703.05 1886,-689 1848.62,-649.62 1879.17,-580.85 1900.22,-544"/>
-<polygon fill="#000000" stroke="#000000" points="1903.25,-545.75 1905.32,-535.36 1897.22,-542.19 1903.25,-545.75"/>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__queue_sendv6_event -->
+<g id="edge48" class="edge">
+<title>picosnitch__monitor_subprocess__monitor_subprocess&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__queue_sendv6_event</title>
+<path fill="none" stroke="#000000" d="M3165.41,-512.38C3030.34,-506.84 2797.74,-494.8 2715,-475 2689.34,-468.86 2662.03,-457.68 2640.47,-447.65"/>
+<polygon fill="#000000" stroke="#000000" points="2641.83,-444.42 2631.29,-443.29 2638.82,-450.75 2641.83,-444.42"/>
 </g>
-<!-- picosnitch__start_picosnitch&#45;&gt;picosnitch__read_snitch -->
-<g id="edge78" class="edge">
-<title>picosnitch__start_picosnitch&#45;&gt;picosnitch__read_snitch</title>
-<path fill="none" stroke="#000000" d="M2280.51,-712.71C2141.51,-710.18 1878.43,-703.5 1864,-689 1806.1,-630.81 1829.17,-521.32 1844.09,-470.79"/>
-<polygon fill="#000000" stroke="#000000" points="1847.52,-471.53 1847.12,-460.95 1840.83,-469.48 1847.52,-471.53"/>
+<!-- picosnitch__utils__get_fstat -->
+<g id="node81" class="node">
+<title>picosnitch__utils__get_fstat</title>
+<ellipse fill="#e199ff" fill-opacity="0.698039" stroke="black" cx="1560" cy="-244" rx="51.99" ry="18"/>
+<text text-anchor="middle" x="1560" y="-240.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_fstat</text>
 </g>
-<!-- picosnitch__ui_dash -->
-<g id="node26" class="node">
-<title>picosnitch__ui_dash</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="1370" cy="-609" rx="46.29" ry="18"/>
-<text text-anchor="middle" x="1370" y="-605.3" font-family="Times,serif" font-size="14.00" fill="#000000">ui_dash</text>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess__get_fd&#45;&gt;picosnitch__utils__get_fstat -->
+<g id="edge50" class="edge">
+<title>picosnitch__monitor_subprocess__monitor_subprocess__get_fd&#45;&gt;picosnitch__utils__get_fstat</title>
+<path fill="none" stroke="#000000" d="M3154.71,-318.69C3145.88,-311.87 3134.56,-304.58 3123,-301 3093.01,-291.73 2024.34,-294.84 1993,-293 1857.64,-285.04 1699.52,-264.69 1616.9,-253.21"/>
+<polygon fill="#000000" stroke="#000000" points="1617.35,-249.73 1606.96,-251.82 1616.38,-256.67 1617.35,-249.73"/>
 </g>
-<!-- picosnitch__start_picosnitch&#45;&gt;picosnitch__ui_dash -->
-<g id="edge81" class="edge">
-<title>picosnitch__start_picosnitch&#45;&gt;picosnitch__ui_dash</title>
-<path fill="none" stroke="#000000" d="M2279.83,-714.5C2107.73,-714.96 1724,-713.15 1595,-689 1526.95,-676.26 1451.79,-646.45 1407.85,-627.31"/>
-<polygon fill="#000000" stroke="#000000" points="1409.26,-624.11 1398.7,-623.28 1406.44,-630.52 1409.26,-624.11"/>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess__queue_exec_event&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__get_cmdline -->
+<g id="edge51" class="edge">
+<title>picosnitch__monitor_subprocess__monitor_subprocess__queue_exec_event&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__get_cmdline</title>
+<path fill="none" stroke="#000000" d="M3047,-407.84C3047,-395.28 3047,-377.98 3047,-363.5"/>
+<polygon fill="#000000" stroke="#000000" points="3050.5,-363.11 3047,-353.11 3043.5,-363.11 3050.5,-363.11"/>
 </g>
-<!-- picosnitch__ui_init -->
-<g id="node28" class="node">
-<title>picosnitch__ui_init</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="1644" cy="-609" rx="39.79" ry="18"/>
-<text text-anchor="middle" x="1644" y="-605.3" font-family="Times,serif" font-size="14.00" fill="#000000">ui_init</text>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess__queue_exec_event&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__get_fd -->
+<g id="edge52" class="edge">
+<title>picosnitch__monitor_subprocess__monitor_subprocess__queue_exec_event&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__get_fd</title>
+<path fill="none" stroke="#000000" d="M3081.14,-409.17C3094.69,-402.24 3110.08,-393.51 3123,-384 3132.84,-376.75 3142.66,-367.61 3150.9,-359.25"/>
+<polygon fill="#000000" stroke="#000000" points="3153.58,-361.51 3157.98,-351.87 3148.53,-356.66 3153.58,-361.51"/>
 </g>
-<!-- picosnitch__start_picosnitch&#45;&gt;picosnitch__ui_init -->
-<g id="edge82" class="edge">
-<title>picosnitch__start_picosnitch&#45;&gt;picosnitch__ui_init</title>
-<path fill="none" stroke="#000000" d="M2280.17,-713.19C2155.24,-711.43 1927.94,-705.95 1848,-689 1786.09,-675.88 1718.34,-646.36 1678.58,-627.36"/>
-<polygon fill="#000000" stroke="#000000" points="1680.11,-624.21 1669.58,-623.01 1677.06,-630.51 1680.11,-624.21"/>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess__queue_recvv4_event&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__get_cmdline -->
+<g id="edge53" class="edge">
+<title>picosnitch__monitor_subprocess__monitor_subprocess__queue_recvv4_event&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__get_cmdline</title>
+<path fill="none" stroke="#000000" d="M2867.72,-409.19C2905.48,-393.78 2962.84,-370.36 3002.46,-354.18"/>
+<polygon fill="#000000" stroke="#000000" points="3003.94,-357.36 3011.88,-350.34 3001.3,-350.88 3003.94,-357.36"/>
 </g>
-<!-- picosnitch__Daemon__restart -->
-<g id="node36" class="node">
-<title>picosnitch__Daemon__restart</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="2987" cy="-609" rx="42.79" ry="18"/>
-<text text-anchor="middle" x="2987" y="-605.3" font-family="Times,serif" font-size="14.00" fill="#000000">restart</text>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess__queue_recvv4_event&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__get_fd -->
+<g id="edge54" class="edge">
+<title>picosnitch__monitor_subprocess__monitor_subprocess__queue_recvv4_event&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__get_fd</title>
+<path fill="none" stroke="#000000" d="M2873.1,-409.58C2894.02,-402.96 2919.52,-395.86 2943,-392 2982.51,-385.5 3086.27,-399.95 3123,-384 3134.83,-378.86 3145.42,-369.48 3153.7,-360.37"/>
+<polygon fill="#000000" stroke="#000000" points="3156.54,-362.43 3160.35,-352.54 3151.21,-357.89 3156.54,-362.43"/>
 </g>
-<!-- picosnitch__start_picosnitch&#45;&gt;picosnitch__Daemon__restart -->
-<g id="edge72" class="edge">
-<title>picosnitch__start_picosnitch&#45;&gt;picosnitch__Daemon__restart</title>
-<path fill="none" stroke="#000000" d="M2450.35,-714.72C2600.3,-715.34 2899.13,-713.43 2940,-689 2959.3,-677.46 2971.59,-654.69 2978.75,-636.55"/>
-<polygon fill="#000000" stroke="#000000" points="2982.07,-637.64 2982.2,-627.05 2975.5,-635.25 2982.07,-637.64"/>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess__queue_recvv6_event&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__get_cmdline -->
+<g id="edge55" class="edge">
+<title>picosnitch__monitor_subprocess__monitor_subprocess__queue_recvv6_event&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__get_cmdline</title>
+<path fill="none" stroke="#000000" d="M3590.75,-409.58C3569.69,-402.83 3543.83,-395.63 3520,-392 3476.38,-385.36 3165.26,-396.69 3123,-384 3105.42,-378.72 3087.96,-368.16 3074.21,-358.29"/>
+<polygon fill="#000000" stroke="#000000" points="3076.27,-355.46 3066.16,-352.29 3072.09,-361.07 3076.27,-355.46"/>
 </g>
-<!-- picosnitch__Daemon__start -->
-<g id="node38" class="node">
-<title>picosnitch__Daemon__start</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="3154" cy="-518" rx="33.29" ry="18"/>
-<text text-anchor="middle" x="3154" y="-514.3" font-family="Times,serif" font-size="14.00" fill="#000000">start</text>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess__queue_recvv6_event&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__get_fd -->
+<g id="edge56" class="edge">
+<title>picosnitch__monitor_subprocess__monitor_subprocess__queue_recvv6_event&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__get_fd</title>
+<path fill="none" stroke="#000000" d="M3586.64,-409.88C3566.27,-403.75 3542.12,-396.96 3520,-392 3414.01,-368.23 3287.7,-350.5 3220.2,-341.86"/>
+<polygon fill="#000000" stroke="#000000" points="3220.24,-338.34 3209.88,-340.55 3219.36,-345.28 3220.24,-338.34"/>
 </g>
-<!-- picosnitch__start_picosnitch&#45;&gt;picosnitch__Daemon__start -->
-<g id="edge73" class="edge">
-<title>picosnitch__start_picosnitch&#45;&gt;picosnitch__Daemon__start</title>
-<path fill="none" stroke="#000000" d="M2450.11,-714.33C2647.29,-714.67 3120.51,-712.98 3145,-689 3182.83,-651.95 3172.12,-583.5 3162.28,-545.74"/>
-<polygon fill="#000000" stroke="#000000" points="3165.61,-544.66 3159.57,-535.96 3158.87,-546.53 3165.61,-544.66"/>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess__queue_sendv4_event&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__get_cmdline -->
+<g id="edge57" class="edge">
+<title>picosnitch__monitor_subprocess__monitor_subprocess__queue_sendv4_event&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__get_cmdline</title>
+<path fill="none" stroke="#000000" d="M3214.48,-410.2C3194.64,-404.51 3171.77,-397.95 3151,-392 3138.56,-388.44 3134.81,-389.29 3123,-384 3107.11,-376.89 3090.63,-366.86 3077.1,-357.81"/>
+<polygon fill="#000000" stroke="#000000" points="3078.9,-354.8 3068.67,-352.04 3074.95,-360.57 3078.9,-354.8"/>
 </g>
-<!-- picosnitch__Daemon__status -->
-<g id="node39" class="node">
-<title>picosnitch__Daemon__status</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="2984" cy="-518" rx="39.79" ry="18"/>
-<text text-anchor="middle" x="2984" y="-514.3" font-family="Times,serif" font-size="14.00" fill="#000000">status</text>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess__queue_sendv4_event&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__get_fd -->
+<g id="edge58" class="edge">
+<title>picosnitch__monitor_subprocess__monitor_subprocess__queue_sendv4_event&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__get_fd</title>
+<path fill="none" stroke="#000000" d="M3247.88,-407.84C3233.11,-393.86 3212.14,-374.01 3195.99,-358.71"/>
+<polygon fill="#000000" stroke="#000000" points="3198.16,-355.95 3188.49,-351.62 3193.35,-361.03 3198.16,-355.95"/>
 </g>
-<!-- picosnitch__start_picosnitch&#45;&gt;picosnitch__Daemon__status -->
-<g id="edge74" class="edge">
-<title>picosnitch__start_picosnitch&#45;&gt;picosnitch__Daemon__status</title>
-<path fill="none" stroke="#000000" d="M2416.21,-700.53C2429.53,-696.91 2443.83,-692.91 2457,-689 2615.46,-641.98 2648.58,-605.69 2811,-575 2839.22,-569.67 2914.08,-579.37 2940,-567 2950.94,-561.78 2960.43,-552.52 2967.77,-543.51"/>
-<polygon fill="#000000" stroke="#000000" points="2970.64,-545.52 2973.88,-535.44 2965.05,-541.29 2970.64,-545.52"/>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess__queue_sendv6_event&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__get_cmdline -->
+<g id="edge59" class="edge">
+<title>picosnitch__monitor_subprocess__monitor_subprocess__queue_sendv6_event&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__get_cmdline</title>
+<path fill="none" stroke="#000000" d="M2648.09,-409.9C2668.57,-403.8 2692.82,-397.04 2715,-392 2805.27,-371.5 2910.91,-354.93 2978.36,-345.28"/>
+<polygon fill="#000000" stroke="#000000" points="2979.03,-348.72 2988.44,-343.85 2978.04,-341.79 2979.03,-348.72"/>
 </g>
-<!-- picosnitch__Daemon__stop -->
-<g id="node40" class="node">
-<title>picosnitch__Daemon__stop</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="3072" cy="-518" rx="30.59" ry="18"/>
-<text text-anchor="middle" x="3072" y="-514.3" font-family="Times,serif" font-size="14.00" fill="#000000">stop</text>
+<!-- picosnitch__monitor_subprocess__monitor_subprocess__queue_sendv6_event&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__get_fd -->
+<g id="edge60" class="edge">
+<title>picosnitch__monitor_subprocess__monitor_subprocess__queue_sendv6_event&#45;&gt;picosnitch__monitor_subprocess__monitor_subprocess__get_fd</title>
+<path fill="none" stroke="#000000" d="M2643.91,-409.49C2665.11,-402.76 2691.07,-395.6 2715,-392 2737.42,-388.62 3102.1,-392.77 3123,-384 3134.89,-379.01 3145.49,-369.65 3153.76,-360.52"/>
+<polygon fill="#000000" stroke="#000000" points="3156.62,-362.56 3160.4,-352.66 3151.27,-358.04 3156.62,-362.56"/>
 </g>
-<!-- picosnitch__start_picosnitch&#45;&gt;picosnitch__Daemon__stop -->
-<g id="edge75" class="edge">
-<title>picosnitch__start_picosnitch&#45;&gt;picosnitch__Daemon__stop</title>
-<path fill="none" stroke="#000000" d="M2449.29,-712.32C2503.98,-709.76 2576.44,-703.6 2639,-689 2776.28,-656.96 2797.56,-606.39 2935,-575 2956.3,-570.13 3013.67,-577.19 3033,-567 3042.97,-561.74 3051.33,-552.72 3057.71,-543.91"/>
-<polygon fill="#000000" stroke="#000000" points="3060.8,-545.58 3063.43,-535.32 3054.97,-541.71 3060.8,-545.58"/>
+<!-- picosnitch__notifcation_manager__NotificationManager -->
+<g id="node44" class="node">
+<title>picosnitch__notifcation_manager__NotificationManager</title>
+<ellipse fill="#99ffa7" fill-opacity="0.698039" stroke="black" cx="3887" cy="-122" rx="106.68" ry="18"/>
+<text text-anchor="middle" x="3887" y="-118.3" font-family="Times,serif" font-size="14.00" fill="#000000">NotificationManager</text>
 </g>
-<!-- picosnitch__start_picosnitch&#45;&gt;picosnitch__ProcessManager__start -->
-<g id="edge76" class="edge">
-<title>picosnitch__start_picosnitch&#45;&gt;picosnitch__ProcessManager__start</title>
-<path fill="none" stroke="#000000" d="M2428.43,-702.7C2434.82,-699.24 2440.57,-694.77 2445,-689 2456.51,-674 2452,-537.9 2452,-519 2452,-519 2452,-519 2452,-359 2452,-310.26 2467.36,-285.57 2433,-251 2405.06,-222.89 2292.15,-212.01 2229.1,-208.06"/>
-<polygon fill="#000000" stroke="#000000" points="2229.25,-204.57 2219.06,-207.47 2228.84,-211.55 2229.25,-204.57"/>
+<!-- picosnitch__notifcation_manager__NotificationManager____new__ -->
+<g id="node45" class="node">
+<title>picosnitch__notifcation_manager__NotificationManager____new__</title>
+<ellipse fill="#65ff7b" fill-opacity="0.698039" stroke="black" cx="4276" cy="-122" rx="47.39" ry="18"/>
+<text text-anchor="middle" x="4276" y="-118.3" font-family="Times,serif" font-size="14.00" fill="#000000">__new__</text>
 </g>
-<!-- picosnitch__start_picosnitch__PicoDaemon -->
-<g id="node62" class="node">
-<title>picosnitch__start_picosnitch__PicoDaemon</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="2365" cy="-609" rx="68.49" ry="18"/>
-<text text-anchor="middle" x="2365" y="-605.3" font-family="Times,serif" font-size="14.00" fill="#000000">PicoDaemon</text>
+<!-- picosnitch__notifcation_manager__NotificationManager__enable_notifications -->
+<g id="node46" class="node">
+<title>picosnitch__notifcation_manager__NotificationManager__enable_notifications</title>
+<ellipse fill="#65ff7b" fill-opacity="0.698039" stroke="black" cx="4144" cy="-50" rx="103.18" ry="18"/>
+<text text-anchor="middle" x="4144" y="-46.3" font-family="Times,serif" font-size="14.00" fill="#000000">enable_notifications</text>
 </g>
-<!-- picosnitch__start_picosnitch&#45;&gt;picosnitch__start_picosnitch__PicoDaemon -->
-<g id="edge79" class="edge">
-<title>picosnitch__start_picosnitch&#45;&gt;picosnitch__start_picosnitch__PicoDaemon</title>
-<path fill="none" stroke="#000000" d="M2365,-696.83C2365,-680.64 2365,-656.13 2365,-637.27"/>
-<polygon fill="#000000" stroke="#000000" points="2368.5,-637.2 2365,-627.2 2361.5,-637.2 2368.5,-637.2"/>
+<!-- picosnitch__notifcation_manager__NotificationManager__toast -->
+<g id="node47" class="node">
+<title>picosnitch__notifcation_manager__NotificationManager__toast</title>
+<ellipse fill="#65ff7b" fill-opacity="0.698039" stroke="black" cx="4144" cy="-122" rx="34.39" ry="18"/>
+<text text-anchor="middle" x="4144" y="-118.3" font-family="Times,serif" font-size="14.00" fill="#000000">toast</text>
 </g>
-<!-- picosnitch__start_picosnitch__delpid -->
-<g id="node63" class="node">
-<title>picosnitch__start_picosnitch__delpid</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="2239" cy="-609" rx="39.79" ry="18"/>
-<text text-anchor="middle" x="2239" y="-605.3" font-family="Times,serif" font-size="14.00" fill="#000000">delpid</text>
+<!-- picosnitch__notifcation_manager__NotificationManager__toast&#45;&gt;picosnitch__notifcation_manager__NotificationManager__enable_notifications -->
+<g id="edge61" class="edge">
+<title>picosnitch__notifcation_manager__NotificationManager__toast&#45;&gt;picosnitch__notifcation_manager__NotificationManager__enable_notifications</title>
+<path fill="none" stroke="#000000" d="M4144,-103.7C4144,-95.98 4144,-86.71 4144,-78.11"/>
+<polygon fill="#000000" stroke="#000000" points="4147.5,-78.1 4144,-68.1 4140.5,-78.1 4147.5,-78.1"/>
 </g>
-<!-- picosnitch__start_picosnitch&#45;&gt;picosnitch__start_picosnitch__delpid -->
-<g id="edge80" class="edge">
-<title>picosnitch__start_picosnitch&#45;&gt;picosnitch__start_picosnitch__delpid</title>
-<path fill="none" stroke="#000000" d="M2309.58,-701.29C2301.88,-698.06 2294.42,-694.03 2288,-689 2270.59,-675.35 2257.77,-653.66 2249.62,-636.46"/>
-<polygon fill="#000000" stroke="#000000" points="2252.64,-634.65 2245.37,-626.95 2246.25,-637.51 2252.64,-634.65"/>
+<!-- picosnitch__primary_subprocess__primary_subprocess&#45;&gt;picosnitch__notifcation_manager__NotificationManager__enable_notifications -->
+<g id="edge62" class="edge">
+<title>picosnitch__primary_subprocess__primary_subprocess&#45;&gt;picosnitch__notifcation_manager__NotificationManager__enable_notifications</title>
+<path fill="none" stroke="#000000" d="M4473.59,-421.6C4586.05,-416.77 4754.18,-405.95 4774,-384 4798.73,-356.62 4794.09,-331.94 4774,-301 4659.62,-124.8 4398.4,-72.77 4250.76,-57.42"/>
+<polygon fill="#000000" stroke="#000000" points="4251.06,-53.93 4240.76,-56.42 4250.36,-60.9 4251.06,-53.93"/>
 </g>
-<!-- picosnitch__ui_geoip -->
-<g id="node27" class="node">
-<title>picosnitch__ui_geoip</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="1370" cy="-443" rx="49.29" ry="18"/>
-<text text-anchor="middle" x="1370" y="-439.3" font-family="Times,serif" font-size="14.00" fill="#000000">ui_geoip</text>
+<!-- picosnitch__primary_subprocess__primary_subprocess&#45;&gt;picosnitch__notifcation_manager__NotificationManager__toast -->
+<g id="edge63" class="edge">
+<title>picosnitch__primary_subprocess__primary_subprocess&#45;&gt;picosnitch__notifcation_manager__NotificationManager__toast</title>
+<path fill="none" stroke="#000000" d="M4272.82,-420.07C4174.95,-414.16 4037.6,-402.65 4021,-384 3961.65,-317.31 4057.16,-276.73 4106,-202 4116.96,-185.23 4126.7,-164.81 4133.58,-148.93"/>
+<polygon fill="#000000" stroke="#000000" points="4136.8,-150.28 4137.47,-139.71 4130.36,-147.56 4136.8,-150.28"/>
 </g>
-<!-- picosnitch__ui_dash&#45;&gt;picosnitch__ui_geoip -->
-<g id="edge86" class="edge">
-<title>picosnitch__ui_dash&#45;&gt;picosnitch__ui_geoip</title>
-<path fill="none" stroke="#000000" d="M1370,-590.76C1370,-562.26 1370,-505.12 1370,-471.16"/>
-<polygon fill="#000000" stroke="#000000" points="1373.5,-471.01 1370,-461.01 1366.5,-471.01 1373.5,-471.01"/>
+<!-- picosnitch__primary_subprocess__primary_subprocess_helper -->
+<g id="node49" class="node">
+<title>picosnitch__primary_subprocess__primary_subprocess_helper</title>
+<ellipse fill="#99ffd3" fill-opacity="0.698039" stroke="black" cx="4627" cy="-335" rx="138.38" ry="18"/>
+<text text-anchor="middle" x="4627" y="-331.3" font-family="Times,serif" font-size="14.00" fill="#000000">primary_subprocess_helper</text>
 </g>
-<!-- picosnitch__ui_dash__serve_layout -->
-<g id="node70" class="node">
-<title>picosnitch__ui_dash__serve_layout</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="941" cy="-518" rx="69.59" ry="18"/>
-<text text-anchor="middle" x="941" y="-514.3" font-family="Times,serif" font-size="14.00" fill="#000000">serve_layout</text>
+<!-- picosnitch__primary_subprocess__primary_subprocess&#45;&gt;picosnitch__primary_subprocess__primary_subprocess_helper -->
+<g id="edge66" class="edge">
+<title>picosnitch__primary_subprocess__primary_subprocess&#45;&gt;picosnitch__primary_subprocess__primary_subprocess_helper</title>
+<path fill="none" stroke="#000000" d="M4416.13,-409.6C4459.11,-394.6 4524.61,-371.74 4571.19,-355.48"/>
+<polygon fill="#000000" stroke="#000000" points="4572.54,-358.71 4580.83,-352.11 4570.24,-352.1 4572.54,-358.71"/>
 </g>
-<!-- picosnitch__ui_dash&#45;&gt;picosnitch__ui_dash__serve_layout -->
-<g id="edge85" class="edge">
-<title>picosnitch__ui_dash&#45;&gt;picosnitch__ui_dash__serve_layout</title>
-<path fill="none" stroke="#000000" d="M1323.72,-608.88C1255.2,-608.79 1123.62,-603.3 1019,-567 1001.71,-561 984.2,-550.69 970.16,-541.16"/>
-<polygon fill="#000000" stroke="#000000" points="972.1,-538.25 961.9,-535.37 968.08,-543.98 972.1,-538.25"/>
+<!-- picosnitch__primary_subprocess__primary_subprocess__snitch_pipe_thread -->
+<g id="node50" class="node">
+<title>picosnitch__primary_subprocess__primary_subprocess__snitch_pipe_thread</title>
+<ellipse fill="#65ffbd" fill-opacity="0.698039" stroke="black" cx="4372" cy="-335" rx="98.58" ry="18"/>
+<text text-anchor="middle" x="4372" y="-331.3" font-family="Times,serif" font-size="14.00" fill="#000000">snitch_pipe_thread</text>
 </g>
-<!-- picosnitch__ui_loop -->
-<g id="node29" class="node">
-<title>picosnitch__ui_loop</title>
-<ellipse fill="#fecccc" fill-opacity="0.698039" stroke="black" cx="1568" cy="-518" rx="43.59" ry="18"/>
-<text text-anchor="middle" x="1568" y="-514.3" font-family="Times,serif" font-size="14.00" fill="#000000">ui_loop</text>
+<!-- picosnitch__primary_subprocess__primary_subprocess&#45;&gt;picosnitch__primary_subprocess__primary_subprocess__snitch_pipe_thread -->
+<g id="edge64" class="edge">
+<title>picosnitch__primary_subprocess__primary_subprocess&#45;&gt;picosnitch__primary_subprocess__primary_subprocess__snitch_pipe_thread</title>
+<path fill="none" stroke="#000000" d="M4372,-407.84C4372,-395.28 4372,-377.98 4372,-363.5"/>
+<polygon fill="#000000" stroke="#000000" points="4375.5,-363.11 4372,-353.11 4368.5,-363.11 4375.5,-363.11"/>
 </g>
-<!-- picosnitch__ui_init&#45;&gt;picosnitch__ui_loop -->
-<g id="edge92" class="edge">
-<title>picosnitch__ui_init&#45;&gt;picosnitch__ui_loop</title>
-<path fill="none" stroke="#000000" d="M1630.41,-592.09C1618.78,-578.46 1601.85,-558.64 1588.56,-543.07"/>
-<polygon fill="#000000" stroke="#000000" points="1591.14,-540.71 1581.98,-535.38 1585.82,-545.25 1591.14,-540.71"/>
+<!-- picosnitch__primary_subprocess__primary_subprocess__write_snitch_and_exit -->
+<g id="node51" class="node">
+<title>picosnitch__primary_subprocess__primary_subprocess__write_snitch_and_exit</title>
+<ellipse fill="#65ffbd" fill-opacity="0.698039" stroke="black" cx="4144" cy="-335" rx="111.28" ry="18"/>
+<text text-anchor="middle" x="4144" y="-331.3" font-family="Times,serif" font-size="14.00" fill="#000000">write_snitch_and_exit</text>
 </g>
-<!-- picosnitch__ui_loop&#45;&gt;picosnitch__ui_geoip -->
-<g id="edge93" class="edge">
-<title>picosnitch__ui_loop&#45;&gt;picosnitch__ui_geoip</title>
-<path fill="none" stroke="#000000" d="M1524.87,-515.51C1495.49,-513.08 1456.39,-506.98 1425,-492 1412.67,-486.11 1400.97,-476.67 1391.56,-467.71"/>
-<polygon fill="#000000" stroke="#000000" points="1393.77,-464.98 1384.22,-460.39 1388.83,-469.93 1393.77,-464.98"/>
+<!-- picosnitch__primary_subprocess__primary_subprocess&#45;&gt;picosnitch__primary_subprocess__primary_subprocess__write_snitch_and_exit -->
+<g id="edge65" class="edge">
+<title>picosnitch__primary_subprocess__primary_subprocess&#45;&gt;picosnitch__primary_subprocess__primary_subprocess__write_snitch_and_exit</title>
+<path fill="none" stroke="#000000" d="M4330.39,-409.4C4310.3,-401.82 4285.86,-392.52 4264,-384 4240.51,-374.84 4214.52,-364.48 4192.75,-355.73"/>
+<polygon fill="#000000" stroke="#000000" points="4193.97,-352.44 4183.38,-351.96 4191.35,-358.94 4193.97,-352.44"/>
 </g>
-<!-- picosnitch__ui_loop__fetch_query_results -->
-<g id="node76" class="node">
-<title>picosnitch__ui_loop__fetch_query_results</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="1669" cy="-443" rx="102.08" ry="18"/>
-<text text-anchor="middle" x="1669" y="-439.3" font-family="Times,serif" font-size="14.00" fill="#000000">fetch_query_results</text>
+<!-- picosnitch__utils__write_snitch -->
+<g id="node88" class="node">
+<title>picosnitch__utils__write_snitch</title>
+<ellipse fill="#e199ff" fill-opacity="0.698039" stroke="black" cx="2070" cy="-244" rx="67.69" ry="18"/>
+<text text-anchor="middle" x="2070" y="-240.3" font-family="Times,serif" font-size="14.00" fill="#000000">write_snitch</text>
 </g>
-<!-- picosnitch__ui_loop&#45;&gt;picosnitch__ui_loop__fetch_query_results -->
-<g id="edge94" class="edge">
-<title>picosnitch__ui_loop&#45;&gt;picosnitch__ui_loop__fetch_query_results</title>
-<path fill="none" stroke="#000000" d="M1588.93,-501.87C1602.97,-491.73 1621.72,-478.17 1637.54,-466.74"/>
-<polygon fill="#000000" stroke="#000000" points="1639.93,-469.33 1645.99,-460.63 1635.83,-463.65 1639.93,-469.33"/>
+<!-- picosnitch__primary_subprocess__primary_subprocess&#45;&gt;picosnitch__utils__write_snitch -->
+<g id="edge67" class="edge">
+<title>picosnitch__primary_subprocess__primary_subprocess&#45;&gt;picosnitch__utils__write_snitch</title>
+<path fill="none" stroke="#000000" d="M4269.1,-422.56C4177.57,-418.75 4051.78,-408.99 4009,-384 3969.7,-361.04 3989.22,-322.31 3949,-301 3868.31,-258.24 2491.91,-247.44 2147.59,-245.4"/>
+<polygon fill="#000000" stroke="#000000" points="2147.49,-241.9 2137.47,-245.35 2147.45,-248.9 2147.49,-241.9"/>
 </g>
-<!-- picosnitch__ui_loop__get_geoip -->
-<g id="node77" class="node">
-<title>picosnitch__ui_loop__get_geoip</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="1493" cy="-443" rx="55.79" ry="18"/>
-<text text-anchor="middle" x="1493" y="-439.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_geoip</text>
+<!-- picosnitch__primary_subprocess__primary_subprocess_helper&#45;&gt;picosnitch__notifcation_manager__NotificationManager__toast -->
+<g id="edge70" class="edge">
+<title>picosnitch__primary_subprocess__primary_subprocess_helper&#45;&gt;picosnitch__notifcation_manager__NotificationManager__toast</title>
+<path fill="none" stroke="#000000" d="M4567.85,-318.64C4469.92,-292.58 4279.03,-238.94 4220,-202 4196.99,-187.6 4176.02,-164.71 4161.97,-147.28"/>
+<polygon fill="#000000" stroke="#000000" points="4164.57,-144.92 4155.65,-139.21 4159.06,-149.24 4164.57,-144.92"/>
 </g>
-<!-- picosnitch__ui_loop&#45;&gt;picosnitch__ui_loop__get_geoip -->
-<g id="edge95" class="edge">
-<title>picosnitch__ui_loop&#45;&gt;picosnitch__ui_loop__get_geoip</title>
-<path fill="none" stroke="#000000" d="M1551.73,-501.16C1541.64,-491.35 1528.51,-478.56 1517.22,-467.58"/>
-<polygon fill="#000000" stroke="#000000" points="1519.37,-464.78 1509.76,-460.31 1514.49,-469.8 1519.37,-464.78"/>
+<!-- picosnitch__primary_subprocess__primary_subprocess__write_snitch_and_exit&#45;&gt;picosnitch__notifcation_manager__NotificationManager__toast -->
+<g id="edge68" class="edge">
+<title>picosnitch__primary_subprocess__primary_subprocess__write_snitch_and_exit&#45;&gt;picosnitch__notifcation_manager__NotificationManager__toast</title>
+<path fill="none" stroke="#000000" d="M4144,-316.73C4144,-280.09 4144,-194.3 4144,-150.21"/>
+<polygon fill="#000000" stroke="#000000" points="4147.5,-150.21 4144,-140.21 4140.5,-150.21 4147.5,-150.21"/>
 </g>
-<!-- picosnitch__virustotal_subprocess&#45;&gt;picosnitch__get_fstat -->
-<g id="edge96" class="edge">
-<title>picosnitch__virustotal_subprocess&#45;&gt;picosnitch__get_fstat</title>
-<path fill="none" stroke="#000000" d="M1435.49,-348.83C1408.34,-343.77 1383.38,-336.43 1375,-326 1354.13,-300.01 1365.61,-282.98 1375,-251 1379.17,-236.81 1387.38,-236.68 1393,-223 1413.19,-173.87 1411.3,-156.61 1404,-104 1402.79,-95.25 1400.49,-85.9 1398.06,-77.54"/>
-<polygon fill="#000000" stroke="#000000" points="1401.38,-76.45 1395.08,-67.93 1394.7,-78.52 1401.38,-76.45"/>
+<!-- picosnitch__primary_subprocess__primary_subprocess__write_snitch_and_exit&#45;&gt;picosnitch__utils__write_snitch -->
+<g id="edge69" class="edge">
+<title>picosnitch__primary_subprocess__primary_subprocess__write_snitch_and_exit&#45;&gt;picosnitch__utils__write_snitch</title>
+<path fill="none" stroke="#000000" d="M4090.39,-319.18C4063.23,-312.34 4029.61,-304.89 3999,-301 3631.86,-254.34 2461.74,-246.51 2148.02,-245.24"/>
+<polygon fill="#000000" stroke="#000000" points="2147.68,-241.74 2137.67,-245.2 2147.65,-248.74 2147.68,-241.74"/>
 </g>
-<!-- picosnitch__virustotal_subprocess__get_analysis -->
-<g id="node78" class="node">
-<title>picosnitch__virustotal_subprocess__get_analysis</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="1524" cy="-277" rx="67.69" ry="18"/>
-<text text-anchor="middle" x="1524" y="-273.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_analysis</text>
+<!-- picosnitch__process_manager__ProcessManager____init__&#45;&gt;picosnitch__process_manager__ProcessManager__start -->
+<g id="edge71" class="edge">
+<title>picosnitch__process_manager__ProcessManager____init__&#45;&gt;picosnitch__process_manager__ProcessManager__start</title>
+<path fill="none" stroke="#000000" d="M1057,-498.84C1057,-486.28 1057,-468.98 1057,-454.5"/>
+<polygon fill="#000000" stroke="#000000" points="1060.5,-454.11 1057,-444.11 1053.5,-454.11 1060.5,-454.11"/>
 </g>
-<!-- picosnitch__virustotal_subprocess&#45;&gt;picosnitch__virustotal_subprocess__get_analysis -->
-<g id="edge97" class="edge">
-<title>picosnitch__virustotal_subprocess&#45;&gt;picosnitch__virustotal_subprocess__get_analysis</title>
-<path fill="none" stroke="#000000" d="M1524,-341.82C1524,-331.19 1524,-317.31 1524,-305.2"/>
-<polygon fill="#000000" stroke="#000000" points="1527.5,-305.15 1524,-295.15 1520.5,-305.15 1527.5,-305.15"/>
+<!-- picosnitch__secondary_subprocess__secondary_subprocess_helper -->
+<g id="node61" class="node">
+<title>picosnitch__secondary_subprocess__secondary_subprocess_helper</title>
+<ellipse fill="#99a7ff" fill-opacity="0.698039" stroke="black" cx="1698" cy="-517" rx="148.67" ry="18"/>
+<text text-anchor="middle" x="1698" y="-513.3" font-family="Times,serif" font-size="14.00" fill="#000000">secondary_subprocess_helper</text>
 </g>
-<!-- picosnitch__write_snitch&#45;&gt;picosnitch__NotificationManager__toast -->
-<g id="edge98" class="edge">
-<title>picosnitch__write_snitch&#45;&gt;picosnitch__NotificationManager__toast</title>
-<path fill="none" stroke="#000000" d="M129.61,-187.61C142.76,-175.36 160.88,-158.49 175.31,-145.06"/>
-<polygon fill="#000000" stroke="#000000" points="177.95,-147.38 182.89,-138 173.18,-142.25 177.95,-147.38"/>
+<!-- picosnitch__secondary_subprocess__secondary_subprocess&#45;&gt;picosnitch__secondary_subprocess__secondary_subprocess_helper -->
+<g id="edge72" class="edge">
+<title>picosnitch__secondary_subprocess__secondary_subprocess&#45;&gt;picosnitch__secondary_subprocess__secondary_subprocess_helper</title>
+<path fill="none" stroke="#000000" d="M1698,-620.81C1698,-601.11 1698,-568.58 1698,-545.39"/>
+<polygon fill="#000000" stroke="#000000" points="1701.5,-545.16 1698,-535.16 1694.5,-545.16 1701.5,-545.16"/>
 </g>
-<!-- picosnitch__Daemon____init__ -->
-<g id="node32" class="node">
-<title>picosnitch__Daemon____init__</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="3092" cy="-609" rx="44.39" ry="18"/>
-<text text-anchor="middle" x="3092" y="-605.3" font-family="Times,serif" font-size="14.00" fill="#000000">__init__</text>
+<!-- picosnitch__utils__get_fanotify_events -->
+<g id="node80" class="node">
+<title>picosnitch__utils__get_fanotify_events</title>
+<ellipse fill="#e199ff" fill-opacity="0.698039" stroke="black" cx="1364" cy="-335" rx="100.98" ry="18"/>
+<text text-anchor="middle" x="1364" y="-331.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_fanotify_events</text>
 </g>
-<!-- picosnitch__Daemon__daemonize -->
-<g id="node33" class="node">
-<title>picosnitch__Daemon__daemonize</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="3174" cy="-443" rx="60.39" ry="18"/>
-<text text-anchor="middle" x="3174" y="-439.3" font-family="Times,serif" font-size="14.00" fill="#000000">daemonize</text>
+<!-- picosnitch__secondary_subprocess__secondary_subprocess&#45;&gt;picosnitch__utils__get_fanotify_events -->
+<g id="edge73" class="edge">
+<title>picosnitch__secondary_subprocess__secondary_subprocess&#45;&gt;picosnitch__utils__get_fanotify_events</title>
+<path fill="none" stroke="#000000" d="M1795.95,-629.62C1818.13,-623.44 1839.87,-613.33 1856,-597 1888.35,-564.24 1918.24,-424.87 1886,-392 1877.98,-383.83 1485.18,-386.45 1474,-384 1448.94,-378.52 1422.53,-367.2 1401.88,-356.93"/>
+<polygon fill="#000000" stroke="#000000" points="1403.32,-353.74 1392.82,-352.32 1400.14,-359.98 1403.32,-353.74"/>
 </g>
-<!-- picosnitch__Daemon__delpid -->
-<g id="node34" class="node">
-<title>picosnitch__Daemon__delpid</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="3174" cy="-360" rx="39.79" ry="18"/>
-<text text-anchor="middle" x="3174" y="-356.3" font-family="Times,serif" font-size="14.00" fill="#000000">delpid</text>
+<!-- picosnitch__utils__get_vt_results -->
+<g id="node85" class="node">
+<title>picosnitch__utils__get_vt_results</title>
+<ellipse fill="#e199ff" fill-opacity="0.698039" stroke="black" cx="1916" cy="-335" rx="76.09" ry="18"/>
+<text text-anchor="middle" x="1916" y="-331.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_vt_results</text>
 </g>
-<!-- picosnitch__Daemon__daemonize&#45;&gt;picosnitch__Daemon__delpid -->
-<g id="edge2" class="edge">
-<title>picosnitch__Daemon__daemonize&#45;&gt;picosnitch__Daemon__delpid</title>
-<path fill="none" stroke="#000000" d="M3174,-424.82C3174,-414.19 3174,-400.31 3174,-388.2"/>
-<polygon fill="#000000" stroke="#000000" points="3177.5,-388.15 3174,-378.15 3170.5,-388.15 3177.5,-388.15"/>
+<!-- picosnitch__secondary_subprocess__secondary_subprocess&#45;&gt;picosnitch__utils__get_vt_results -->
+<g id="edge74" class="edge">
+<title>picosnitch__secondary_subprocess__secondary_subprocess&#45;&gt;picosnitch__utils__get_vt_results</title>
+<path fill="none" stroke="#000000" d="M1779.63,-626.32C1832.39,-617.96 1892.73,-606.54 1901,-597 1958.59,-530.6 1937.63,-415.3 1924.01,-363.08"/>
+<polygon fill="#000000" stroke="#000000" points="1927.33,-361.95 1921.33,-353.22 1920.58,-363.79 1927.33,-361.95"/>
 </g>
-<!-- picosnitch__Daemon__getpid -->
-<g id="node35" class="node">
-<title>picosnitch__Daemon__getpid</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="2984" cy="-443" rx="40.09" ry="18"/>
-<text text-anchor="middle" x="2984" y="-439.3" font-family="Times,serif" font-size="14.00" fill="#000000">getpid</text>
+<!-- picosnitch__secondary_subprocess__secondary_subprocess_sha_wrapper -->
+<g id="node62" class="node">
+<title>picosnitch__secondary_subprocess__secondary_subprocess_sha_wrapper</title>
+<ellipse fill="#99a7ff" fill-opacity="0.698039" stroke="black" cx="1698" cy="-426" rx="178.97" ry="18"/>
+<text text-anchor="middle" x="1698" y="-422.3" font-family="Times,serif" font-size="14.00" fill="#000000">secondary_subprocess_sha_wrapper</text>
 </g>
-<!-- picosnitch__Daemon__restart&#45;&gt;picosnitch__Daemon__start -->
-<g id="edge3" class="edge">
-<title>picosnitch__Daemon__restart&#45;&gt;picosnitch__Daemon__start</title>
-<path fill="none" stroke="#000000" d="M3006.14,-592.87C3015.52,-586.27 3027.3,-579.1 3039,-575 3069.8,-564.2 3083.06,-582.09 3112,-567 3122.27,-561.65 3131.16,-552.66 3138.08,-543.9"/>
-<polygon fill="#000000" stroke="#000000" points="3141,-545.83 3144.09,-535.69 3135.36,-541.69 3141,-545.83"/>
+<!-- picosnitch__secondary_subprocess__secondary_subprocess_helper&#45;&gt;picosnitch__secondary_subprocess__secondary_subprocess_sha_wrapper -->
+<g id="edge75" class="edge">
+<title>picosnitch__secondary_subprocess__secondary_subprocess_helper&#45;&gt;picosnitch__secondary_subprocess__secondary_subprocess_sha_wrapper</title>
+<path fill="none" stroke="#000000" d="M1698,-498.84C1698,-486.28 1698,-468.98 1698,-454.5"/>
+<polygon fill="#000000" stroke="#000000" points="1701.5,-454.11 1698,-444.11 1694.5,-454.11 1701.5,-454.11"/>
 </g>
-<!-- picosnitch__Daemon__restart&#45;&gt;picosnitch__Daemon__stop -->
-<g id="edge4" class="edge">
-<title>picosnitch__Daemon__restart&#45;&gt;picosnitch__Daemon__stop</title>
-<path fill="none" stroke="#000000" d="M3005.53,-592.68C3014.18,-585.23 3024.43,-575.97 3033,-567 3040.27,-559.39 3047.68,-550.58 3054.07,-542.6"/>
-<polygon fill="#000000" stroke="#000000" points="3056.88,-544.69 3060.3,-534.66 3051.37,-540.36 3056.88,-544.69"/>
+<!-- picosnitch__utils__reverse_dns_lookup -->
+<g id="node87" class="node">
+<title>picosnitch__utils__reverse_dns_lookup</title>
+<ellipse fill="#e199ff" fill-opacity="0.698039" stroke="black" cx="950" cy="-335" rx="102.08" ry="18"/>
+<text text-anchor="middle" x="950" y="-331.3" font-family="Times,serif" font-size="14.00" fill="#000000">reverse_dns_lookup</text>
 </g>
-<!-- picosnitch__Daemon__run -->
-<g id="node37" class="node">
-<title>picosnitch__Daemon__run</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="3069" cy="-443" rx="27" ry="18"/>
-<text text-anchor="middle" x="3069" y="-439.3" font-family="Times,serif" font-size="14.00" fill="#000000">run</text>
+<!-- picosnitch__secondary_subprocess__secondary_subprocess_helper&#45;&gt;picosnitch__utils__reverse_dns_lookup -->
+<g id="edge76" class="edge">
+<title>picosnitch__secondary_subprocess__secondary_subprocess_helper&#45;&gt;picosnitch__utils__reverse_dns_lookup</title>
+<path fill="none" stroke="#000000" d="M1598.48,-503.56C1560.76,-496.97 1523.61,-487.59 1510,-475 1481.72,-448.84 1515.7,-415.27 1485,-392 1466.22,-377.77 1084.02,-388.99 1061,-384 1035.73,-378.52 1009.09,-367.21 988.24,-356.94"/>
+<polygon fill="#000000" stroke="#000000" points="989.6,-353.7 979.1,-352.32 986.45,-359.95 989.6,-353.7"/>
 </g>
-<!-- picosnitch__Daemon__start&#45;&gt;picosnitch__Daemon__daemonize -->
-<g id="edge5" class="edge">
-<title>picosnitch__Daemon__start&#45;&gt;picosnitch__Daemon__daemonize</title>
-<path fill="none" stroke="#000000" d="M3158.64,-500.07C3161.02,-491.38 3163.98,-480.59 3166.66,-470.8"/>
-<polygon fill="#000000" stroke="#000000" points="3170.05,-471.66 3169.32,-461.09 3163.3,-469.81 3170.05,-471.66"/>
+<!-- picosnitch__utils__get_sha256_fd -->
+<g id="node82" class="node">
+<title>picosnitch__utils__get_sha256_fd</title>
+<ellipse fill="#e199ff" fill-opacity="0.698039" stroke="black" cx="1560" cy="-335" rx="77.19" ry="18"/>
+<text text-anchor="middle" x="1560" y="-331.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_sha256_fd</text>
 </g>
-<!-- picosnitch__Daemon__start&#45;&gt;picosnitch__Daemon__getpid -->
-<g id="edge6" class="edge">
-<title>picosnitch__Daemon__start&#45;&gt;picosnitch__Daemon__getpid</title>
-<path fill="none" stroke="#000000" d="M3129.51,-505.74C3123.86,-503.52 3117.8,-501.44 3112,-500 3077.74,-491.52 3064.96,-506.97 3033,-492 3021.32,-486.53 3010.76,-477.1 3002.45,-468.04"/>
-<polygon fill="#000000" stroke="#000000" points="3004.94,-465.57 2995.76,-460.28 2999.64,-470.14 3004.94,-465.57"/>
+<!-- picosnitch__secondary_subprocess__secondary_subprocess_sha_wrapper&#45;&gt;picosnitch__utils__get_sha256_fd -->
+<g id="edge77" class="edge">
+<title>picosnitch__secondary_subprocess__secondary_subprocess_sha_wrapper&#45;&gt;picosnitch__utils__get_sha256_fd</title>
+<path fill="none" stroke="#000000" d="M1671.72,-408.05C1649.57,-393.77 1617.74,-373.24 1593.72,-357.75"/>
+<polygon fill="#000000" stroke="#000000" points="1595.55,-354.76 1585.25,-352.29 1591.76,-360.65 1595.55,-354.76"/>
 </g>
-<!-- picosnitch__Daemon__start&#45;&gt;picosnitch__Daemon__run -->
-<g id="edge7" class="edge">
-<title>picosnitch__Daemon__start&#45;&gt;picosnitch__Daemon__run</title>
-<path fill="none" stroke="#000000" d="M3128.22,-506.58C3120.3,-502.69 3111.87,-497.78 3105,-492 3097.16,-485.4 3090.02,-476.78 3084.21,-468.67"/>
-<polygon fill="#000000" stroke="#000000" points="3086.97,-466.5 3078.46,-460.19 3081.18,-470.43 3086.97,-466.5"/>
+<!-- picosnitch__utils__get_sha256_fuse -->
+<g id="node83" class="node">
+<title>picosnitch__utils__get_sha256_fuse</title>
+<ellipse fill="#e199ff" fill-opacity="0.698039" stroke="black" cx="1158" cy="-335" rx="87.99" ry="18"/>
+<text text-anchor="middle" x="1158" y="-331.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_sha256_fuse</text>
 </g>
-<!-- picosnitch__Daemon__status&#45;&gt;picosnitch__Daemon__getpid -->
-<g id="edge8" class="edge">
-<title>picosnitch__Daemon__status&#45;&gt;picosnitch__Daemon__getpid</title>
-<path fill="none" stroke="#000000" d="M2984,-499.7C2984,-491.25 2984,-480.87 2984,-471.37"/>
-<polygon fill="#000000" stroke="#000000" points="2987.5,-471.18 2984,-461.18 2980.5,-471.18 2987.5,-471.18"/>
+<!-- picosnitch__secondary_subprocess__secondary_subprocess_sha_wrapper&#45;&gt;picosnitch__utils__get_sha256_fuse -->
+<g id="edge78" class="edge">
+<title>picosnitch__secondary_subprocess__secondary_subprocess_sha_wrapper&#45;&gt;picosnitch__utils__get_sha256_fuse</title>
+<path fill="none" stroke="#000000" d="M1622.71,-409.65C1587.16,-403.05 1544.06,-395.94 1505,-392 1449.48,-386.4 1308.1,-397.69 1254,-384 1232.31,-378.51 1209.85,-367.61 1192.11,-357.59"/>
+<polygon fill="#000000" stroke="#000000" points="1193.7,-354.46 1183.29,-352.46 1190.17,-360.51 1193.7,-354.46"/>
 </g>
-<!-- picosnitch__Daemon__stop&#45;&gt;picosnitch__Daemon__getpid -->
-<g id="edge9" class="edge">
-<title>picosnitch__Daemon__stop&#45;&gt;picosnitch__Daemon__getpid</title>
-<path fill="none" stroke="#000000" d="M3051.21,-504.79C3045.16,-500.94 3038.66,-496.51 3033,-492 3023.59,-484.5 3013.97,-475.44 3005.77,-467.23"/>
-<polygon fill="#000000" stroke="#000000" points="3008.19,-464.69 2998.7,-459.98 3003.18,-469.58 3008.19,-464.69"/>
+<!-- picosnitch__utils__get_sha256_pid -->
+<g id="node84" class="node">
+<title>picosnitch__utils__get_sha256_pid</title>
+<ellipse fill="#e199ff" fill-opacity="0.698039" stroke="black" cx="1739" cy="-335" rx="83.39" ry="18"/>
+<text text-anchor="middle" x="1739" y="-331.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_sha256_pid</text>
 </g>
-<!-- picosnitch__NotificationManager____new__ -->
-<g id="node41" class="node">
-<title>picosnitch__NotificationManager____new__</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="311" cy="-122" rx="47.39" ry="18"/>
-<text text-anchor="middle" x="311" y="-118.3" font-family="Times,serif" font-size="14.00" fill="#000000">__new__</text>
+<!-- picosnitch__secondary_subprocess__secondary_subprocess_sha_wrapper&#45;&gt;picosnitch__utils__get_sha256_pid -->
+<g id="edge79" class="edge">
+<title>picosnitch__secondary_subprocess__secondary_subprocess_sha_wrapper&#45;&gt;picosnitch__utils__get_sha256_pid</title>
+<path fill="none" stroke="#000000" d="M1705.91,-407.84C1711.86,-394.91 1720.13,-376.96 1726.92,-362.23"/>
+<polygon fill="#000000" stroke="#000000" points="1730.11,-363.65 1731.12,-353.11 1723.76,-360.73 1730.11,-363.65"/>
 </g>
-<!-- picosnitch__NotificationManager__toast&#45;&gt;picosnitch__NotificationManager__enable_notifications -->
-<g id="edge10" class="edge">
-<title>picosnitch__NotificationManager__toast&#45;&gt;picosnitch__NotificationManager__enable_notifications</title>
-<path fill="none" stroke="#000000" d="M211.93,-105.12C218.91,-96.54 227.69,-85.77 235.57,-76.09"/>
-<polygon fill="#000000" stroke="#000000" points="238.32,-78.26 241.92,-68.29 232.89,-73.84 238.32,-78.26"/>
+<!-- picosnitch__user_interface__ui_geoip -->
+<g id="node64" class="node">
+<title>picosnitch__user_interface__ui_geoip</title>
+<ellipse fill="#b699ff" fill-opacity="0.698039" stroke="black" cx="3016" cy="-730" rx="49.29" ry="18"/>
+<text text-anchor="middle" x="3016" y="-726.3" font-family="Times,serif" font-size="14.00" fill="#000000">ui_geoip</text>
 </g>
-<!-- picosnitch__ProcessManager____init__&#45;&gt;picosnitch__ProcessManager__start -->
-<g id="edge11" class="edge">
-<title>picosnitch__ProcessManager____init__&#45;&gt;picosnitch__ProcessManager__start</title>
-<path fill="none" stroke="#000000" d="M2070.23,-262.67C2093.8,-251.13 2127.95,-234.42 2153.05,-222.13"/>
-<polygon fill="#000000" stroke="#000000" points="2154.75,-225.2 2162.19,-217.65 2151.67,-218.91 2154.75,-225.2"/>
+<!-- picosnitch__user_interface__ui_dash&#45;&gt;picosnitch__user_interface__ui_geoip -->
+<g id="edge81" class="edge">
+<title>picosnitch__user_interface__ui_dash&#45;&gt;picosnitch__user_interface__ui_geoip</title>
+<path fill="none" stroke="#000000" d="M3016,-916.69C3016,-881.41 3016,-800.93 3016,-758.44"/>
+<polygon fill="#000000" stroke="#000000" points="3019.5,-758.26 3016,-748.26 3012.5,-758.26 3019.5,-758.26"/>
 </g>
-<!-- picosnitch__main_process__clean_exit&#45;&gt;picosnitch__ProcessManager -->
-<g id="edge31" class="edge">
-<title>picosnitch__main_process__clean_exit&#45;&gt;picosnitch__ProcessManager</title>
-<path fill="none" stroke="#000000" d="M2192.31,-344.71C2204.38,-338.97 2218.38,-332.24 2231,-326 2248.88,-317.16 2268.55,-307.16 2285.25,-298.59"/>
-<polygon fill="#000000" stroke="#000000" points="2286.9,-301.67 2294.2,-293.98 2283.7,-295.45 2286.9,-301.67"/>
+<!-- picosnitch__user_interface__ui_dash__serve_layout -->
+<g id="node72" class="node">
+<title>picosnitch__user_interface__ui_dash__serve_layout</title>
+<ellipse fill="#9165ff" fill-opacity="0.698039" stroke="black" cx="3969" cy="-813" rx="69.59" ry="18"/>
+<text text-anchor="middle" x="3969" y="-809.3" font-family="Times,serif" font-size="14.00" fill="#000000">serve_layout</text>
 </g>
-<!-- picosnitch__main_process__clean_exit&#45;&gt;picosnitch__ProcessManager__terminate -->
-<g id="edge32" class="edge">
-<title>picosnitch__main_process__clean_exit&#45;&gt;picosnitch__ProcessManager__terminate</title>
-<path fill="none" stroke="#000000" d="M2162,-341.82C2162,-331.19 2162,-317.31 2162,-305.2"/>
-<polygon fill="#000000" stroke="#000000" points="2165.5,-305.15 2162,-295.15 2158.5,-305.15 2165.5,-305.15"/>
+<!-- picosnitch__user_interface__ui_dash&#45;&gt;picosnitch__user_interface__ui_dash__serve_layout -->
+<g id="edge80" class="edge">
+<title>picosnitch__user_interface__ui_dash&#45;&gt;picosnitch__user_interface__ui_dash__serve_layout</title>
+<path fill="none" stroke="#000000" d="M3062.17,-933.78C3231.73,-932.69 3814.15,-926.52 3890,-893 3915.85,-881.58 3937.86,-857.57 3952.03,-839"/>
+<polygon fill="#000000" stroke="#000000" points="3954.87,-841.05 3957.98,-830.92 3949.23,-836.9 3954.87,-841.05"/>
 </g>
-<!-- picosnitch__monitor_subprocess__get_fd&#45;&gt;picosnitch__get_fstat -->
-<g id="edge43" class="edge">
-<title>picosnitch__monitor_subprocess__get_fd&#45;&gt;picosnitch__get_fstat</title>
-<path fill="none" stroke="#000000" d="M3281.35,-190.04C3273.31,-185.75 3264.02,-181.5 3255,-179 2903.76,-81.74 1733.76,-56.63 1450.94,-51.92"/>
-<polygon fill="#000000" stroke="#000000" points="1450.92,-48.42 1440.86,-51.76 1450.8,-55.42 1450.92,-48.42"/>
+<!-- picosnitch__user_interface__ui_loop -->
+<g id="node66" class="node">
+<title>picosnitch__user_interface__ui_loop</title>
+<ellipse fill="#b699ff" fill-opacity="0.698039" stroke="black" cx="2847" cy="-813" rx="43.59" ry="18"/>
+<text text-anchor="middle" x="2847" y="-809.3" font-family="Times,serif" font-size="14.00" fill="#000000">ui_loop</text>
 </g>
-<!-- picosnitch__monitor_subprocess__queue_exec_event&#45;&gt;picosnitch__monitor_subprocess__get_cmdline -->
-<g id="edge44" class="edge">
-<title>picosnitch__monitor_subprocess__queue_exec_event&#45;&gt;picosnitch__monitor_subprocess__get_cmdline</title>
-<path fill="none" stroke="#000000" d="M3351.03,-261.24C3315.64,-249.87 3266.73,-234.17 3230.1,-222.41"/>
-<polygon fill="#000000" stroke="#000000" points="3230.71,-218.93 3220.12,-219.2 3228.57,-225.59 3230.71,-218.93"/>
+<!-- picosnitch__user_interface__ui_init&#45;&gt;picosnitch__user_interface__ui_loop -->
+<g id="edge87" class="edge">
+<title>picosnitch__user_interface__ui_init&#45;&gt;picosnitch__user_interface__ui_loop</title>
+<path fill="none" stroke="#000000" d="M2847,-916.81C2847,-897.11 2847,-864.58 2847,-841.39"/>
+<polygon fill="#000000" stroke="#000000" points="2850.5,-841.16 2847,-831.16 2843.5,-841.16 2850.5,-841.16"/>
 </g>
-<!-- picosnitch__monitor_subprocess__queue_exec_event&#45;&gt;picosnitch__monitor_subprocess__get_fd -->
-<g id="edge45" class="edge">
-<title>picosnitch__monitor_subprocess__queue_exec_event&#45;&gt;picosnitch__monitor_subprocess__get_fd</title>
-<path fill="none" stroke="#000000" d="M3374.96,-259.41C3362.06,-249.7 3345.65,-237.35 3331.86,-226.97"/>
-<polygon fill="#000000" stroke="#000000" points="3333.76,-224.02 3323.67,-220.8 3329.55,-229.61 3333.76,-224.02"/>
+<!-- picosnitch__user_interface__ui_loop&#45;&gt;picosnitch__user_interface__ui_geoip -->
+<g id="edge88" class="edge">
+<title>picosnitch__user_interface__ui_loop&#45;&gt;picosnitch__user_interface__ui_geoip</title>
+<path fill="none" stroke="#000000" d="M2886.37,-805.04C2909.13,-799.95 2937.76,-791.69 2961,-779 2972.82,-772.55 2984.3,-763.18 2993.69,-754.44"/>
+<polygon fill="#000000" stroke="#000000" points="2996.3,-756.78 3001.05,-747.31 2991.43,-751.75 2996.3,-756.78"/>
 </g>
-<!-- picosnitch__monitor_subprocess__queue_recvv4_event&#45;&gt;picosnitch__monitor_subprocess__get_cmdline -->
-<g id="edge46" class="edge">
-<title>picosnitch__monitor_subprocess__queue_recvv4_event&#45;&gt;picosnitch__monitor_subprocess__get_cmdline</title>
-<path fill="none" stroke="#000000" d="M3179,-258.7C3179,-250.98 3179,-241.71 3179,-233.11"/>
-<polygon fill="#000000" stroke="#000000" points="3182.5,-233.1 3179,-223.1 3175.5,-233.1 3182.5,-233.1"/>
+<!-- picosnitch__user_interface__ui_loop__fetch_query_results -->
+<g id="node78" class="node">
+<title>picosnitch__user_interface__ui_loop__fetch_query_results</title>
+<ellipse fill="#9165ff" fill-opacity="0.698039" stroke="black" cx="2847" cy="-730" rx="102.08" ry="18"/>
+<text text-anchor="middle" x="2847" y="-726.3" font-family="Times,serif" font-size="14.00" fill="#000000">fetch_query_results</text>
 </g>
-<!-- picosnitch__monitor_subprocess__queue_recvv4_event&#45;&gt;picosnitch__monitor_subprocess__get_fd -->
-<g id="edge47" class="edge">
-<title>picosnitch__monitor_subprocess__queue_recvv4_event&#45;&gt;picosnitch__monitor_subprocess__get_fd</title>
-<path fill="none" stroke="#000000" d="M3208.31,-259.59C3227.12,-249.05 3251.59,-235.35 3271.07,-224.44"/>
-<polygon fill="#000000" stroke="#000000" points="3272.89,-227.43 3279.91,-219.49 3269.47,-221.32 3272.89,-227.43"/>
+<!-- picosnitch__user_interface__ui_loop&#45;&gt;picosnitch__user_interface__ui_loop__fetch_query_results -->
+<g id="edge89" class="edge">
+<title>picosnitch__user_interface__ui_loop&#45;&gt;picosnitch__user_interface__ui_loop__fetch_query_results</title>
+<path fill="none" stroke="#000000" d="M2847,-794.82C2847,-784.19 2847,-770.31 2847,-758.2"/>
+<polygon fill="#000000" stroke="#000000" points="2850.5,-758.15 2847,-748.15 2843.5,-758.15 2850.5,-758.15"/>
 </g>
-<!-- picosnitch__monitor_subprocess__queue_recvv6_event&#45;&gt;picosnitch__monitor_subprocess__get_cmdline -->
-<g id="edge48" class="edge">
-<title>picosnitch__monitor_subprocess__queue_recvv6_event&#45;&gt;picosnitch__monitor_subprocess__get_cmdline</title>
-<path fill="none" stroke="#000000" d="M3928.09,-261.75C3909.7,-257.6 3889.08,-253.51 3870,-251 3598.72,-215.34 3526.21,-259.22 3255,-223 3248.84,-222.18 3242.45,-221.1 3236.1,-219.89"/>
-<polygon fill="#000000" stroke="#000000" points="3236.7,-216.44 3226.2,-217.9 3235.31,-223.31 3236.7,-216.44"/>
+<!-- picosnitch__user_interface__ui_loop__get_geoip -->
+<g id="node79" class="node">
+<title>picosnitch__user_interface__ui_loop__get_geoip</title>
+<ellipse fill="#9165ff" fill-opacity="0.698039" stroke="black" cx="2671" cy="-730" rx="55.79" ry="18"/>
+<text text-anchor="middle" x="2671" y="-726.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_geoip</text>
 </g>
-<!-- picosnitch__monitor_subprocess__queue_recvv6_event&#45;&gt;picosnitch__monitor_subprocess__get_fd -->
-<g id="edge49" class="edge">
-<title>picosnitch__monitor_subprocess__queue_recvv6_event&#45;&gt;picosnitch__monitor_subprocess__get_fd</title>
-<path fill="none" stroke="#000000" d="M3926.87,-261.87C3908.78,-257.83 3888.64,-253.77 3870,-251 3680.48,-222.82 3452.47,-211.49 3353.66,-207.67"/>
-<polygon fill="#000000" stroke="#000000" points="3353.79,-204.17 3343.67,-207.29 3353.53,-211.17 3353.79,-204.17"/>
+<!-- picosnitch__user_interface__ui_loop&#45;&gt;picosnitch__user_interface__ui_loop__get_geoip -->
+<g id="edge90" class="edge">
+<title>picosnitch__user_interface__ui_loop&#45;&gt;picosnitch__user_interface__ui_loop__get_geoip</title>
+<path fill="none" stroke="#000000" d="M2809.03,-804.17C2787,-798.8 2759.12,-790.53 2736,-779 2722.26,-772.15 2708.39,-762.38 2697.01,-753.45"/>
+<polygon fill="#000000" stroke="#000000" points="2699.18,-750.7 2689.2,-747.14 2694.78,-756.15 2699.18,-750.7"/>
 </g>
-<!-- picosnitch__monitor_subprocess__queue_sendv4_event&#45;&gt;picosnitch__monitor_subprocess__get_cmdline -->
-<g id="edge50" class="edge">
-<title>picosnitch__monitor_subprocess__queue_sendv4_event&#45;&gt;picosnitch__monitor_subprocess__get_cmdline</title>
-<path fill="none" stroke="#000000" d="M3556.83,-261.94C3538.96,-258.02 3519.24,-254.01 3501,-251 3392.43,-233.07 3363.51,-241.26 3255,-223 3249.19,-222.02 3243.16,-220.89 3237.15,-219.67"/>
-<polygon fill="#000000" stroke="#000000" points="3237.6,-216.19 3227.09,-217.57 3236.17,-223.04 3237.6,-216.19"/>
+<!-- picosnitch__user_interface__ui_dash__display_time_range -->
+<g id="node67" class="node">
+<title>picosnitch__user_interface__ui_dash__display_time_range</title>
+<ellipse fill="#9165ff" fill-opacity="0.698039" stroke="black" cx="4232" cy="-813" rx="100.98" ry="18"/>
+<text text-anchor="middle" x="4232" y="-809.3" font-family="Times,serif" font-size="14.00" fill="#000000">display_time_range</text>
 </g>
-<!-- picosnitch__monitor_subprocess__queue_sendv4_event&#45;&gt;picosnitch__monitor_subprocess__get_fd -->
-<g id="edge51" class="edge">
-<title>picosnitch__monitor_subprocess__queue_sendv4_event&#45;&gt;picosnitch__monitor_subprocess__get_fd</title>
-<path fill="none" stroke="#000000" d="M3554.73,-262.25C3494.21,-248.68 3403.08,-228.23 3348.96,-216.09"/>
-<polygon fill="#000000" stroke="#000000" points="3349.5,-212.62 3338.98,-213.85 3347.97,-219.45 3349.5,-212.62"/>
+<!-- picosnitch__user_interface__ui_dash__exit -->
+<g id="node68" class="node">
+<title>picosnitch__user_interface__ui_dash__exit</title>
+<ellipse fill="#9165ff" fill-opacity="0.698039" stroke="black" cx="4085" cy="-813" rx="28.7" ry="18"/>
+<text text-anchor="middle" x="4085" y="-809.3" font-family="Times,serif" font-size="14.00" fill="#000000">exit</text>
 </g>
-<!-- picosnitch__monitor_subprocess__queue_sendv6_event&#45;&gt;picosnitch__monitor_subprocess__get_cmdline -->
-<g id="edge52" class="edge">
-<title>picosnitch__monitor_subprocess__queue_sendv6_event&#45;&gt;picosnitch__monitor_subprocess__get_cmdline</title>
-<path fill="none" stroke="#000000" d="M2999.13,-260.98C3036.65,-249.51 3088.25,-233.74 3126.56,-222.03"/>
-<polygon fill="#000000" stroke="#000000" points="3127.96,-225.26 3136.5,-218.99 3125.91,-218.57 3127.96,-225.26"/>
+<!-- picosnitch__user_interface__ui_dash__get_geoip -->
+<g id="node69" class="node">
+<title>picosnitch__user_interface__ui_dash__get_geoip</title>
+<ellipse fill="#9165ff" fill-opacity="0.698039" stroke="black" cx="3471" cy="-730" rx="55.79" ry="18"/>
+<text text-anchor="middle" x="3471" y="-726.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_geoip</text>
 </g>
-<!-- picosnitch__monitor_subprocess__queue_sendv6_event&#45;&gt;picosnitch__monitor_subprocess__get_fd -->
-<g id="edge53" class="edge">
-<title>picosnitch__monitor_subprocess__queue_sendv6_event&#45;&gt;picosnitch__monitor_subprocess__get_fd</title>
-<path fill="none" stroke="#000000" d="M3010.13,-262.12C3027.76,-258.27 3047.11,-254.26 3065,-251 3148.97,-235.7 3172.09,-243.3 3255,-223 3258.34,-222.18 3261.77,-221.23 3265.19,-220.2"/>
-<polygon fill="#000000" stroke="#000000" points="3266.27,-223.53 3274.73,-217.16 3264.14,-216.87 3266.27,-223.53"/>
+<!-- picosnitch__user_interface__ui_dash__get_totals -->
+<g id="node70" class="node">
+<title>picosnitch__user_interface__ui_dash__get_totals</title>
+<ellipse fill="#9165ff" fill-opacity="0.698039" stroke="black" cx="3601" cy="-730" rx="56.59" ry="18"/>
+<text text-anchor="middle" x="3601" y="-726.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_totals</text>
 </g>
-<!-- picosnitch__primary_subprocess__write_snitch_and_exit&#45;&gt;picosnitch__write_snitch -->
-<g id="edge61" class="edge">
-<title>picosnitch__primary_subprocess__write_snitch_and_exit&#45;&gt;picosnitch__write_snitch</title>
-<path fill="none" stroke="#000000" d="M174.91,-259.05C164.15,-249.98 150.75,-238.68 139.08,-228.84"/>
-<polygon fill="#000000" stroke="#000000" points="141.24,-226.08 131.34,-222.31 136.72,-231.43 141.24,-226.08"/>
+<!-- picosnitch__user_interface__ui_dash__get_user -->
+<g id="node71" class="node">
+<title>picosnitch__user_interface__ui_dash__get_user</title>
+<ellipse fill="#9165ff" fill-opacity="0.698039" stroke="black" cx="3726" cy="-730" rx="50.89" ry="18"/>
+<text text-anchor="middle" x="3726" y="-726.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_user</text>
 </g>
-<!-- picosnitch__primary_subprocess__write_snitch_and_exit&#45;&gt;picosnitch__NotificationManager__toast -->
-<g id="edge60" class="edge">
-<title>picosnitch__primary_subprocess__write_snitch_and_exit&#45;&gt;picosnitch__NotificationManager__toast</title>
-<path fill="none" stroke="#000000" d="M195.45,-258.75C196.14,-232.46 197.45,-182.13 198.28,-150.69"/>
-<polygon fill="#000000" stroke="#000000" points="201.78,-150.51 198.54,-140.43 194.78,-150.33 201.78,-150.51"/>
+<!-- picosnitch__user_interface__ui_dash__toggle_refresh -->
+<g id="node73" class="node">
+<title>picosnitch__user_interface__ui_dash__toggle_refresh</title>
+<ellipse fill="#9165ff" fill-opacity="0.698039" stroke="black" cx="3803" cy="-813" rx="77.99" ry="18"/>
+<text text-anchor="middle" x="3803" y="-809.3" font-family="Times,serif" font-size="14.00" fill="#000000">toggle_refresh</text>
 </g>
-<!-- picosnitch__start_picosnitch__PicoDaemon&#45;&gt;picosnitch__Daemon -->
-<g id="edge83" class="edge">
-<title>picosnitch__start_picosnitch__PicoDaemon&#45;&gt;picosnitch__Daemon</title>
-<path fill="none" stroke="#000000" d="M2365,-590.84C2365,-578.28 2365,-560.98 2365,-546.5"/>
-<polygon fill="#000000" stroke="#000000" points="2368.5,-546.11 2365,-536.11 2361.5,-546.11 2368.5,-546.11"/>
+<!-- picosnitch__user_interface__ui_dash__trim_label -->
+<g id="node74" class="node">
+<title>picosnitch__user_interface__ui_dash__trim_label</title>
+<ellipse fill="#9165ff" fill-opacity="0.698039" stroke="black" cx="3853" cy="-730" rx="57.69" ry="18"/>
+<text text-anchor="middle" x="3853" y="-726.3" font-family="Times,serif" font-size="14.00" fill="#000000">trim_label</text>
 </g>
-<!-- picosnitch__start_picosnitch__PicoDaemon__run -->
-<g id="node64" class="node">
-<title>picosnitch__start_picosnitch__PicoDaemon__run</title>
-<ellipse fill="#ff6565" fill-opacity="0.698039" stroke="black" cx="1925" cy="-609" rx="27" ry="18"/>
-<text text-anchor="middle" x="1925" y="-605.3" font-family="Times,serif" font-size="14.00" fill="#000000">run</text>
+<!-- picosnitch__user_interface__ui_dash__update -->
+<g id="node75" class="node">
+<title>picosnitch__user_interface__ui_dash__update</title>
+<ellipse fill="#9165ff" fill-opacity="0.698039" stroke="black" cx="3664" cy="-813" rx="42.79" ry="18"/>
+<text text-anchor="middle" x="3664" y="-809.3" font-family="Times,serif" font-size="14.00" fill="#000000">update</text>
 </g>
-<!-- picosnitch__start_picosnitch__PicoDaemon__run&#45;&gt;picosnitch__main -->
-<g id="edge84" class="edge">
-<title>picosnitch__start_picosnitch__PicoDaemon__run&#45;&gt;picosnitch__main</title>
-<path fill="none" stroke="#000000" d="M1923.26,-590.84C1921.98,-578.16 1920.21,-560.64 1918.74,-546.08"/>
-<polygon fill="#000000" stroke="#000000" points="1922.22,-545.7 1917.73,-536.11 1915.25,-546.41 1922.22,-545.7"/>
+<!-- picosnitch__user_interface__ui_dash__update&#45;&gt;picosnitch__user_interface__ui_geoip -->
+<g id="edge86" class="edge">
+<title>picosnitch__user_interface__ui_dash__update&#45;&gt;picosnitch__user_interface__ui_geoip</title>
+<path fill="none" stroke="#000000" d="M3640.21,-797.89C3631.62,-793.53 3621.65,-789.27 3612,-787 3582.63,-780.08 3097.07,-790.06 3069,-779 3056.37,-774.02 3044.85,-764.54 3035.81,-755.3"/>
+<polygon fill="#000000" stroke="#000000" points="3038.17,-752.7 3028.82,-747.71 3033.02,-757.44 3038.17,-752.7"/>
 </g>
-<!-- picosnitch__ui_dash__display_time_range -->
-<g id="node65" class="node">
-<title>picosnitch__ui_dash__display_time_range</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="1204" cy="-518" rx="100.98" ry="18"/>
-<text text-anchor="middle" x="1204" y="-514.3" font-family="Times,serif" font-size="14.00" fill="#000000">display_time_range</text>
+<!-- picosnitch__user_interface__ui_dash__update&#45;&gt;picosnitch__user_interface__ui_dash__get_geoip -->
+<g id="edge82" class="edge">
+<title>picosnitch__user_interface__ui_dash__update&#45;&gt;picosnitch__user_interface__ui_dash__get_geoip</title>
+<path fill="none" stroke="#000000" d="M3639.56,-798.11C3631.08,-793.88 3621.35,-789.65 3612,-787 3578.89,-777.63 3567.03,-791.55 3535,-779 3520.43,-773.29 3506.29,-763.31 3495.02,-753.92"/>
+<polygon fill="#000000" stroke="#000000" points="3497.21,-751.18 3487.36,-747.26 3492.61,-756.47 3497.21,-751.18"/>
 </g>
-<!-- picosnitch__ui_dash__exit -->
-<g id="node66" class="node">
-<title>picosnitch__ui_dash__exit</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="1057" cy="-518" rx="28.7" ry="18"/>
-<text text-anchor="middle" x="1057" y="-514.3" font-family="Times,serif" font-size="14.00" fill="#000000">exit</text>
+<!-- picosnitch__user_interface__ui_dash__update&#45;&gt;picosnitch__user_interface__ui_dash__get_totals -->
+<g id="edge83" class="edge">
+<title>picosnitch__user_interface__ui_dash__update&#45;&gt;picosnitch__user_interface__ui_dash__get_totals</title>
+<path fill="none" stroke="#000000" d="M3651.25,-795.61C3642.34,-784.16 3630.29,-768.66 3620.22,-755.72"/>
+<polygon fill="#000000" stroke="#000000" points="3622.85,-753.39 3613.95,-747.65 3617.32,-757.69 3622.85,-753.39"/>
 </g>
-<!-- picosnitch__ui_dash__get_geoip -->
-<g id="node67" class="node">
-<title>picosnitch__ui_dash__get_geoip</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="443" cy="-443" rx="55.79" ry="18"/>
-<text text-anchor="middle" x="443" y="-439.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_geoip</text>
+<!-- picosnitch__user_interface__ui_dash__update&#45;&gt;picosnitch__user_interface__ui_dash__get_user -->
+<g id="edge84" class="edge">
+<title>picosnitch__user_interface__ui_dash__update&#45;&gt;picosnitch__user_interface__ui_dash__get_user</title>
+<path fill="none" stroke="#000000" d="M3676.55,-795.61C3685.31,-784.16 3697.17,-768.66 3707.08,-755.72"/>
+<polygon fill="#000000" stroke="#000000" points="3709.96,-757.71 3713.26,-747.65 3704.4,-753.46 3709.96,-757.71"/>
 </g>
-<!-- picosnitch__ui_dash__get_totals -->
-<g id="node68" class="node">
-<title>picosnitch__ui_dash__get_totals</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="573" cy="-443" rx="56.59" ry="18"/>
-<text text-anchor="middle" x="573" y="-439.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_totals</text>
+<!-- picosnitch__user_interface__ui_dash__update&#45;&gt;picosnitch__user_interface__ui_dash__trim_label -->
+<g id="edge85" class="edge">
+<title>picosnitch__user_interface__ui_dash__update&#45;&gt;picosnitch__user_interface__ui_dash__trim_label</title>
+<path fill="none" stroke="#000000" d="M3688.46,-798.17C3696.94,-793.94 3706.66,-789.69 3716,-787 3746.09,-778.32 3756.78,-790.26 3786,-779 3801.19,-773.15 3816.11,-763.02 3828,-753.57"/>
+<polygon fill="#000000" stroke="#000000" points="3830.23,-756.27 3835.71,-747.2 3825.77,-750.87 3830.23,-756.27"/>
 </g>
-<!-- picosnitch__ui_dash__get_user -->
-<g id="node69" class="node">
-<title>picosnitch__ui_dash__get_user</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="698" cy="-443" rx="50.89" ry="18"/>
-<text text-anchor="middle" x="698" y="-439.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_user</text>
+<!-- picosnitch__user_interface__ui_dash__update_time_slider_marks -->
+<g id="node76" class="node">
+<title>picosnitch__user_interface__ui_dash__update_time_slider_marks</title>
+<ellipse fill="#9165ff" fill-opacity="0.698039" stroke="black" cx="3471" cy="-813" rx="131.88" ry="18"/>
+<text text-anchor="middle" x="3471" y="-809.3" font-family="Times,serif" font-size="14.00" fill="#000000">update_time_slider_marks</text>
 </g>
-<!-- picosnitch__ui_dash__toggle_refresh -->
-<g id="node71" class="node">
-<title>picosnitch__ui_dash__toggle_refresh</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="775" cy="-518" rx="77.99" ry="18"/>
-<text text-anchor="middle" x="775" y="-514.3" font-family="Times,serif" font-size="14.00" fill="#000000">toggle_refresh</text>
+<!-- picosnitch__user_interface__ui_dash__update_time_slider_pos -->
+<g id="node77" class="node">
+<title>picosnitch__user_interface__ui_dash__update_time_slider_pos</title>
+<ellipse fill="#9165ff" fill-opacity="0.698039" stroke="black" cx="3201" cy="-813" rx="119.68" ry="18"/>
+<text text-anchor="middle" x="3201" y="-809.3" font-family="Times,serif" font-size="14.00" fill="#000000">update_time_slider_pos</text>
 </g>
-<!-- picosnitch__ui_dash__trim_label -->
-<g id="node72" class="node">
-<title>picosnitch__ui_dash__trim_label</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="825" cy="-443" rx="57.69" ry="18"/>
-<text text-anchor="middle" x="825" y="-439.3" font-family="Times,serif" font-size="14.00" fill="#000000">trim_label</text>
+<!-- picosnitch__utils__get_fanotify_events&#45;&gt;picosnitch__event_structures__FanotifyEventMetadata -->
+<g id="edge91" class="edge">
+<title>picosnitch__utils__get_fanotify_events&#45;&gt;picosnitch__event_structures__FanotifyEventMetadata</title>
+<path fill="none" stroke="#000000" d="M1322.71,-318.52C1302.59,-311.75 1277.86,-304.56 1255,-301 1194.83,-291.64 766.85,-304.23 707,-293 677.56,-287.48 646.02,-275.85 621.49,-265.43"/>
+<polygon fill="#000000" stroke="#000000" points="622.69,-262.13 612.12,-261.36 619.9,-268.55 622.69,-262.13"/>
 </g>
-<!-- picosnitch__ui_dash__update -->
-<g id="node73" class="node">
-<title>picosnitch__ui_dash__update</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="636" cy="-518" rx="42.79" ry="18"/>
-<text text-anchor="middle" x="636" y="-514.3" font-family="Times,serif" font-size="14.00" fill="#000000">update</text>
+<!-- picosnitch__utils__get_fanotify_events&#45;&gt;picosnitch__utils__get_fstat -->
+<g id="edge92" class="edge">
+<title>picosnitch__utils__get_fanotify_events&#45;&gt;picosnitch__utils__get_fstat</title>
+<path fill="none" stroke="#000000" d="M1399.04,-318.09C1433.21,-302.58 1485.07,-279.02 1520.64,-262.87"/>
+<polygon fill="#000000" stroke="#000000" points="1522.1,-266.05 1529.76,-258.73 1519.21,-259.68 1522.1,-266.05"/>
 </g>
-<!-- picosnitch__ui_dash__update&#45;&gt;picosnitch__ui_geoip -->
-<g id="edge91" class="edge">
-<title>picosnitch__ui_dash__update&#45;&gt;picosnitch__ui_geoip</title>
-<path fill="none" stroke="#000000" d="M666.69,-505.27C673.6,-503.11 680.97,-501.17 688,-500 722.48,-494.28 1284.47,-504.78 1317,-492 1329.64,-487.04 1341.15,-477.55 1350.19,-468.32"/>
-<polygon fill="#000000" stroke="#000000" points="1352.99,-470.45 1357.18,-460.72 1347.83,-465.71 1352.99,-470.45"/>
+<!-- picosnitch__utils__get_sha256_fd&#45;&gt;picosnitch__utils__get_fstat -->
+<g id="edge93" class="edge">
+<title>picosnitch__utils__get_sha256_fd&#45;&gt;picosnitch__utils__get_fstat</title>
+<path fill="none" stroke="#000000" d="M1560,-316.84C1560,-304.28 1560,-286.98 1560,-272.5"/>
+<polygon fill="#000000" stroke="#000000" points="1563.5,-272.11 1560,-262.11 1556.5,-272.11 1563.5,-272.11"/>
 </g>
-<!-- picosnitch__ui_dash__update&#45;&gt;picosnitch__ui_dash__get_geoip -->
-<g id="edge87" class="edge">
-<title>picosnitch__ui_dash__update&#45;&gt;picosnitch__ui_dash__get_geoip</title>
-<path fill="none" stroke="#000000" d="M604.67,-505.57C597.92,-503.45 590.78,-501.44 584,-500 550.35,-492.84 539.03,-504.55 507,-492 492.43,-486.29 478.29,-476.31 467.02,-466.92"/>
-<polygon fill="#000000" stroke="#000000" points="469.21,-464.18 459.36,-460.26 464.61,-469.47 469.21,-464.18"/>
+<!-- picosnitch__utils__get_sha256_pid&#45;&gt;picosnitch__utils__get_fstat -->
+<g id="edge94" class="edge">
+<title>picosnitch__utils__get_sha256_pid&#45;&gt;picosnitch__utils__get_fstat</title>
+<path fill="none" stroke="#000000" d="M1707.41,-318.29C1676.81,-303.08 1630.38,-279.99 1597.82,-263.81"/>
+<polygon fill="#000000" stroke="#000000" points="1599.13,-260.55 1588.62,-259.23 1596.01,-266.81 1599.13,-260.55"/>
 </g>
-<!-- picosnitch__ui_dash__update&#45;&gt;picosnitch__ui_dash__get_totals -->
-<g id="edge88" class="edge">
-<title>picosnitch__ui_dash__update&#45;&gt;picosnitch__ui_dash__get_totals</title>
-<path fill="none" stroke="#000000" d="M622.02,-500.8C613.81,-491.29 603.29,-479.09 594.09,-468.44"/>
-<polygon fill="#000000" stroke="#000000" points="596.56,-465.95 587.38,-460.66 591.26,-470.52 596.56,-465.95"/>
+<!-- picosnitch__utils__read_snitch&#45;&gt;picosnitch__utils__write_snitch -->
+<g id="edge95" class="edge">
+<title>picosnitch__utils__read_snitch&#45;&gt;picosnitch__utils__write_snitch</title>
+<path fill="none" stroke="#000000" d="M2073.23,-316.84C2072.66,-304.28 2071.89,-286.98 2071.24,-272.5"/>
+<polygon fill="#000000" stroke="#000000" points="2074.71,-271.94 2070.77,-262.11 2067.72,-272.25 2074.71,-271.94"/>
 </g>
-<!-- picosnitch__ui_dash__update&#45;&gt;picosnitch__ui_dash__get_user -->
-<g id="edge89" class="edge">
-<title>picosnitch__ui_dash__update&#45;&gt;picosnitch__ui_dash__get_user</title>
-<path fill="none" stroke="#000000" d="M649.76,-500.8C657.89,-491.23 668.34,-478.92 677.44,-468.21"/>
-<polygon fill="#000000" stroke="#000000" points="680.26,-470.3 684.06,-460.41 674.92,-465.76 680.26,-470.3"/>
+<!-- picosnitch__utils__write_snitch&#45;&gt;picosnitch__notifcation_manager__NotificationManager__toast -->
+<g id="edge96" class="edge">
+<title>picosnitch__utils__write_snitch&#45;&gt;picosnitch__notifcation_manager__NotificationManager__toast</title>
+<path fill="none" stroke="#000000" d="M2137.27,-242.12C2487.26,-237.49 4084.82,-215.62 4106,-202 4123.96,-190.46 4133.64,-167.85 4138.73,-149.77"/>
+<polygon fill="#000000" stroke="#000000" points="4142.14,-150.57 4141.17,-140.02 4135.35,-148.88 4142.14,-150.57"/>
 </g>
-<!-- picosnitch__ui_dash__update&#45;&gt;picosnitch__ui_dash__trim_label -->
-<g id="edge90" class="edge">
-<title>picosnitch__ui_dash__update&#45;&gt;picosnitch__ui_dash__trim_label</title>
-<path fill="none" stroke="#000000" d="M667.34,-505.63C674.09,-503.5 681.23,-501.48 688,-500 718.59,-493.32 728.78,-503.26 758,-492 773.19,-486.15 788.11,-476.02 800,-466.57"/>
-<polygon fill="#000000" stroke="#000000" points="802.23,-469.27 807.71,-460.2 797.77,-463.87 802.23,-469.27"/>
+<!-- picosnitch__virustotal_subprocess__virustotal_subprocess&#45;&gt;picosnitch__utils__get_fstat -->
+<g id="edge97" class="edge">
+<title>picosnitch__virustotal_subprocess__virustotal_subprocess&#45;&gt;picosnitch__utils__get_fstat</title>
+<path fill="none" stroke="#000000" d="M422.26,-326.79C669.11,-309.05 1300.58,-263.65 1499.23,-249.37"/>
+<polygon fill="#000000" stroke="#000000" points="1499.74,-252.84 1509.47,-248.63 1499.24,-245.86 1499.74,-252.84"/>
 </g>
-<!-- picosnitch__ui_dash__update_time_slider_marks -->
-<g id="node74" class="node">
-<title>picosnitch__ui_dash__update_time_slider_marks</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="443" cy="-518" rx="131.88" ry="18"/>
-<text text-anchor="middle" x="443" y="-514.3" font-family="Times,serif" font-size="14.00" fill="#000000">update_time_slider_marks</text>
+<!-- picosnitch__virustotal_subprocess__virustotal_subprocess__get_analysis -->
+<g id="node90" class="node">
+<title>picosnitch__virustotal_subprocess__virustotal_subprocess__get_analysis</title>
+<ellipse fill="#ff65e9" fill-opacity="0.698039" stroke="black" cx="322" cy="-244" rx="67.69" ry="18"/>
+<text text-anchor="middle" x="322" y="-240.3" font-family="Times,serif" font-size="14.00" fill="#000000">get_analysis</text>
 </g>
-<!-- picosnitch__ui_dash__update_time_slider_pos -->
-<g id="node75" class="node">
-<title>picosnitch__ui_dash__update_time_slider_pos</title>
-<ellipse fill="#ff9999" fill-opacity="0.698039" stroke="black" cx="173" cy="-518" rx="119.68" ry="18"/>
-<text text-anchor="middle" x="173" y="-514.3" font-family="Times,serif" font-size="14.00" fill="#000000">update_time_slider_pos</text>
+<!-- picosnitch__virustotal_subprocess__virustotal_subprocess&#45;&gt;picosnitch__virustotal_subprocess__virustotal_subprocess__get_analysis -->
+<g id="edge98" class="edge">
+<title>picosnitch__virustotal_subprocess__virustotal_subprocess&#45;&gt;picosnitch__virustotal_subprocess__virustotal_subprocess__get_analysis</title>
+<path fill="none" stroke="#000000" d="M322,-316.84C322,-304.28 322,-286.98 322,-272.5"/>
+<polygon fill="#000000" stroke="#000000" points="325.5,-272.11 322,-262.11 318.5,-272.11 325.5,-272.11"/>
 </g>
 </g>
 </svg>
diff --git a/picosnitch.py b/picosnitch.py
deleted file mode 100755
index 00c6ebf..0000000
--- a/picosnitch.py
+++ /dev/null
@@ -1,2613 +0,0 @@
-#!/usr/bin/env python3
-# picosnitch
-# Copyright (C) 2020-2023 Eric Lesiuta
-
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-# https://github.com/elesiuta/picosnitch
-
-import atexit
-import collections
-import ctypes
-import ctypes.util
-import curses
-import datetime
-import fcntl
-import functools
-import ipaddress
-import json
-import hashlib
-import importlib
-import importlib.util
-import math
-import multiprocessing
-import os
-import pickle
-import pwd
-import queue
-import resource
-import shlex
-import signal
-import site
-import socket
-import sqlite3
-import struct
-import subprocess
-import sys
-import termios
-import textwrap
-import threading
-import time
-import typing
-
-# add site dirs for system and user installed packages (to import bcc with picosnitch installed via pipx/venv, or dependencies installed via user)
-site.addsitedir("/usr/lib/python3/dist-packages")
-site.addsitedir(os.path.expandvars("$PYTHON_USER_SITE"))
-import psutil
-
-# picosnitch version and supported platform
-VERSION: typing.Final[str] = "1.0.1"
-assert sys.version_info >= (3, 8), "Python version >= 3.8 is required"
-assert sys.platform.startswith("linux"), "Did not detect a supported operating system"
-
-# warning about -O (optimize) flag since asserts are disabled and some are critical
-if sys.flags.optimize > 0:
-    print("Warning: picosnitch does not function properly with the -O (optimize) flag", file=sys.stderr)
-
-# set constants and RLIMIT_NOFILE if configured
-if os.getuid() == 0:
-    if os.getenv("SUDO_UID"):
-        home_user = pwd.getpwuid(int(os.getenv("SUDO_UID"))).pw_name
-    elif os.getenv("SUDO_USER"):
-        home_user = os.getenv("SUDO_USER")
-    else:
-        for home_user in os.listdir("/home"):
-            try:
-                if pwd.getpwnam(home_user).pw_uid >= 1000:
-                    break
-            except Exception:
-                pass
-    home_dir = pwd.getpwnam(home_user).pw_dir
-    if not os.getenv("SUDO_UID"):
-        os.environ["SUDO_UID"] = str(pwd.getpwnam(home_user).pw_uid)
-    if not os.getenv("DBUS_SESSION_BUS_ADDRESS"):
-        os.environ["DBUS_SESSION_BUS_ADDRESS"] = f"unix:path=/run/user/{pwd.getpwnam(home_user).pw_uid}/bus"
-else:
-    home_dir = os.path.expanduser("~")
-    if sys.executable.startswith("/snap/"):
-        home_dir = home_dir.split("/snap/picosnitch")[0]
-BASE_PATH: typing.Final[str] = os.path.join(home_dir, ".config", "picosnitch")
-try:
-    file_path = os.path.join(BASE_PATH, "config.json")
-    with open(file_path, "r", encoding="utf-8", errors="surrogateescape") as json_file:
-        nofile = json.load(json_file)["Set RLIMIT_NOFILE"]
-    if type(nofile) == int:
-        try:
-            new_limit = (nofile, resource.getrlimit(resource.RLIMIT_NOFILE)[1])
-            resource.setrlimit(resource.RLIMIT_NOFILE, new_limit)
-            time.sleep(0.5)
-        except Exception as e:
-            print(type(e).__name__ + str(e.args), file=sys.stderr)
-            print("Error: Set RLIMIT_NOFILE was found in config.json but it could not be set", file=sys.stderr)
-except Exception:
-    pass
-FD_CACHE: typing.Final[int] = resource.getrlimit(resource.RLIMIT_NOFILE)[0] - 128
-PID_CACHE: typing.Final[int] = max(8192, 2*FD_CACHE)
-st_dev_mask = 0xffffffff
-try:
-    for part in psutil.disk_partitions():
-        if part.fstype == "btrfs":
-            st_dev_mask = 0
-            if not os.path.exists(os.path.join(BASE_PATH, "config.json")):
-                # only warn users about btrfs on first run (by checking for config.json)
-                print("Warning: running picosnitch on systems with btrfs is not fully supported due to dev number strangeness and non-unique inodes (this is still fine for most use cases)", file=sys.stderr)
-            break
-    file_path = os.path.join(BASE_PATH, "config.json")
-    with open(file_path, "r", encoding="utf-8", errors="surrogateescape") as json_file:
-        set_mask = json.load(json_file)["Set st_dev mask"]
-    if type(set_mask) == int:
-        st_dev_mask = set_mask
-except Exception:
-    pass
-ST_DEV_MASK: typing.Final[int] = st_dev_mask
-
-
-### classes
-class Daemon:
-    """A generic daemon class based on http://www.jejik.com/files/examples/daemon3x.py"""
-    def __init__(self, pidfile):
-        self.pidfile = pidfile
-
-    def daemonize(self):
-        """Daemonize class. UNIX double fork mechanism."""
-        try:
-            pid = os.fork()
-            if pid > 0:
-                # exit first parent
-                sys.exit(0)
-        except OSError as err:
-            sys.stderr.write('fork #1 failed: {0}\n'.format(err))
-            sys.exit(1)
-        # decouple from parent environment
-        os.chdir('/')
-        os.setsid()
-        os.umask(0)
-        # do second fork
-        try:
-            pid = os.fork()
-            if pid > 0:
-                # exit from second parent
-                sys.exit(0)
-        except OSError as err:
-            sys.stderr.write('fork #2 failed: {0}\n'.format(err))
-            sys.exit(1)
-        # redirect standard file descriptors
-        sys.stdout.flush()
-        sys.stderr.flush()
-        si = open(os.devnull, 'r')
-        so = open(os.devnull, 'a+')
-        se = open(os.devnull, 'a+')
-        os.dup2(si.fileno(), sys.stdin.fileno())
-        os.dup2(so.fileno(), sys.stdout.fileno())
-        os.dup2(se.fileno(), sys.stderr.fileno())
-        # write pidfile
-        atexit.register(self.delpid)
-        pid = str(os.getpid())
-        with open(self.pidfile,'w+') as f:
-            f.write(pid + '\n')
-
-    def delpid(self):
-        os.remove(self.pidfile)
-
-    def getpid(self):
-        """Get the pid from the pidfile"""
-        try:
-            with open(self.pidfile, "r") as f:
-                pid = int(f.read().strip())
-        except IOError:
-            pid = None
-        return pid
-
-    def start(self):
-        """Start the daemon."""
-        # Check for a pidfile to see if the daemon already runs
-        pid = self.getpid()
-        if pid:
-            message = "pidfile {0} already exist. " + \
-                    "picosnitch already running?\n"
-            sys.stderr.write(message.format(self.pidfile))
-            sys.exit(1)
-        # Start the daemon
-        self.daemonize()
-        self.run()
-
-    def stop(self):
-        """Stop the daemon."""
-        pid = self.getpid()
-        if not pid:
-            message = "pidfile {0} does not exist. " + \
-                    "picosnitch not running?\n"
-            sys.stderr.write(message.format(self.pidfile))
-            return # not an error in a restart
-        # Try killing the daemon process
-        try:
-            while 1:
-                os.kill(pid, signal.SIGTERM)
-                time.sleep(0.1)
-        except OSError as err:
-            e = str(err.args)
-            if e.find("No such process") > 0:
-                if os.path.exists(self.pidfile):
-                    os.remove(self.pidfile)
-            else:
-                print (str(err.args))
-                sys.exit(1)
-
-    def restart(self):
-        """Restart the daemon."""
-        self.stop()
-        self.start()
-
-    def status(self):
-        """Get daemon status."""
-        pid = self.getpid()
-        if pid:
-            try:
-                with open(f"/proc/{pid}/cmdline", "r") as f:
-                    cmdline = f.read()
-            except Exception:
-                cmdline = ""
-            if "picosnitch" in cmdline:
-                print(f"picosnitch is currently running with pid {pid}.")
-            else:
-                print("pidfile exists however picosnitch was not detected.")
-        else:
-            print("picosnitch does not appear to be running.")
-
-    def run(self):
-        """Subclass Daemon and override this method"""
-
-
-class ProcessManager:
-    """A class for managing a subprocess"""
-    def __init__(self, name: str, target: typing.Callable, init_args: tuple = ()) -> None:
-        self.name, self.target, self.init_args = name, target, init_args
-        self.q_in, self.q_out = multiprocessing.Queue(), multiprocessing.Queue()
-        self.start()
-
-    def start(self) -> None:
-        self.p = multiprocessing.Process(name=self.name, target=self.target, daemon=True,
-                                         args=(*self.init_args, self.q_in, self.q_out)
-                                        )
-        self.p.start()
-        self.pp = psutil.Process(self.p.pid)
-
-    def terminate(self) -> None:
-        if self.p.is_alive():
-            self.p.terminate()
-        self.p.join(timeout=5)
-        if self.p.is_alive():
-            self.p.kill()
-        self.p.join(timeout=5)
-        self.p.close()
-
-    def is_alive(self) -> bool:
-        return self.p.is_alive()
-
-    def is_zombie(self) -> bool:
-        return self.pp.is_running() and self.pp.status() == psutil.STATUS_ZOMBIE
-
-    def memory(self) -> int:
-        return self.pp.memory_info().rss
-
-
-class NotificationManager:
-    """A singleton for creating system tray notifications, holds notifications in queue if fails, prints if disabled"""
-    __instance = None
-    dbus_notifications = False
-    notifications_ready = False
-    notification_queue = []
-    last_notification = ""
-    def __new__(cls, *args, **kwargs):
-        if not cls.__instance:
-            cls.__instance = super(NotificationManager, cls).__new__(cls, *args, **kwargs)
-        return cls.__instance
-
-    def enable_notifications(self):
-        self.dbus_notifications = True
-        try:
-            import dbus
-            os.seteuid(int(os.getenv("SUDO_UID")))
-            dbus_session_obj = dbus.SessionBus().get_object("org.freedesktop.Notifications", "/org/freedesktop/Notifications")
-            interface = dbus.Interface(dbus_session_obj, "org.freedesktop.Notifications")
-            self.system_notification = lambda msg: interface.Notify("picosnitch", 0, "", "picosnitch", msg, [], [], 2000)
-            self.notifications_ready = True
-        except Exception:
-            pass
-        finally:
-            os.seteuid(os.getuid())
-
-    def toast(self, msg: str, file=sys.stdout) -> None:
-        try:
-            if self.notifications_ready:
-                if self.last_notification != msg:
-                    self.last_notification = msg
-                    self.system_notification(msg)
-            else:
-                print(msg, file=file)
-                self.notification_queue.append(msg)
-                if self.dbus_notifications:
-                    self.enable_notifications()
-                    if self.notifications_ready:
-                        for msg in self.notification_queue:
-                            try:
-                                if self.last_notification != msg:
-                                    self.last_notification = msg
-                                    self.system_notification(msg)
-                            except Exception:
-                                pass
-                        self.notification_queue = []
-        except Exception:
-            self.notification_queue.append(msg)
-            self.notifications_ready = False
-
-
-class BpfEvent(typing.TypedDict):
-    """Process and connection data for each event captured by the BPF program, and sent to the main & secondary processes"""
-    pid: int
-    name: str
-    fd: int
-    dev: int
-    ino: int
-    exe: str
-    cmdline: str
-    ppid: int
-    pname: str
-    pfd: int
-    pdev: int
-    pino: int
-    pexe: str
-    pcmdline: str
-    uid: int
-    send: int
-    recv: int
-    lport: int
-    rport: int
-    laddr: str
-    raddr: str
-    domain: str
-
-
-class FanotifyEventMetadata(ctypes.Structure):
-    """https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/uapi/linux/fanotify.h"""
-    _fields_ = [
-        ("event_len", ctypes.c_uint32),
-        ("vers", ctypes.c_uint8),
-        ("reserved", ctypes.c_uint8),
-        ("metadata_len", ctypes.c_uint16),
-        ("mask", ctypes.c_uint64),
-        ("fd", ctypes.c_int32),
-        ("pid", ctypes.c_int32)
-    ]
-
-
-### functions
-def read_snitch() -> dict:
-    """read data for the snitch dictionary from config.json and record.json or init new files if not found"""
-    template = {
-        "Config": {
-            "DB retention (days)": 30,
-            "DB sql log": True,
-            "DB sql server": {},
-            "DB text log": False,
-            "DB write limit (seconds)": 10,
-            "Dash scroll zoom": True,
-            "Dash theme": "",
-            "Desktop notifications": True,
-            "Every exe (not just conns)": False,
-            "GeoIP lookup": True,
-            "Log addresses": True,
-            "Log commands": True,
-            "Log ignore": [],
-            "Log ports": True,
-            "Perf ring buffer (pages)": 256,
-            "Set RLIMIT_NOFILE": None,
-            "Set st_dev mask": None,
-            "VT API key": "",
-            "VT file upload": False,
-            "VT request limit (seconds)": 15
-        },
-        "Error Log": [],
-        "Exe Log": [],
-        "Executables": {},
-        "Names": {},
-        "Parent Executables": {},
-        "Parent Names": {},
-        "SHA256": {}
-    }
-    data = {k: v for k, v in template.items()}
-    data["Config"] = {k: v for k, v in template["Config"].items()}
-    write_config = False
-    config_path = os.path.join(BASE_PATH, "config.json")
-    record_path = os.path.join(BASE_PATH, "record.json")
-    if os.path.exists(config_path):
-        with open(config_path, "r", encoding="utf-8", errors="surrogateescape") as json_file:
-            data["Config"] = json.load(json_file)
-        for key in template["Config"]:
-            if key not in data["Config"]:
-                data["Config"][key] = template["Config"][key]
-                write_config = True
-    else:
-        write_config = True
-    if os.path.exists(record_path):
-        with open(record_path, "r", encoding="utf-8", errors="surrogateescape") as json_file:
-            snitch_record = json.load(json_file)
-        for key in ["Executables", "Names", "Parent Executables", "Parent Names", "SHA256"]:
-            if key in snitch_record:
-                data[key] = snitch_record[key]
-    assert all(type(data[key]) == type(template[key]) for key in template), "Invalid json files"
-    assert all(key in ["Set RLIMIT_NOFILE", "Set st_dev mask"] or type(data["Config"][key]) == type(template["Config"][key]) for key in template["Config"]), "Invalid config"
-    if write_config:
-        write_snitch(data, write_config=True)
-    return data
-
-
-def write_snitch(snitch: dict, write_config: bool = False, write_record: bool = True) -> None:
-    """write the snitch dictionary to config.json, record.json, exe.log, and error.log"""
-    config_path = os.path.join(BASE_PATH, "config.json")
-    record_path = os.path.join(BASE_PATH, "record.json")
-    exe_log_path = os.path.join(BASE_PATH, "exe.log")
-    error_log_path = os.path.join(BASE_PATH, "error.log")
-    assert os.getuid() == 0, "Requires root privileges to write config and log files"
-    if not os.path.isdir(BASE_PATH):
-        os.makedirs(BASE_PATH)
-    if os.stat(BASE_PATH).st_uid == 0 and os.getenv("SUDO_UID"):
-        os.chown(BASE_PATH, int(os.getenv("SUDO_UID")), int(os.getenv("SUDO_UID")))
-    snitch_config = snitch["Config"]
-    try:
-        if write_config:
-            with open(config_path, "w", encoding="utf-8", errors="surrogateescape") as json_file:
-                json.dump(snitch_config, json_file, indent=2, separators=(',', ': '), sort_keys=True, ensure_ascii=False)
-        del snitch["Config"]
-        if snitch["Error Log"]:
-            with open(error_log_path, "a", encoding="utf-8", errors="surrogateescape") as text_file:
-                text_file.write("\n".join(snitch["Error Log"]) + "\n")
-        del snitch["Error Log"]
-        if snitch["Exe Log"]:
-            with open(exe_log_path, "a", encoding="utf-8", errors="surrogateescape") as text_file:
-                text_file.write("\n".join(snitch["Exe Log"]) + "\n")
-        del snitch["Exe Log"]
-        if write_record:
-            with open(record_path, "w", encoding="utf-8", errors="surrogateescape") as json_file:
-                json.dump(snitch, json_file, indent=2, separators=(',', ': '), sort_keys=True, ensure_ascii=False)
-    except Exception:
-        NotificationManager().toast("picosnitch write error", file=sys.stderr)
-    snitch["Config"] = snitch_config
-    snitch["Error Log"] = []
-    snitch["Exe Log"] = []
-
-
-@functools.lru_cache(maxsize=None)
-def reverse_dns_lookup(ip: str) -> str:
-    """do a reverse dns lookup, return original ip if fails"""
-    try:
-        host = socket.getnameinfo((ip, 0), 0)[0]
-        try:
-            _ = ipaddress.ip_address(host)
-            return ip
-        except ValueError:
-            return ".".join(reversed(host.split(".")))
-    except Exception:
-        return ip
-
-
-@functools.lru_cache(maxsize=PID_CACHE)
-def get_sha256_fd(path: str, st_dev: int, st_ino: int, _mod_cnt: int) -> str:
-    """get sha256 of process executable from /proc/monitor_pid/fd/proc_exe_fd"""
-    try:
-        sha256 = hashlib.sha256()
-        with open(path, "rb") as f:
-            if not st_ino:
-                return "!!! FD Stat Error"
-            if (st_dev, st_ino) != get_fstat(f.fileno()):
-                return "!!! FD Cache Error"
-            while data := f.read(1048576):
-                sha256.update(data)
-        return sha256.hexdigest()
-    except Exception:
-        return "!!! FD Read Error"
-
-
-@functools.lru_cache(maxsize=PID_CACHE)
-def get_sha256_pid(pid: int, st_dev: int, st_ino: int) -> str:
-    """get sha256 of process executable from /proc/pid/exe"""
-    try:
-        sha256 = hashlib.sha256()
-        with open(f"/proc/{pid}/exe", "rb") as f:
-            if (st_dev, st_ino) != get_fstat(f.fileno()):
-                return "!!! PID Recycled Error"
-            while data := f.read(1048576):
-                sha256.update(data)
-        return sha256.hexdigest()
-    except Exception:
-        return "!!! PID Read Error"
-
-
-@functools.lru_cache(maxsize=PID_CACHE)
-def get_sha256_fuse(q_in: multiprocessing.Queue, q_out: multiprocessing.Queue, path: str, pid: int, st_dev: int, st_ino: int, _mod_cnt: int) -> str:
-    """get sha256 of process executable from a fuse mount"""
-    q_in.put(pickle.dumps((path, pid, st_dev, st_ino)))
-    try:
-        return q_out.get()
-    except Exception:
-        return "!!! FUSE Subprocess Error"
-
-
-def get_fstat(fd: int) -> typing.Tuple[int, int]:
-    """get (st_dev, st_ino) or (0, 0) if fails"""
-    try:
-        stat = os.fstat(fd)
-        return stat.st_dev & ST_DEV_MASK, stat.st_ino
-    except Exception:
-        return 0, 0
-
-
-def get_fanotify_events(fan_fd: int, fan_mod_cnt: dict, q_error: multiprocessing.Queue) -> None:
-    """check if any watched executables were modified and increase count to trigger rehash"""
-    sizeof_event = ctypes.sizeof(FanotifyEventMetadata)
-    bytes_avail = ctypes.c_int()
-    fcntl.ioctl(fan_fd, termios.FIONREAD, bytes_avail)
-    for i in range(0, bytes_avail.value, sizeof_event):
-        try:
-            fanotify_event_metadata = FanotifyEventMetadata()
-            buf = os.read(fan_fd, sizeof_event)
-            ctypes.memmove(ctypes.addressof(fanotify_event_metadata), buf, sizeof_event)
-            st_dev, st_ino = get_fstat(fanotify_event_metadata.fd)
-            fan_mod_cnt[f"{st_dev} {st_ino}"] += 1
-            os.close(fanotify_event_metadata.fd)
-        except Exception as e:
-            q_error.put("Fanotify Event %s%s on line %s" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno))
-
-
-def get_vt_results(snitch: dict, q_vt: multiprocessing.Queue, q_out: multiprocessing.Queue, check_pending: bool = False) -> None:
-    """get virustotal results from subprocess and update snitch, q_vt = q_in if check_pending else q_out"""
-    if check_pending:
-        for exe in snitch["SHA256"]:
-            for sha256 in snitch["SHA256"][exe]:
-                if snitch["SHA256"][exe][sha256] in ["VT Pending", "File not analyzed (no api key)", "", None]:
-                    if exe in snitch["Executables"] and snitch["Executables"][exe]:
-                        name = snitch["Executables"][exe][0]
-                    elif exe in snitch["Parent Executables"] and snitch["Parent Executables"][exe]:
-                        name = snitch["Parent Executables"][exe][0]
-                    else:
-                        name = exe
-                    proc = {"exe": exe, "name": name}
-                    q_vt.put(pickle.dumps((proc, sha256)))
-    else:
-        while not q_vt.empty():
-            proc, sha256, result, suspicious = pickle.loads(q_vt.get())
-            q_out.put(pickle.dumps({"type": "vt_result", "name": proc["name"], "exe": proc["exe"], "sha256": sha256, "result": result, "suspicious": suspicious}))
-
-
-def monitor_subprocess_initial_poll() -> list:
-    """poll initial processes and connections using psutil"""
-    initial_processes = []
-    for pid in psutil.pids():
-        try:
-            proc = psutil.Process(pid).as_dict(attrs=["name", "exe", "pid", "ppid", "uids"], ad_value="")
-            proc["uid"] = proc["uids"][0]
-            proc["pname"] = psutil.Process(proc["ppid"]).name()
-            proc["raddr"] = ""
-            proc["rport"] = -1
-            proc["laddr"] = ""
-            proc["lport"] = -1
-            initial_processes.append(proc)
-        except Exception:
-            pass
-    for conn in psutil.net_connections(kind="all"):
-        try:
-            proc = psutil.Process(conn.pid).as_dict(attrs=["name", "exe", "pid", "ppid", "uids"], ad_value="")
-            proc["uid"] = proc["uids"][0]
-            proc["pname"] = psutil.Process(proc["ppid"]).name()
-            proc["raddr"] = conn.raddr.ip
-            proc["rport"] = conn.raddr.port
-            proc["laddr"] = conn.laddr.ip
-            proc["lport"] = conn.laddr.port
-            initial_processes.append(proc)
-        except Exception:
-            pass
-    return initial_processes
-
-
-def secondary_subprocess_sha_wrapper(snitch: dict, fan_mod_cnt: dict, proc: dict, p_rfuse: ProcessManager, q_vt: multiprocessing.Queue, q_out: multiprocessing.Queue, q_error: multiprocessing.Queue) -> str:
-    """get sha256 of executable and submit to primary_subprocess or virustotal_subprocess if necessary"""
-    sha_fd_error = ""
-    sha_pid_error = ""
-    sha256 = get_sha256_fd(proc["fd"], proc["dev"], proc["ino"], fan_mod_cnt["%d %d" % (proc["dev"], proc["ino"])])
-    if sha256.startswith("!"):
-        # fallback on trying to read directly (if still alive) if fd_cache fails, probable causes include:
-        # system suspends in the middle of hashing (since cache is reset)
-        # process too short lived to open fd or stat in time (then fallback will fail too)
-        # too many executables on system (see Set RLIMIT_NOFILE)
-        sha_fd_error = sha256
-        sha256 = get_sha256_pid(proc["pid"], proc["dev"], proc["ino"])
-        if sha256.startswith("!"):
-            # fallback to trying to read from fuse mount
-            # this is meant for appimages that are run as the same user as the one running picosnitch, since they are not readable as root
-            sha_pid_error = sha256
-            sha256 = get_sha256_fuse(p_rfuse.q_in, p_rfuse.q_out, proc["fd"], proc["pid"], proc["dev"], proc["ino"], fan_mod_cnt["%d %d" % (proc["dev"], proc["ino"])])
-            if sha256.startswith("!"):
-                # notify user with what went wrong (may be cause for suspicion)
-                sha256_error = sha_fd_error[4:] + " and " + sha_pid_error[4:] + " and " + sha256[4:]
-                sha256 = sha_fd_error + " " + sha_pid_error + " " + sha256
-                q_error.put(sha256_error + " for " + str(proc))
-            elif proc["exe"] not in snitch["SHA256"] or sha256 not in snitch["SHA256"][proc["exe"]]:
-                q_error.put("Fallback to FUSE hash successful on " + sha_fd_error[4:] + " and " + sha_pid_error[4:] + " for " + str(proc))
-        elif proc["exe"] not in snitch["SHA256"] or sha256 not in snitch["SHA256"][proc["exe"]]:
-            q_error.put("Fallback to PID hash successful on " + sha_fd_error[4:] + " for " + str(proc))
-    if proc["exe"] in snitch["SHA256"]:
-        if sha256 not in snitch["SHA256"][proc["exe"]]:
-            snitch["SHA256"][proc["exe"]][sha256] = "SUBMITTED"
-            q_vt.put(pickle.dumps((proc, sha256)))
-            q_out.put(pickle.dumps({"type": "sha256", "name": proc["name"], "exe": proc["exe"], "sha256": sha256}))
-        elif snitch["SHA256"][proc["exe"]][sha256] == "Failed to read process for upload":
-            snitch["SHA256"][proc["exe"]][sha256] = "RETRY"
-            q_vt.put(pickle.dumps((proc, sha256)))
-    else:
-        snitch["SHA256"][proc["exe"]] = {sha256: "SUBMITTED"}
-        q_vt.put(pickle.dumps((proc, sha256)))
-        q_out.put(pickle.dumps({"type": "sha256", "name": proc["name"], "exe": proc["exe"], "sha256": sha256}))
-    return sha256
-
-
-def secondary_subprocess_helper(snitch: dict, fan_mod_cnt: dict, new_processes: typing.List[bytes], p_rfuse: ProcessManager, q_vt: multiprocessing.Queue, q_out: multiprocessing.Queue, q_error: multiprocessing.Queue) -> typing.List[tuple]:
-    """iterate over the list of process/connection data to generate a list of entries for the sql database"""
-    datetime_now = time.strftime("%Y-%m-%d %H:%M:%S")
-    traffic_counter = collections.defaultdict(int)
-    transaction = set()
-    for proc_pickle in new_processes:
-        proc: BpfEvent = pickle.loads(proc_pickle)
-        if type(proc) != dict:
-            q_error.put("sync error between secondary and primary, received '%s' in middle of transfer" % str(proc))
-            continue
-        # get the sha256 of the process executable and its parent
-        sha256 = secondary_subprocess_sha_wrapper(snitch, fan_mod_cnt, proc, p_rfuse, q_vt, q_out, q_error)
-        pproc = {"pid": proc["ppid"], "name": proc["pname"], "exe": proc["pexe"], "fd": proc["pfd"], "dev": proc["pdev"], "ino": proc["pino"]}
-        psha256 = secondary_subprocess_sha_wrapper(snitch, fan_mod_cnt, pproc, p_rfuse, q_vt, q_out, q_error)
-        # join or omit commands from logs
-        if snitch["Config"]["Log commands"]:
-            proc["cmdline"] = shlex.join(proc["cmdline"].encode("utf-8", "ignore").decode("utf-8", "ignore").strip("\0\t\n ").split("\0"))
-            proc["pcmdline"] = shlex.join(proc["pcmdline"].encode("utf-8", "ignore").decode("utf-8", "ignore").strip("\0\t\n ").split("\0"))
-        else:
-            proc["cmdline"] = ""
-            proc["pcmdline"] = ""
-        # reverse dns lookup or omit with IP from logs
-        if snitch["Config"]["Log addresses"]:
-            if not proc["domain"]:
-                proc["domain"] = reverse_dns_lookup(proc["raddr"])
-        else:
-            proc["domain"], proc["raddr"] = "", ""
-        if not snitch["Config"]["Log ports"]:
-            proc["lport"] = min(0, proc["lport"])
-            proc["rport"] = min(0, proc["rport"])
-        # omit entry from logs
-        ignored = False
-        for ignore in snitch["Config"]["Log ignore"]:
-            if ((proc["rport"] == ignore) or
-                (proc["lport"] == ignore) or
-                (sha256 == ignore) or
-                (type(ignore) == str and proc["domain"].startswith(ignore))
-               ):
-                ignored = True
-                break
-        if ignored:
-            continue
-        if snitch["Config"]["Log ignore IP"] and proc["raddr"]:
-            raddr = ipaddress.ip_address(proc["raddr"])
-            if (any(raddr in network for network in snitch["Config"]["Log ignore IP"])):
-                continue
-            laddr = ipaddress.ip_address(proc["laddr"])
-            if (any(laddr in network for network in snitch["Config"]["Log ignore IP"])):
-                continue
-        # create sql entry
-        event = (proc["exe"], proc["name"], proc["cmdline"], sha256, proc["pexe"], proc["pname"], proc["pcmdline"], psha256, proc["uid"], proc["lport"], proc["rport"], proc["laddr"], proc["raddr"], proc["domain"])
-        traffic_counter["send " + str(event)] += proc["send"]
-        traffic_counter["recv " + str(event)] += proc["recv"]
-        transaction.add(event)
-    return [(datetime_now, traffic_counter["send " + str(event)], traffic_counter["recv " + str(event)], *event) for event in transaction]
-
-
-def primary_subprocess_helper(snitch: dict, new_processes: typing.List[bytes]) -> None:
-    """iterate over the list of process/connection data to update the snitch dictionary and create notifications on new entries"""
-    datetime_now = time.strftime("%Y-%m-%d %H:%M:%S")
-    for proc_pickle in new_processes:
-        proc: BpfEvent = pickle.loads(proc_pickle)
-        proc_name, proc_exe, snitch_names, snitch_executables, parent = proc["name"], proc["exe"], snitch["Names"], snitch["Executables"], ""
-        for i in range(2):
-            notification = []
-            if proc_name in snitch_names:
-                if proc_exe not in snitch_names[proc_name]:
-                    snitch_names[proc_name].append(proc_exe)
-            else:
-                snitch_names[proc_name] = [proc_exe]
-                notification.append("name")
-            if proc_exe in snitch_executables:
-                if proc_name not in snitch_executables[proc_exe]:
-                    snitch_executables[proc_exe].append(proc_name)
-            else:
-                snitch_executables[proc_exe] = [proc_name]
-                notification.append("exe")
-                if proc_exe not in snitch["SHA256"]:
-                    snitch["SHA256"][proc_exe] = {}
-            if notification:
-                snitch["Exe Log"].append(f"{datetime_now} {proc_name:<16.16} {proc_exe} (new {', '.join(notification)}){parent}")
-                NotificationManager().toast(f"picosnitch: {proc_name} {proc_exe}")
-            proc_name, proc_exe, snitch_names, snitch_executables, parent = proc["pname"], proc["pexe"], snitch["Parent Names"], snitch["Parent Executables"], " (parent)"
-
-
-### processes
-def primary_subprocess(snitch, snitch_pipes, secondary_pipe, q_error, q_in, _q_out):
-    """first to receive connection data from monitor, more responsive than secondary, creates notifications and writes exe.log, error.log, and record.json"""
-    try:
-        os.nice(-20)
-    except Exception:
-        pass
-    # init variables for loop
-    parent_process = multiprocessing.parent_process()
-    snitch_record = pickle.dumps([snitch["Executables"], snitch["Names"], snitch["Parent Executables"], snitch["Parent Names"], snitch["SHA256"]])
-    last_write = 0
-    write_record = False
-    processes_to_send = []
-    # init notifications
-    if snitch["Config"]["Desktop notifications"]:
-        NotificationManager().enable_notifications()
-    # init signal handlers
-    def write_snitch_and_exit(snitch: dict, q_error: multiprocessing.Queue, snitch_pipes):
-        while not q_error.empty():
-            error = q_error.get()
-            snitch["Error Log"].append(time.strftime("%Y-%m-%d %H:%M:%S") + " " + error)
-            # shorten some common error messages before displaying them and after writing them to error.log
-            error = error.replace("FD Read Error and PID Read Error and FUSE Read Error for", "Read Error for")
-            if len(error) > 50:
-                error = error[:47] + "..."
-            NotificationManager().toast(error, file=sys.stderr)
-        write_snitch(snitch)
-        for snitch_pipe in snitch_pipes:
-            snitch_pipe.close()
-        sys.exit(0)
-    signal.signal(signal.SIGTERM, lambda *args: write_snitch_and_exit(snitch, q_error, snitch_pipes))
-    signal.signal(signal.SIGINT, lambda *args: write_snitch_and_exit(snitch, q_error, snitch_pipes))
-    # init thread to receive new connection data over pipe
-    def snitch_pipe_thread(snitch_pipes, pipe_data: list, listen: threading.Event, ready: threading.Event):
-        while True:
-            listen.wait()
-            new_processes = pipe_data[0]
-            while listen.is_set():
-                for i in range(5):
-                    if any(snitch_pipe.poll() for snitch_pipe in snitch_pipes):
-                        break
-                    time.sleep(1)
-                for snitch_pipe in snitch_pipes:
-                    while snitch_pipe.poll():
-                        new_processes.append(snitch_pipe.recv_bytes())
-            ready.set()
-    listen, ready = threading.Event(), threading.Event()
-    pipe_data = [[]]
-    thread = threading.Thread(target=snitch_pipe_thread, args=(snitch_pipes, pipe_data, listen, ready,), daemon=True)
-    thread.start()
-    listen.set()
-    # main loop
-    while True:
-        if not parent_process.is_alive():
-            q_error.put("picosnitch has stopped")
-            write_snitch_and_exit(snitch, q_error, snitch_pipes)
-        try:
-            # check for errors
-            while not q_error.empty():
-                error = q_error.get()
-                snitch["Error Log"].append(time.strftime("%Y-%m-%d %H:%M:%S") + " " + error)
-                # shorten some common error messages before displaying them and after writing them to error.log
-                error = error.replace("FD Read Error and PID Read Error and FUSE Read Error for", "Read Error for")
-                if len(error) > 50:
-                    error = error[:47] + "..."
-                # don't need to toast fallback success messages
-                if error.startswith("Fallback to FUSE hash successful on ") or error.startswith("Fallback to PID hash successful on "):
-                    continue
-                NotificationManager().toast(error, file=sys.stderr)
-            # get list of new processes and connections since last update
-            listen.clear()
-            if not ready.wait(timeout=300):
-                q_error.put("thread timeout error for primary subprocess")
-                write_snitch_and_exit(snitch, q_error, snitch_pipes)
-            new_processes = pipe_data[0]
-            pipe_data[0] = []
-            ready.clear()
-            listen.set()
-            # process the list and update snitch, send new process/connection data to secondary subprocess if ready
-            primary_subprocess_helper(snitch, new_processes)
-            processes_to_send += new_processes
-            while not q_in.empty():
-                msg: dict = pickle.loads(q_in.get())
-                if msg["type"] == "ready":
-                    secondary_pipe.send_bytes(pickle.dumps(len(processes_to_send)))
-                    for proc_pickle in processes_to_send:
-                        secondary_pipe.send_bytes(proc_pickle)
-                    secondary_pipe.send_bytes(pickle.dumps("done"))
-                    processes_to_send = []
-                    break
-                elif msg["type"] == "sha256":
-                    if msg["exe"] in snitch["SHA256"]:
-                        if msg["sha256"] not in snitch["SHA256"][msg["exe"]]:
-                            snitch["SHA256"][msg["exe"]][msg["sha256"]] = "VT Pending"
-                            snitch["Exe Log"].append(f"{time.strftime('%Y-%m-%d %H:%M:%S')} {msg['sha256']:<16.16} {msg['exe']} (new hash)")
-                            NotificationManager().toast(f"New sha256: {msg['exe']}")
-                    else:
-                        snitch["SHA256"][msg["exe"]] = {msg["sha256"]: "VT Pending"}
-                elif msg["type"] == "vt_result":
-                    if msg["exe"] in snitch["SHA256"]:
-                        if msg["sha256"] not in snitch["SHA256"][msg["exe"]]:
-                            snitch["Exe Log"].append(f"{time.strftime('%Y-%m-%d %H:%M:%S')} {msg['sha256']:<16.16} {msg['exe']} (new hash)")
-                            NotificationManager().toast(f"New sha256: {msg['exe']}")
-                        snitch["SHA256"][msg["exe"]][msg["sha256"]] = msg["result"]
-                    else:
-                        snitch["SHA256"][msg["exe"]] = {msg["sha256"]: msg["result"]}
-                    if msg["suspicious"]:
-                        snitch["Exe Log"].append(f"{time.strftime('%Y-%m-%d %H:%M:%S')} {msg['sha256']:<16.16} {msg['exe']} (suspicious)")
-                        NotificationManager().toast(f"Suspicious VT results: {msg['exe']}")
-                    else:
-                        snitch["Exe Log"].append(f"{time.strftime('%Y-%m-%d %H:%M:%S')} {msg['sha256']:<16.16} {msg['exe']} (clean)")
-            # write the snitch dictionary to record.json, error.log, and exe.log (limit writes to reduce disk wear)
-            if snitch["Error Log"] or snitch["Exe Log"] or time.time() - last_write > 30:
-                new_record = pickle.dumps([snitch["Executables"], snitch["Names"], snitch["Parent Executables"], snitch["Parent Names"], snitch["SHA256"]])
-                if new_record != snitch_record:
-                    snitch_record = new_record
-                    write_record = True
-                write_snitch(snitch, write_record=write_record)
-                last_write = time.time()
-                write_record = False
-        except Exception as e:
-            q_error.put("primary subprocess %s%s on line %s" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno))
-
-
-def secondary_subprocess(snitch, fan_fd, p_rfuse: ProcessManager, p_virustotal: ProcessManager, secondary_pipe, q_primary_in, q_error, _q_in, _q_out):
-    """second to receive connection data from monitor, less responsive than primary, coordinates connection data with virustotal subprocess and checks fanotify, updates connection logs and reports sha256/vt_results back to primary_subprocess if needed"""
-    parent_process = multiprocessing.parent_process()
-    # maintain a separate copy of the snitch dictionary here and coordinate with the primary_subprocess (sha256 and vt_results)
-    get_vt_results(snitch, p_virustotal.q_in, q_primary_in, True)
-    # init sql
-    # (contime text, send integer, recv integer, exe text, name text, cmdline text, sha256 text, pexe text, pname text, pcmdline text, psha256 text, uid integer, lport integer, rport integer, laddr text, raddr text, domain text)
-    # (datetime_now, traffic_counter["send " + str(event)], traffic_counter["recv " + str(event)], *(proc["exe"], proc["name"], proc["cmdline"], sha256, proc["pexe"], proc["pname"], proc["pcmdline"], psha256, proc["uid"], proc["lport"], proc["rport"], proc["laddr"], proc["raddr"], proc["domain"]))
-    sqlite_query = ''' INSERT INTO connections VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) '''
-    file_path = os.path.join(BASE_PATH, "snitch.db")
-    text_path = os.path.join(BASE_PATH, "conn.log")
-    if snitch["Config"]["DB sql log"]:
-        con = sqlite3.connect(file_path)
-        cur = con.cursor()
-        cur.execute(''' PRAGMA user_version ''')
-        assert cur.fetchone()[0] == 3, f"Incorrect database version of snitch.db for picosnitch v{VERSION}"
-        cur.execute(''' DELETE FROM connections WHERE contime < datetime("now", "localtime", "-%d days") ''' % int(snitch["Config"]["DB retention (days)"]))
-        con.commit()
-        con.close()
-    if sql_kwargs := snitch["Config"]["DB sql server"]:
-        sql_client = sql_kwargs.pop("client", "no client error")
-        table_name = sql_kwargs.pop("table_name", "connections")
-        sql = importlib.import_module(sql_client)
-        sql_query = sqlite_query.replace("?", "%s").replace("connections", table_name)
-    log_destinations = int(bool(snitch["Config"]["DB sql log"])) + int(bool(sql_kwargs)) + int(bool(snitch["Config"]["DB text log"]))
-    # init fanotify mod counter = {"st_dev st_ino": modify_count}, and traffic counter = {"send|recv pid socket_ino": bytes}
-    fan_mod_cnt = collections.defaultdict(int)
-    # get network address and mask for ignored IP subnets
-    ignored_ips = []
-    for ip_subnet in reversed(snitch["Config"]["Log ignore"]):
-        try:
-            ignored_ips.append(ipaddress.ip_network(ip_subnet))
-            snitch["Config"]["Log ignore"].remove(ip_subnet)
-        except Exception as e:
-            pass
-    snitch["Config"]["Log ignore IP"] = ignored_ips
-    # main loop
-    transaction = []
-    new_processes = []
-    last_write = 0
-    while True:
-        if not parent_process.is_alive():
-            return 0
-        try:
-            # prep to receive new connections
-            if secondary_pipe.poll():
-                q_error.put("sync error between secondary and primary on ready (pipe not empty)")
-            else:
-                q_primary_in.put(pickle.dumps({"type": "ready"}))
-                secondary_pipe.poll(timeout=300)
-                if not secondary_pipe.poll():
-                    q_error.put("sync error between secondary and primary on ready (secondary timed out waiting for first message)")
-            # receive first message, should be transfer size
-            transfer_size = 0
-            if secondary_pipe.poll():
-                first_pickle = secondary_pipe.recv_bytes()
-                if type(pickle.loads(first_pickle)) == int:
-                    transfer_size = pickle.loads(first_pickle)
-                elif pickle.loads(first_pickle) == "done":
-                    q_error.put("sync error between secondary and primary on ready (received done)")
-                else:
-                    q_error.put("sync error between secondary and primary on ready (did not receive transfer size)")
-                    new_processes.append(first_pickle)
-            # receive new connections until "done"
-            timeout_counter = 0
-            while True:
-                while secondary_pipe.poll(timeout=1):
-                    new_processes.append(secondary_pipe.recv_bytes())
-                    transfer_size -= 1
-                timeout_counter += 1
-                if pickle.loads(new_processes[-1]) == "done":
-                    _ = new_processes.pop()
-                    transfer_size += 1
-                    break
-                elif timeout_counter > 30:
-                    q_error.put("sync error between secondary and primary on receive (did not receive done)")
-            if transfer_size > 0:
-                q_error.put("sync error between secondary and primary on receive (did not receive all messages)")
-            elif transfer_size < 0:
-                q_error.put("sync error between secondary and primary on receive (received extra messages)")
-            # check for other pending data (vt, fanotify)
-            get_vt_results(snitch, p_virustotal.q_out, q_primary_in, False)
-            get_fanotify_events(fan_fd, fan_mod_cnt, q_error)
-            # process connection data
-            if time.time() - last_write > snitch["Config"]["DB write limit (seconds)"] and (transaction or new_processes):
-                current_write = time.time()
-                transaction += secondary_subprocess_helper(snitch, fan_mod_cnt, new_processes, p_rfuse, p_virustotal.q_in, q_primary_in, q_error)
-                new_processes = []
-                transaction_success = False
-                try:
-                    if snitch["Config"]["DB sql log"]:
-                        con = sqlite3.connect(file_path)
-                        with con:
-                            con.executemany(sqlite_query, transaction)
-                        con.close()
-                        transaction_success = True
-                except Exception as e:
-                    q_error.put("SQLite execute %s%s on line %s, lost %s entries" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno, len(transaction)))
-                try:
-                    if sql_kwargs:
-                        con = sql.connect(**sql_kwargs)
-                        with con.cursor() as cur:
-                            cur.executemany(sql_query, transaction)
-                        con.commit()
-                        con.close()
-                        transaction_success = True
-                except Exception as e:
-                    q_error.put("SQL server execute %s%s on line %s, lost %s entries" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno, len(transaction)))
-                try:
-                    if snitch["Config"]["DB text log"]:
-                        with open(text_path, "a", encoding="utf-8", errors="surrogateescape") as text_file:
-                            for entry in transaction:
-                                clean_entry = [str(value).replace(",", "").replace("\n", "").replace("\0", "") for value in entry]
-                                text_file.write(",".join(clean_entry) + "\n")
-                        transaction_success = True
-                except Exception as e:
-                    q_error.put("text log %s%s on line %s, lost %s entries" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno, len(transaction)))
-                if transaction_success or log_destinations == 0:
-                    transaction = []
-                else:
-                    q_error.put("secondary subprocess all log desinations failed, will retry %s entries with next write" % (len(transaction)))
-                last_write = current_write
-        except Exception as e:
-            q_error.put("secondary subprocess %s%s on line %s" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno))
-
-
-def rfuse_subprocess(config: dict, q_error, q_in, q_out):
-    """runs as user to read executables for FUSE/AppImage (since real, effective, and saved UID must match)"""
-    parent_process = multiprocessing.parent_process()
-    try:
-        os.setgid(int(os.getenv("SUDO_UID")))
-        os.setuid(int(os.getenv("SUDO_UID")))
-    except Exception:
-        pass
-    while True:
-        if not parent_process.is_alive():
-            return 0
-        try:
-            path, pid, st_dev, st_ino = pickle.loads(q_in.get(block=True, timeout=15))
-            sha256 = get_sha256_fd.__wrapped__(path, st_dev, st_ino, 0)
-            if sha256.startswith("!"):
-                sha256 = get_sha256_pid.__wrapped__(pid, st_dev, st_ino)
-                if sha256.startswith("!"):
-                    sha256 = "!!! FUSE Read Error"
-            q_out.put(sha256)
-        except queue.Empty:
-            pass
-        except Exception as e:
-            q_error.put("rfuse subprocess %s%s on line %s" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno))
-
-
-def monitor_subprocess(config: dict, fan_fd, snitch_pipes, q_error, q_in, _q_out):
-    """runs a bpf program to monitor the system for new connections and puts info into a pipe for primary_subprocess"""
-    # initialization of subprocess
-    try:
-        os.nice(-20)
-    except Exception:
-        pass
-    import bcc
-    from bcc import BPF
-    parent_process = multiprocessing.parent_process()
-    signal.signal(signal.SIGTERM, lambda *args: sys.exit(0))
-    snitch_pipe_0, snitch_pipe_1, snitch_pipe_2, snitch_pipe_3, snitch_pipe_4 = snitch_pipes
-    EVERY_EXE: typing.Final[bool] = config["Every exe (not just conns)"]
-    PAGE_CNT: typing.Final[int] = config["Perf ring buffer (pages)"]
-    # fanotify (for watching executables for modification)
-    libc = ctypes.CDLL(ctypes.util.find_library("c"))
-    _FAN_MARK_ADD = 0x1
-    _FAN_MARK_REMOVE = 0x2
-    _FAN_MARK_FLUSH = 0x80
-    _FAN_MODIFY = 0x2
-    libc.fanotify_mark(fan_fd, _FAN_MARK_FLUSH, _FAN_MODIFY, -1, None)
-    # domain and file descriptor cache, domains are cached for the life of the program, fd has a fixed size, populate with dummy values
-    domain_dict = collections.defaultdict(str)
-    fd_dict = collections.OrderedDict()
-    for x in range(FD_CACHE):
-        fd_dict[f"tmp{x}"] = (0,)
-    self_pid = os.getpid()
-    # function for getting an existing or opening a new file descriptor based on st_dev and st_ino
-    def get_fd(st_dev: int, st_ino: int, pid: int, port: int) -> typing.Tuple[int, int, int, str, str]:
-        st_dev = st_dev & ST_DEV_MASK
-        sig = f"{st_dev} {st_ino}"
-        try:
-            # check if it is in the cache and move it to the most recent position
-            fd_dict.move_to_end(sig)
-            fd, fd_path, exe = fd_dict[sig]
-            if not fd:
-                # sig is in cache but fd is 0, try again to open it
-                # add a dummy value to the oldest postition to be popped off on retry so cache size is maintained
-                # since sig is already in cache, value will just be updated without increasing cache size
-                fd_dict[f"tmp{sig}"] = (0,)
-                fd_dict.move_to_end(f"tmp{sig}", last=False)
-                raise Exception("previous attempt failed, probably due to process terminating too quickly, try again")
-        except Exception:
-            # open a new file descriptor and pop off the oldest one
-            # watch it with fanotify, and also cache the apparent executable path with it
-            try:
-                fd = os.open(f"/proc/{pid}/exe", os.O_RDONLY)
-                libc.fanotify_mark(fan_fd, _FAN_MARK_ADD, _FAN_MODIFY, fd, None)
-                fd_path = f"/proc/{self_pid}/fd/{fd}"
-            except Exception:
-                fd, fd_path = 0, ""
-            try:
-                exe = os.readlink(f"/proc/{pid}/exe")
-            except Exception:
-                exe = ""
-            if fd and (st_dev, st_ino) != get_fstat(fd):
-                if EVERY_EXE or port != -1:
-                    q_error.put(f"Exe inode changed for (pid: {pid} fd: {fd} dev: {st_dev} ino: {st_ino}) before FD could be opened, using port: {port}")
-                st_dev, st_ino = get_fstat(fd)
-                sig = f"{st_dev} {st_ino}"
-                if EVERY_EXE or port != -1:
-                    q_error.put(f"New inode for (pid: {pid} fd: {fd} dev: {st_dev} ino: {st_ino} exe: {exe})")
-            fd_dict[sig] = (fd, fd_path, exe)
-            try:
-                if fd_old := fd_dict.popitem(last=False)[1][0]:
-                    libc.fanotify_mark(fan_fd, _FAN_MARK_REMOVE, _FAN_MODIFY, fd_old, None)
-                    os.close(fd_old)
-            except Exception:
-                pass
-        return (st_dev, st_ino, pid, fd_path, exe)
-    # function for getting or looking up the cmdline for a pid
-    @functools.lru_cache(maxsize=PID_CACHE)
-    def get_cmdline(pid: int) -> str:
-        try:
-            with open(f"/proc/{pid}/cmdline", "r") as f:
-                return f.read()
-        except Exception:
-            return ""
-    # get current connections
-    for proc in monitor_subprocess_initial_poll():
-        try:
-            stat = os.stat(f"/proc/{proc['pid']}/exe")
-            pstat = os.stat(f"/proc/{proc['ppid']}/exe")
-            cmd = get_cmdline(proc["pid"])
-            pcmd = get_cmdline(proc["ppid"])
-            st_dev, st_ino, pid, fd, exe = get_fd(stat.st_dev, stat.st_ino, proc["pid"], proc["rport"])
-            pst_dev, pst_ino, ppid, pfd, pexe = get_fd(pstat.st_dev, pstat.st_ino, proc["ppid"], -1)
-            if EVERY_EXE or proc["rport"] != -1:
-                snitch_pipe_0.send_bytes(pickle.dumps({"pid": pid, "name": proc["name"], "fd": fd, "dev": st_dev, "ino": st_ino, "exe": exe, "cmdline": cmd,
-                                                     "ppid": ppid, "pname": proc["pname"], "pfd": pfd, "pdev": pst_dev, "pino": pst_ino, "pexe": pexe, "pcmdline": pcmd,
-                                                     "uid": proc["uid"], "send": 0, "recv": 0, "lport": proc["lport"], "rport": proc["rport"], "laddr": proc["laddr"], "raddr": proc["raddr"], "domain": domain_dict[proc["raddr"]]}))
-        except Exception:
-            pass
-    # initialize bpf program
-    bpf_text = bpf_text_base + bpf_text_bandwidth_structs + bpf_text_bandwidth_probe.replace("int flags, ", "") + bpf_text_bandwidth_probe.replace("sendmsg", "recvmsg")
-    try:
-        assert BPF.support_kfunc(), "BPF.support_kfunc() was not True, check BCC version or Kernel Configuration"
-        b = BPF(text=bpf_text)
-        b.attach_kretprobe(event=b.get_syscall_fnname("execve"), fn_name="exec_entry")
-    except Exception as e:
-        q_error.put("Init BPF %s%s on line %s" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno))
-        time.sleep(5)
-        os.kill(parent_process.pid, signal.SIGTERM)
-        raise e
-    use_getaddrinfo_uprobe = False
-    if bcc.__version__ == "EAD-HASH-NOTFOUND+GITDIR-N" or tuple(map(int, bcc.__version__.split(".")[0:2])) >= (0, 23):
-        try:
-            b.attach_uprobe(name="c", sym="getaddrinfo", fn_name="dns_entry")
-            b.attach_uretprobe(name="c", sym="getaddrinfo", fn_name="dns_return")
-            use_getaddrinfo_uprobe = True
-        except Exception:
-            q_error.put("BPF.attach_uprobe() failed for getaddrinfo, falling back to only using reverse DNS lookup")
-    # callbacks for bpf events, read event and put into a pipe for primary_subprocess
-    def queue_lost(event, *args):
-        q_error.put(f"BPF callbacks not processing fast enough, missed {event} event, try increasing 'Perf ring buffer (pages)' (power of two) if this continues")
-    def queue_sendv4_event(cpu, data, size):
-        event = b["sendmsg_events"].event(data)
-        st_dev, st_ino, pid, fd, exe = get_fd(event.dev, event.ino, event.pid, event.dport)
-        pst_dev, pst_ino, ppid, pfd, pexe = get_fd(event.pdev, event.pino, event.ppid, -1)
-        cmd = get_cmdline(event.pid)
-        pcmd = get_cmdline(event.ppid)
-        laddr = socket.inet_ntop(socket.AF_INET, struct.pack("I", event.saddr))
-        raddr = socket.inet_ntop(socket.AF_INET, struct.pack("I", event.daddr))
-        snitch_pipe_0.send_bytes(pickle.dumps({"pid": pid, "name": event.comm.decode(), "fd": fd, "dev": st_dev, "ino": st_ino, "exe": exe, "cmdline": cmd,
-                                             "ppid": ppid, "pname": event.pcomm.decode(), "pfd": pfd, "pdev": pst_dev, "pino": pst_ino, "pexe": pexe, "pcmdline": pcmd,
-                                             "uid": event.uid, "send": event.bytes, "recv": 0, "lport": event.lport, "rport": event.dport, "laddr": laddr, "raddr": raddr, "domain": domain_dict[raddr]}))
-    def queue_sendv6_event(cpu, data, size):
-        event = b["sendmsg6_events"].event(data)
-        st_dev, st_ino, pid, fd, exe = get_fd(event.dev, event.ino, event.pid, event.dport)
-        pst_dev, pst_ino, ppid, pfd, pexe = get_fd(event.pdev, event.pino, event.ppid, -1)
-        cmd = get_cmdline(event.pid)
-        pcmd = get_cmdline(event.ppid)
-        laddr = socket.inet_ntop(socket.AF_INET6, event.saddr)
-        raddr = socket.inet_ntop(socket.AF_INET6, event.daddr)
-        snitch_pipe_1.send_bytes(pickle.dumps({"pid": pid, "name": event.comm.decode(), "fd": fd, "dev": st_dev, "ino": st_ino, "exe": exe, "cmdline": cmd,
-                                             "ppid": ppid, "pname": event.pcomm.decode(), "pfd": pfd, "pdev": pst_dev, "pino": pst_ino, "pexe": pexe, "pcmdline": pcmd,
-                                             "uid": event.uid, "send": event.bytes, "recv": 0, "lport": event.lport, "rport": event.dport, "laddr": laddr, "raddr": raddr, "domain": domain_dict[raddr]}))
-    def queue_recvv4_event(cpu, data, size):
-        event = b["recvmsg_events"].event(data)
-        st_dev, st_ino, pid, fd, exe = get_fd(event.dev, event.ino, event.pid, event.dport)
-        pst_dev, pst_ino, ppid, pfd, pexe = get_fd(event.pdev, event.pino, event.ppid, -1)
-        cmd = get_cmdline(event.pid)
-        pcmd = get_cmdline(event.ppid)
-        laddr = socket.inet_ntop(socket.AF_INET, struct.pack("I", event.saddr))
-        raddr = socket.inet_ntop(socket.AF_INET, struct.pack("I", event.daddr))
-        snitch_pipe_2.send_bytes(pickle.dumps({"pid": pid, "name": event.comm.decode(), "fd": fd, "dev": st_dev, "ino": st_ino, "exe": exe, "cmdline": cmd,
-                                             "ppid": ppid, "pname": event.pcomm.decode(), "pfd": pfd, "pdev": pst_dev, "pino": pst_ino, "pexe": pexe, "pcmdline": pcmd,
-                                             "uid": event.uid, "send": 0, "recv": event.bytes, "lport": event.lport, "rport": event.dport, "laddr": laddr, "raddr": raddr, "domain": domain_dict[raddr]}))
-    def queue_recvv6_event(cpu, data, size):
-        event = b["recvmsg6_events"].event(data)
-        st_dev, st_ino, pid, fd, exe = get_fd(event.dev, event.ino, event.pid, event.dport)
-        pst_dev, pst_ino, ppid, pfd, pexe = get_fd(event.pdev, event.pino, event.ppid, -1)
-        cmd = get_cmdline(event.pid)
-        pcmd = get_cmdline(event.ppid)
-        laddr = socket.inet_ntop(socket.AF_INET6, event.saddr)
-        raddr = socket.inet_ntop(socket.AF_INET6, event.daddr)
-        snitch_pipe_3.send_bytes(pickle.dumps({"pid": pid, "name": event.comm.decode(), "fd": fd, "dev": st_dev, "ino": st_ino, "exe": exe, "cmdline": cmd,
-                                             "ppid": ppid, "pname": event.pcomm.decode(), "pfd": pfd, "pdev": pst_dev, "pino": pst_ino, "pexe": pexe, "pcmdline": pcmd,
-                                             "uid": event.uid, "send": 0, "recv": event.bytes, "lport": event.lport, "rport": event.dport, "laddr": laddr, "raddr": raddr, "domain": domain_dict[raddr]}))
-    def queue_exec_event(cpu, data, size):
-        event = b["exec_events"].event(data)
-        st_dev, st_ino, pid, fd, exe = get_fd(event.dev, event.ino, event.pid, -1)
-        pst_dev, pst_ino, ppid, pfd, pexe = get_fd(event.pdev, event.pino, event.ppid, -1)
-        cmd = get_cmdline(event.pid)
-        pcmd = get_cmdline(event.ppid)
-        if EVERY_EXE:
-            snitch_pipe_4.send_bytes(pickle.dumps({"pid": pid, "name": event.comm.decode(), "fd": fd, "dev": st_dev, "ino": st_ino, "exe": exe, "cmdline": cmd,
-                                                 "ppid": ppid, "pname": event.pcomm.decode(), "pfd": pfd, "pdev": pst_dev, "pino": pst_ino, "pexe": pexe, "pcmdline": pcmd,
-                                                 "uid": event.uid, "send": 0, "recv": 0, "lport": -1, "rport": -1, "laddr": "", "raddr": "", "domain": ""}))
-    def queue_dns_event(cpu, data, size):
-        event = b["dns_events"].event(data)
-        if event.daddr:
-            ip = socket.inet_ntop(socket.AF_INET, struct.pack("I", event.daddr))
-        else:
-            ip = socket.inet_ntop(socket.AF_INET6, event.daddr6)
-        domain = event.host.decode("utf-8", "replace")
-        try:
-            _ = ipaddress.ip_address(domain)
-        except ValueError:
-            domain_dict[ip] = ".".join(reversed(domain.split(".")))
-    b["exec_events"].open_perf_buffer(queue_exec_event, page_cnt=PAGE_CNT, lost_cb=lambda *args: queue_lost("exec", *args))
-    if use_getaddrinfo_uprobe:
-        b["dns_events"].open_perf_buffer(queue_dns_event, page_cnt=PAGE_CNT, lost_cb=lambda *args: queue_lost("dns", *args))
-    b["sendmsg_events"].open_perf_buffer(queue_sendv4_event, page_cnt=PAGE_CNT*4, lost_cb=lambda *args: queue_lost("sendv4", *args))
-    b["sendmsg6_events"].open_perf_buffer(queue_sendv6_event, page_cnt=PAGE_CNT*4, lost_cb=lambda *args: queue_lost("sendv6", *args))
-    b["recvmsg_events"].open_perf_buffer(queue_recvv4_event, page_cnt=PAGE_CNT*4, lost_cb=lambda *args: queue_lost("recvv4", *args))
-    b["recvmsg6_events"].open_perf_buffer(queue_recvv6_event, page_cnt=PAGE_CNT*4, lost_cb=lambda *args: queue_lost("recvv6", *args))
-    # main loop
-    while True:
-        if not parent_process.is_alive() or not q_in.empty():
-            return 0
-        try:
-            b.perf_buffer_poll(timeout=-1)
-        except Exception as e:
-            q_error.put("BPF %s%s on line %s" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno))
-
-
-def virustotal_subprocess(config: dict, q_error, q_vt_pending, q_vt_results):
-    """get virustotal results of process executable"""
-    parent_process = multiprocessing.parent_process()
-    try:
-        import requests
-        vt_enabled = True
-    except ImportError:
-        vt_enabled = False
-    if not (config["VT API key"] and vt_enabled):
-        config["VT request limit (seconds)"] = 0
-    headers = {"x-apikey": config["VT API key"]}
-    def get_analysis(analysis_id: dict, sha256: str) -> dict:
-        api_url = "https://www.virustotal.com/api/v3/analyses/" + analysis_id["data"]["id"]
-        for i in range(90):
-            time.sleep(max(5, config["VT request limit (seconds)"]))
-            response = requests.get(api_url, headers=headers).json()
-            if response["data"]["attributes"]["status"] == "completed":
-                return response["data"]["attributes"]["stats"]
-        return {"timeout": api_url, "sha256": sha256}
-    while True:
-        if not parent_process.is_alive():
-            return 0
-        try:
-            time.sleep(config["VT request limit (seconds)"])
-            proc, analysis = None, None
-            proc, sha256 = pickle.loads(q_vt_pending.get(block=True, timeout=15))
-            suspicious = False
-            if config["VT API key"] and vt_enabled:
-                try:
-                    analysis = requests.get("https://www.virustotal.com/api/v3/files/" + sha256, headers=headers).json()
-                    analysis = analysis["data"]["attributes"]["last_analysis_stats"]
-                except Exception:
-                    if config["VT file upload"]:
-                        try:
-                            with open(proc["fd"], "rb") as f:
-                                assert (proc["dev"], proc["ino"]) == get_fstat(f.fileno())
-                                files = {"file": (proc["exe"], f)}
-                                analysis_id = requests.post("https://www.virustotal.com/api/v3/files", headers=headers, files=files).json()
-                            analysis = get_analysis(analysis_id, sha256)
-                        except Exception:
-                            try:
-                                readlink_exe_sha256 = hashlib.sha256()
-                                with open(proc["exe"], "rb") as f:
-                                    while data := f.read(1048576):
-                                        readlink_exe_sha256.update(data)
-                                assert readlink_exe_sha256.hexdigest() == sha256
-                                with open(proc["exe"], "rb") as f:
-                                    files = {"file": (proc["exe"], f)}
-                                    analysis_id = requests.post("https://www.virustotal.com/api/v3/files", headers=headers, files=files).json()
-                                analysis = get_analysis(analysis_id, sha256)
-                            except Exception:
-                                q_vt_results.put(pickle.dumps((proc, sha256, "Failed to read process for upload", suspicious)))
-                                continue
-                    else:
-                        # could also be an invalid api key
-                        q_vt_results.put(pickle.dumps((proc, sha256, "File not analyzed (analysis not found)", suspicious)))
-                        continue
-                if analysis["suspicious"] != 0 or analysis["malicious"] != 0:
-                    suspicious = True
-                q_vt_results.put(pickle.dumps((proc, sha256, str(analysis), suspicious)))
-            elif vt_enabled:
-                q_vt_results.put(pickle.dumps((proc, sha256, "File not analyzed (no api key)", suspicious)))
-            else:
-                q_vt_results.put(pickle.dumps((proc, sha256, "File not analyzed (requests library not found)", suspicious)))
-        except queue.Empty:
-            # have to timeout here to check whether to terminate otherwise this could stay hanging
-            # daemon=True flag for multiprocessing.Process does not work after root privileges are dropped for parent
-            pass
-        except Exception as e:
-            q_error.put("VT %s%s on line %s" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno))
-            try:
-                analysis = str(analysis)
-            except Exception:
-                analysis = "unknown analysis"
-            q_error.put("Last VT Exception on: %s with %s" % (str(proc), str(analysis)))
-
-
-def main_process(snitch: dict):
-    """coordinates all picosnitch subprocesses"""
-    # init fanotify
-    libc = ctypes.CDLL(ctypes.util.find_library("c"))
-    _FAN_CLASS_CONTENT = 0x4
-    _FAN_UNLIMITED_MARKS = 0x20
-    flags = _FAN_CLASS_CONTENT if FD_CACHE < 8192 else _FAN_CLASS_CONTENT | _FAN_UNLIMITED_MARKS
-    fan_fd = libc.fanotify_init(flags, os.O_RDONLY)
-    assert fan_fd >= 0, "fanotify_init() failed"
-    # start subprocesses
-    snitch_pipes = [multiprocessing.Pipe(duplex=False) for i in range(5)]
-    snitch_recv_pipes, snitch_send_pipes = zip(*snitch_pipes)
-    secondary_recv_pipe, secondary_send_pipe = multiprocessing.Pipe(duplex=False)
-    q_error = multiprocessing.Queue()
-    p_monitor = ProcessManager(name="snitchmonitor", target=monitor_subprocess,
-                               init_args=(snitch["Config"], fan_fd, snitch_send_pipes, q_error,))
-    p_rfuse = ProcessManager(name="snitchrfuse", target=rfuse_subprocess,
-                             init_args=(snitch["Config"], q_error,))
-    p_virustotal = ProcessManager(name="snitchvirustotal", target=virustotal_subprocess,
-                                  init_args=(snitch["Config"], q_error,))
-    p_primary = ProcessManager(name="snitchprimary", target=primary_subprocess,
-                               init_args=(snitch, snitch_recv_pipes, secondary_send_pipe, q_error,))
-    p_secondary = ProcessManager(name="snitchsecondary", target=secondary_subprocess,
-                           init_args=(snitch, fan_fd, p_rfuse, p_virustotal, secondary_recv_pipe, p_primary.q_in, q_error,))
-    # set signals
-    subprocesses = [p_monitor, p_rfuse, p_virustotal, p_primary, p_secondary]
-    def clean_exit():
-        _ = [p.terminate() for p in subprocesses]
-        sys.exit(0)
-    signal.signal(signal.SIGINT, lambda *args: clean_exit())
-    signal.signal(signal.SIGTERM, lambda *args: clean_exit())
-    # watch subprocesses
-    suspend_check_last = time.time()
-    try:
-        while True:
-            time.sleep(5)
-            if not all(p.is_alive() for p in subprocesses):
-                dead = " ".join([p.name for p in subprocesses if not p.is_alive()])
-                q_error.put(f"picosnitch subprocess died, attempting restart, terminate by running `picosnitch stop` ({dead})")
-                break
-            if any(p.is_zombie() for p in subprocesses):
-                zombies = " ".join([p.name for p in subprocesses if p.is_zombie()])
-                q_error.put(f"picosnitch subprocess became a zombie, attempting restart ({zombies})")
-                break
-            if sum(p.memory() for p in subprocesses) > 4096000000:
-                q_error.put("picosnitch memory usage exceeded 4096 MB, attempting restart")
-                break
-            suspend_check_now = time.time()
-            if suspend_check_now - suspend_check_last > 20:
-                p_monitor.q_in.put("terminate")
-                p_monitor.terminate()
-                _ = p_monitor.q_in.get()
-                p_monitor.start()
-            suspend_check_last = suspend_check_now
-    except Exception as e:
-        q_error.put("picosnitch subprocess exception: %s%s on line %s" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno))
-    if sys.argv[1] == "start-no-daemon":
-        return 1
-    # attempt to restart picosnitch (terminate by running `picosnitch stop`)
-    time.sleep(5)
-    _ = [p.terminate() for p in subprocesses]
-    args = [sys.executable, os.path.abspath(__file__), "restart"]
-    subprocess.Popen(args)
-    return 0
-
-
-### user interface
-def ui_geoip():
-    """init a geoip2 reader and return it (along with updating geoip db), or None if not available"""
-    with open(os.path.join(BASE_PATH, "config.json"), "r", encoding="utf-8", errors="surrogateescape") as json_file:
-        if not json.load(json_file)["GeoIP lookup"]:
-            return None
-    try:
-        import geoip2.database
-        # download latest database if out of date or does not exist, then create geoip_reader
-        geoip_mmdb = os.path.join(BASE_PATH, "dbip-country-lite.mmdb")
-        geoip_url = datetime.datetime.now().strftime("https://download.db-ip.com/free/dbip-country-lite-%Y-%m.mmdb.gz")
-        if not os.path.isfile(geoip_mmdb) or datetime.datetime.fromtimestamp(os.path.getmtime(geoip_mmdb)).strftime("%Y%m") != datetime.datetime.now().strftime("%Y%m"):
-            try:
-                import urllib.request
-                try:
-                    request = urllib.request.Request(geoip_url, headers={'User-Agent': 'Mozilla/5.0'})
-                    with urllib.request.urlopen(request) as response, open(geoip_mmdb + ".gz", "wb") as f:
-                        f.write(response.read())
-                except Exception:
-                    # try previous month if current month is not available
-                    geoip_url = (datetime.datetime.now() - datetime.timedelta(days=30)).strftime("https://download.db-ip.com/free/dbip-country-lite-%Y-%m.mmdb.gz")
-                    request = urllib.request.Request(geoip_url, headers={'User-Agent': 'Mozilla/5.0'})
-                    with urllib.request.urlopen(request) as response, open(geoip_mmdb + ".gz", "wb") as f:
-                        f.write(response.read())
-                import gzip
-                with gzip.open(geoip_mmdb + ".gz", "rb") as f_in, open(geoip_mmdb, "wb") as f_out:
-                    f_out.write(f_in.read())
-                os.remove(geoip_mmdb + ".gz")
-            except Exception:
-                if not os.path.isfile(geoip_mmdb):
-                    raise Exception("Could not download GeoIP database")
-                print("Could not update GeoIP database, using old version", file=sys.stderr)
-        return geoip2.database.Reader(geoip_mmdb)
-    except Exception:
-        return None
-
-
-def ui_loop(stdscr: curses.window, splash: str) -> int:
-    """for curses wrapper"""
-    # thread for querying database
-    file_path = os.path.join(BASE_PATH, "snitch.db")
-    q_query_results = queue.Queue()
-    kill_thread_query = threading.Event()
-    def fetch_query_results(current_query: str, q_query_results: queue.Queue, kill_thread_query: threading.Event):
-        con = sqlite3.connect(file_path, timeout=1)
-        cur = con.cursor()
-        while True and not kill_thread_query.is_set():
-            try:
-                cur.execute(current_query)
-                break
-            except sqlite3.OperationalError:
-                time.sleep(0.5)
-        results = cur.fetchmany(25)
-        while results and not kill_thread_query.is_set():
-            q_query_results.put(results)
-            results = cur.fetchmany(25)
-        con.close()
-    thread_query = threading.Thread()
-    thread_query.start()
-    # init and splash screen
-    curses.cbreak()
-    curses.noecho()
-    curses.curs_set(0)
-    curses.start_color()
-    curses.use_default_colors()
-    curses.init_pair(1, curses.COLOR_WHITE, curses.COLOR_CYAN)  # selection
-    curses.init_pair(2, curses.COLOR_YELLOW, -1)  # splash
-    curses.init_pair(3, curses.COLOR_WHITE, curses.COLOR_MAGENTA)  # header
-    curses.init_pair(4, curses.COLOR_WHITE, -1)  # splash
-    splash_lines = splash.splitlines()
-    stdscr.clear()
-    for i in range(len(splash_lines)):
-        if "\u001b[33m" in splash_lines[i]:
-            part1 = splash_lines[i].split("\u001b[33m")
-            part2 = part1[1].split("\033[0m")
-            stdscr.addstr(i, 0, part1[0], curses.color_pair(4))
-            stdscr.addstr(i, len(part1[0]), part2[0], curses.color_pair(2))
-            stdscr.addstr(i, len(part1[0]) + len(part2[0]), part2[1], curses.color_pair(4))
-        else:
-            stdscr.addstr(i, 0, splash_lines[i])
-    stdscr.refresh()
-    # time lookup functions
-    # time_i is the index of the time period, time_j is the number of time period steps to go back
-    # time_i=0 means all records and time_j=0 means current time (no rounding), due to rounding for time_j>0, time_j=1 may extend partially into the future
-    time_i = 0
-    time_j = 0
-    time_period = ["all", "1 minute", "3 minutes", "5 minutes", "10 minutes", "15 minutes", "30 minutes", "1 hour", "3 hours", "6 hours", "12 hours", "1 day", "3 days", "7 days", "30 days", "365 days"]
-    time_minutes = [0, 1, 3, 5, 10, 15, 30, 60, 180, 360, 720, 1440, 4320, 10080, 43200, 525600]
-    time_deltas = [datetime.timedelta(minutes=x) for x in time_minutes]
-    time_round_units = ["second"] + ["minute"]*6 + ["hour"]*4 + ["day"]*3 + ["month"] + ["year"]
-    time_round_functions = collections.OrderedDict({
-        "second": lambda x: x.replace(microsecond=0),
-        "minute": lambda x: x.replace(microsecond=0, second=0),
-        "hour": lambda x: x.replace(microsecond=0, second=0, minute=0),
-        "day": lambda x: x.replace(microsecond=0, second=0, minute=0, hour=0),
-        "month": lambda x: x.replace(microsecond=0, second=0, minute=0, hour=0, day=1),
-        "year": lambda x: x.replace(microsecond=0, second=0, minute=0, hour=0, day=1, month=1),
-    })
-    time_round_func = lambda resolution_index, time: time_round_functions[time_round_units[resolution_index]](time)
-    # geoip lookup
-    geoip_reader = ui_geoip()
-    def get_geoip(ip: str) -> str:
-        try:
-            country_code = geoip_reader.country(ip).country.iso_code
-            base = 0x1f1e6 - ord("A")
-            # country_flag = chr(base + ord(country_code[0].upper())) + chr(base + ord(country_code[1].upper()))  # flags aren't supported in most fonts and terminals, disable for now
-            return f"{country_code} {ip}"
-        except Exception:
-            try:
-                if ipaddress.ip_address(ip).is_private:
-                    return f"{chr(0x1f3e0)}{chr(0x200b)} {ip}"  # home emoji + ZWSP so line length is counted correctly
-                else:
-                    return f"{chr(0x1f310)}{chr(0x200b)} {ip}"  # globe emoji + ZWSP so line length is counted correctly
-            except Exception:
-                return f"{chr(0x2753)}{chr(0x200b)} {ip}"  # question emoji + ZWSP so line length is counted correctly
-    # screens from queries (exe text, name text, cmdline text, sha256 text, contime text, domain text, ip text, port integer, uid integer)
-    tab_i = 0
-    tab_names = ["Executables", "Process Names", "Commands", "SHA256", "Parent Executables", "Parent Names", "Parent Commands", "Parent SHA256", "Users", "Local Ports", "Remote Ports", "Local Addresses", "Remote Addresses", "Domains", "Entry Time"]
-    col_names = ["Executable", "Process Name", "Command", "SHA256", "Parent Executable", "Parent Name", "Parent Command", "Parent SHA256", "User", "Local Port", "Remote Port", "Local Address", "Remote Address", "Domain", "Entry Time"]
-    col_sql = ["exe", "name", "cmdline", "sha256", "pexe", "pname", "pcmdline", "psha256", "uid", "lport", "rport", "laddr", "raddr", "domain", "contime"]
-    tab_stack = []
-    byte_units = 3
-    round_bytes = lambda size, b: f"{size if b == 0 else round(size/10**b, 1)!s:>{8 if b == 0 else 7}} {'k' if b == 3 else 'M' if b == 6 else 'G' if b == 9 else ''}B"
-    # ui loop
-    max_y, max_x = stdscr.getmaxyx()
-    first_line = 4
-    cursor, line = first_line, first_line
-    filter_values = []
-    filter_exclude = []
-    add_filter = False
-    add_filter_exclude = False
-    update_time = True
-    update_query = True
-    execute_query = True
-    running_query = False
-    current_query, current_screen = "", [""]
-    vt_status = collections.defaultdict(str)
-    while True:
-        # adjust cursor
-        tab_i %= len(col_sql)
-        time_i %= len(time_period)
-        if time_j < 0 or time_i == 0:
-            time_j = 0
-        cursor %= line
-        if cursor < first_line:
-            cursor = first_line
-        # generate screen
-        if update_query:
-            if time_j == 0:
-                time_history_start = (datetime.datetime.now() - time_deltas[time_i]).strftime("%Y-%m-%d %H:%M:%S")
-                time_history_end = "now"
-                time_history = time_round_functions["second"](datetime.datetime.now())
-            elif time_i != 0:
-                if update_time:
-                    time_history_start = time_round_func(time_i, datetime.datetime.now() - time_deltas[time_i] * (time_j-1)).strftime("%Y-%m-%d %H:%M:%S")
-                    time_history_end = time_round_func(time_i, datetime.datetime.now() - time_deltas[time_i] * (time_j-2)).strftime("%Y-%m-%d %H:%M:%S")
-                    time_history = f"{time_history_start} -> {time_history_end}"
-                    update_time = False
-            if time_i == 0:
-                time_query = ""
-            else:
-                if tab_stack:
-                    time_query = f" AND contime > datetime(\"{time_history_start}\") AND contime < datetime(\"{time_history_end}\")"
-                else:
-                    time_query = f" WHERE contime > datetime(\"{time_history_start}\") AND contime < datetime(\"{time_history_end}\")"
-            if tab_stack:
-                filter_query = " AND ".join(f"{col_sql[i]} IS {exclude}\"{value}\"" for i, exclude, value in zip(tab_stack, filter_exclude, filter_values))
-                current_query = f"SELECT {col_sql[tab_i]}, SUM(send), SUM(recv) FROM connections WHERE {filter_query}{time_query} GROUP BY {col_sql[tab_i]}"
-            else:
-                current_query = f"SELECT {col_sql[tab_i]}, SUM(send), SUM(recv) FROM connections{time_query} GROUP BY {col_sql[tab_i]}"
-            update_query = False
-        if execute_query:
-            current_screen = []
-            # kill old thread with flag, may still be executing current query so don't wait for join, just let gc handle it
-            kill_thread_query.set()
-            while not q_query_results.empty():
-                _ = q_query_results.get_nowait()
-            # start new thread, reinitialize queue and kill flag
-            q_query_results = queue.Queue()
-            kill_thread_query = threading.Event()
-            thread_query = threading.Thread(target=fetch_query_results, args=(current_query, q_query_results, kill_thread_query), daemon=True)
-            thread_query.start()
-            # check daemon pid for status bar
-            try:
-                with open("/run/picosnitch.pid", "r") as f:
-                    run_status = "pid: " + f.read().strip()
-            except Exception:
-                run_status = "not running"
-            print(f"\033]0;picosnitch v{VERSION} ({run_status})\a", end="", flush=True)
-            # check if any new virustotal results
-            try:
-                with open(os.path.join(BASE_PATH, "record.json"), "r") as f:
-                    sha256_record = json.load(f)["SHA256"]
-                for exe, hashes in sha256_record.items():
-                    for sha256, status in hashes.items():
-                        if sha256 not in vt_status:
-                            if "harmless" in status:
-                                suspicious = status.split("'suspicious': ")[1].split(",")[0]
-                                malicious = status.split("'malicious': ")[1].split(",")[0]
-                                if suspicious == "0" and malicious == "0":
-                                    vt_status[sha256] = " (clean)"
-                                else:
-                                    vt_status[sha256] = " (suspicious)"
-            except Exception:
-                pass
-            # check if any query results are ready
-            if not q_query_results.empty():
-                current_screen += q_query_results.get_nowait()
-            sum_send = sum(b for _, b, _ in current_screen)
-            sum_recv = sum(b for _, _, b in current_screen)
-            execute_query = False
-            running_query = True
-        # update headers for screen
-        help_bar = f"f/F: filter  e/E: exclude  h/H: history  t/T: time  u/U: units  r: refresh  q: quit {' ':<{curses.COLS}}"
-        status_bar = f"history: {time_history}  time: {time_period[time_i]}  line: {min(cursor-first_line+1, len(current_screen))}/{len(current_screen)}  totals: {round_bytes(sum_send, byte_units).strip()} / {round_bytes(sum_recv, byte_units).strip()}{' ':<{curses.COLS}}"
-        if tab_stack:
-            l_tabs = " | ".join(reversed([tab_names[tab_i-i] for i in range (1, len(tab_names))]))
-            r_tabs = " | ".join([tab_names[(tab_i+i) % len(tab_names)] for i in range(1, len(tab_names))])
-            c_tab = tab_names[tab_i]
-            filter_query = " & ".join(f"{col_names[i].lower()} {exclude.replace('NOT ', '!')}= \"{value}\"" for i, exclude, value in zip(tab_stack, filter_exclude, filter_values))
-            column_names = f"{f'{col_names[tab_i]} (where {filter_query})':<{curses.COLS - 29}.{curses.COLS - 29}}          Sent       Received"
-        else:
-            l_tabs = " | ".join(reversed([tab_names[tab_i-i] for i in range(1, len(tab_names))]))
-            r_tabs = " | ".join([tab_names[(tab_i+i) % len(tab_names)] for i in range(1, len(tab_names))])
-            c_tab = tab_names[tab_i]
-            column_names = f"{col_names[tab_i]:<{curses.COLS - 29}}          Sent       Received"
-        edges_width = len("<- ... |  | ... ->")
-        l_width = (curses.COLS - len(c_tab) - edges_width) // 2
-        r_width = curses.COLS - len(c_tab) - edges_width - l_width
-        l_tabs = f" ...{l_tabs[-l_width:]:>{l_width}} | "
-        r_tabs = f" | {r_tabs:<{r_width}.{r_width}}... "
-        # display headers on screen
-        stdscr.clear()
-        stdscr.attrset(curses.color_pair(3) | curses.A_BOLD)
-        stdscr.addstr(0, 0, help_bar)
-        stdscr.addstr(1, 0, status_bar)
-        stdscr.addstr(2, 0, "<-")
-        stdscr.addstr(2, 2, l_tabs, curses.color_pair(3))
-        stdscr.addstr(2, 2 + len(l_tabs), c_tab, curses.color_pair(3) | curses.A_BOLD | curses.A_UNDERLINE)
-        stdscr.addstr(2, 2 + len(l_tabs) + len(c_tab), r_tabs, curses.color_pair(3))
-        stdscr.addstr(2, 2 + len(l_tabs) + len(c_tab) + len(r_tabs), "->")
-        stdscr.addstr(3, 0, column_names)
-        # display query results on screen
-        line = first_line
-        cursor = min(cursor, len(current_screen) + first_line - 1)
-        offset = max(0, cursor - curses.LINES + 3)
-        for name, send, recv in current_screen:
-            if line == cursor:
-                stdscr.attrset(curses.color_pair(1) | curses.A_BOLD)
-                # if space/enter was pressed on previous loop, check current line to update filter
-                if add_filter:
-                    tab_stack.append(tab_i)
-                    filter_values.append(name)
-                    if add_filter_exclude:
-                        filter_exclude.append("NOT ")
-                    else:
-                        filter_exclude.append("")
-                    add_filter_exclude = False
-                    break
-            else:
-                stdscr.attrset(curses.color_pair(0))
-            if first_line <= line - offset < curses.LINES - 1:
-                # special cases (cmdline null chars, uid, ip, sha256 and vt results)
-                if type(name) == str:
-                    name = name.replace("\0", "")
-                elif col_sql[tab_i] == "uid":
-                    try:
-                        name = f"{pwd.getpwuid(name).pw_name} ({name})"
-                    except Exception:
-                        name = f"??? ({name})"
-                if col_sql[tab_i] == "raddr":
-                    name = get_geoip(name)
-                if col_sql[tab_i].endswith("sha256"):
-                    name = f"{name}{vt_status[name]}"
-                value = f"{round_bytes(send, byte_units):>14.14} {round_bytes(recv, byte_units):>14.14}"
-                stdscr.addstr(line - offset, 0, f"{name!s:<{curses.COLS-29}.{curses.COLS-29}}{value}")
-            line += 1
-        stdscr.refresh()
-        # if space/enter was pressed on previous loop, continue loop with updated filter to execute new query
-        if add_filter:
-            add_filter = False
-            update_query = True
-            execute_query = True
-            continue
-        # check for any new query results while waiting for user input
-        if running_query:
-            if not thread_query.is_alive():
-                running_query = False
-            stdscr.nodelay(True)
-            new_results = False
-            while True:
-                try:
-                    current_screen += q_query_results.get(timeout=0.01)
-                    new_results = True
-                except queue.Empty:
-                    ch = stdscr.getch()
-                    if ch != -1:
-                        break
-                    if new_results:
-                        sum_send = sum(b for _, b, _ in current_screen)
-                        sum_recv = sum(b for _, _, b in current_screen)
-                        break
-            stdscr.nodelay(False)
-        else:
-            ch = stdscr.getch()
-        # process user input
-        if ch == ord("\n") or ch == ord(" ") or ch == ord("f"):
-            add_filter = True
-        if ch == ord("e"):
-            add_filter = True
-            add_filter_exclude = True
-        elif ch == curses.KEY_BACKSPACE or ch == ord("F") or ch == ord("E"):
-            if tab_stack:
-                tab_i = tab_stack.pop()
-                _ = filter_values.pop()
-                _ = filter_exclude.pop()
-            update_query = True
-            execute_query = True
-        elif ch == ord("r"):
-            update_time = True
-            update_query = True
-            execute_query = True
-        elif ch == ord("t"):
-            time_j = 0
-            time_i += 1
-            update_query = True
-            execute_query = True
-        elif ch == ord("T"):
-            time_j = 0
-            time_i -= 1
-            update_query = True
-            execute_query = True
-        elif ch == ord("h"):
-            time_j += 1
-            update_time = True
-            update_query = True
-            execute_query = True
-        elif ch == ord("H"):
-            time_j -= 1
-            update_time = True
-            update_query = True
-            execute_query = True
-        elif ch == ord("u"):
-            byte_units = (byte_units + 3) % 12
-        elif ch == ord("U"):
-            byte_units = (byte_units - 3) % 12
-        elif ch == curses.KEY_UP:
-            cursor -= 1
-            if cursor < first_line:
-                cursor = -1
-        elif ch == curses.KEY_DOWN:
-            cursor += 1
-        elif ch == curses.KEY_PPAGE:
-            cursor -= curses.LINES
-            if cursor < first_line:
-                cursor = first_line
-        elif ch == curses.KEY_NPAGE:
-            cursor += curses.LINES
-            if cursor >= line:
-                cursor = line - 1
-        elif ch == curses.KEY_HOME:
-            cursor = first_line
-        elif ch == curses.KEY_END:
-            cursor = len(current_screen) + first_line - 1
-        elif ch == curses.KEY_LEFT:
-            tab_i -= 1
-            update_query = True
-            execute_query = True
-        elif ch == curses.KEY_RIGHT:
-            tab_i += 1
-            update_query = True
-            execute_query = True
-        elif ch == curses.KEY_RESIZE and curses.is_term_resized(max_y, max_x):
-            max_y, max_x = stdscr.getmaxyx()
-            stdscr.clear()
-            curses.resizeterm(max_y, max_x)
-            stdscr.refresh()
-            cursor = first_line
-        elif ch == 27 or ch == ord("q"):
-            return 0
-
-
-def ui_init() -> int:
-    """init curses ui"""
-    splash = textwrap.dedent("""
-        @@&@@                                                              @@@@,
-      &&.,,. &&&&&&%&%&&&&&&&&(..                      ..&&%&%&&&&&&&&%&&&&  .,#&%
-        ,,/%#/(....,.,/(.  ...*,,%%                  %#*,..,... // ...,..//#%*,
-             @@@@@@#((      #(/    @@  %@@@@@@@@  /@@    #(,      ##@@&@@@@
-                   %@&    #(  .      @@\u001b[33m/********\033[0m@@(        (((    @@
-                     .@@((    ,    @@\u001b[33m.,*,,****,,,,\033[0m(@@      . .#(@@
-                        @@@@@@&@@@@@@\u001b[33m,,*,,,,,,,,,,\033[0m(@@@@@@@@&@@@@
-                                   @@\u001b[33m**/*/*,**///*\033[0m(@@
-                                   @@\u001b[33m.****/*//,*,*\033[0m/@@
-                                     @&\u001b[33m//*////,/\033[0m&&(
-                                       ,*\u001b[33m,,,,,,\033[0m,
-
-    Loading database ...
-    """)
-    # init sql connection
-    file_path = os.path.join(BASE_PATH, "snitch.db")
-    con = sqlite3.connect(file_path, timeout=15)
-    # check for table
-    cur = con.cursor()
-    cur.execute(''' PRAGMA user_version ''')
-    assert cur.fetchone()[0] == 3, f"Incorrect database version of snitch.db for picosnitch v{VERSION}"
-    con.close()
-    # start curses
-    for err_count in reversed(range(30)):
-        try:
-            return curses.wrapper(ui_loop, splash)
-        except curses.error:
-            print("CURSES DISPLAY ERROR: try resizing your terminal, ui will close in %s seconds" % (err_count + 1), file=sys.stderr)
-            time.sleep(1)
-    return 1
-
-
-def ui_dash():
-    """gui with plotly dash"""
-    site.addsitedir(os.path.expanduser(f"~/.local/pipx/venvs/dash/lib/python{sys.version_info.major}.{sys.version_info.minor}/site-packages"))
-    site.addsitedir(os.path.expandvars(f"$PIPX_HOME/venvs/dash/lib/python{sys.version_info.major}.{sys.version_info.minor}/site-packages"))
-    site.addsitedir(os.path.expanduser(f"~/.local/pipx/venvs/dash-bootstrap-components/lib/python{sys.version_info.major}.{sys.version_info.minor}/site-packages"))
-    site.addsitedir(os.path.expandvars(f"$PIPX_HOME/venvs/dash-bootstrap-components/lib/python{sys.version_info.major}.{sys.version_info.minor}/site-packages"))
-    site.addsitedir(os.path.expanduser(f"~/.local/pipx/venvs/dash-bootstrap-templates/lib/python{sys.version_info.major}.{sys.version_info.minor}/site-packages"))
-    site.addsitedir(os.path.expandvars(f"$PIPX_HOME/venvs/dash-bootstrap-templates/lib/python{sys.version_info.major}.{sys.version_info.minor}/site-packages"))
-    site.addsitedir(os.path.expanduser(f"~/.local/pipx/venvs/geoip2/lib/python{sys.version_info.major}.{sys.version_info.minor}/site-packages"))
-    site.addsitedir(os.path.expandvars(f"$PIPX_HOME/venvs/geoip2/lib/python{sys.version_info.major}.{sys.version_info.minor}/site-packages"))
-    from dash import Dash, dcc, html, callback_context, no_update
-    from dash.dependencies import Input, Output, State
-    from dash.exceptions import PreventUpdate
-    import pandas as pd
-    import pandas.io.sql as psql
-    import plotly.express as px
-    with open(os.path.join(BASE_PATH, "config.json"), "r", encoding="utf-8", errors="surrogateescape") as json_file:
-        config = json.load(json_file)
-    file_path = os.path.join(BASE_PATH, "snitch.db")
-    all_dims = ["exe", "name", "cmdline", "sha256", "uid", "lport", "rport", "laddr", "raddr", "domain", "pexe", "pname", "pcmdline", "psha256"]
-    dim_labels = {"exe": "Executable", "name": "Process Name", "cmdline": "Command", "sha256": "SHA256", "uid": "User", "lport": "Local Port", "rport": "Remote Port", "laddr": "Local Address", "raddr": "Remote Address", "domain": "Domain", "pexe": "Parent Executable", "pname": "Parent Name", "pcmdline": "Parent Command", "psha256": "Parent SHA256"}
-    time_period = ["all", "1 minute", "3 minutes", "5 minutes", "10 minutes", "15 minutes", "30 minutes", "1 hour", "3 hours", "6 hours", "12 hours", "1 day", "3 days", "7 days", "30 days", "365 days"]
-    time_minutes = [0, 1, 3, 5, 10, 15, 30, 60, 180, 360, 720, 1440, 4320, 10080, 43200, 525600]
-    time_deltas = [datetime.timedelta(minutes=x) for x in time_minutes]
-    time_round_units = ["second"] + ["minute"]*6 + ["hour"]*4 + ["day"]*3 + ["month"] + ["year"]
-    time_round_functions = collections.OrderedDict({
-        "second": lambda x: x.replace(microsecond=0),
-        "minute": lambda x: x.replace(microsecond=0, second=0),
-        "hour": lambda x: x.replace(microsecond=0, second=0, minute=0),
-        "day": lambda x: x.replace(microsecond=0, second=0, minute=0, hour=0),
-        "month": lambda x: x.replace(microsecond=0, second=0, minute=0, hour=0, day=1),
-        "year": lambda x: x.replace(microsecond=0, second=0, minute=0, hour=0, day=1, month=1),
-    })
-    time_round_func = lambda resolution_index, time: time_round_functions[time_round_units[resolution_index]](time)
-    geoip_reader = ui_geoip()
-    def get_user(uid) -> str:
-        try:
-            return f"{pwd.getpwuid(uid).pw_name} ({uid})"
-        except Exception:
-            return f"??? ({uid})"
-    def get_totals(df_sum, dim) -> str:
-        size = df_sum[dim]
-        if size > 10**9:
-            return f"{dim} ({round(size/10**9, 2)!s} GB)"
-        elif size > 10**6:
-            return f"{dim} ({round(size/10**6, 2)!s} MB)"
-        elif size > 10**3:
-            return f"{dim} ({round(size/10**3, 2)!s} kB)"
-        else:
-            return f"{dim} ({size!s} B)"
-    def get_geoip(ip: str) -> str:
-        try:
-            country_code = geoip_reader.country(ip).country.iso_code
-            base = 0x1f1e6 - ord("A")
-            country_flag = chr(base + ord(country_code[0].upper())) + chr(base + ord(country_code[1].upper()))
-            return f"{ip} ({country_flag}{country_code})"
-        except Exception:
-            try:
-                if ipaddress.ip_address(ip).is_private:
-                    return f"{ip} ({chr(0x1f3e0)})"  # home emoji
-                else:
-                    return f"{ip} ({chr(0x1f310)})"  # globe emoji
-            except Exception:
-                return f"{ip} ({chr(0x2753)})"  # question emoji
-    def trim_label(label, trim) -> str:
-        if trim and len(label) > 64:
-            return f"{label[:32]}...{label[-29:]}"
-        return label
-    def serve_layout():
-        try:
-            with open("/run/picosnitch.pid", "r") as f:
-                run_status = "pid: " + f.read().strip()
-        except Exception:
-            run_status = "not running"
-        return html.Div([
-            dcc.Interval(
-                id="interval-component",
-                interval=10000,
-                disabled=True,
-            ),
-            html.Div(html.Button("Stop Dash", id="exit", className="btn btn-primary btn-sm mt-1"), style={"float": "right"}),
-            html.Div([
-                dcc.Dropdown(
-                    id="resampling",
-                    options=[
-                        {"label": "Resampling (100 points)", "value": 100},
-                        {"label": "Resampling (500 points)", "value": 500},
-                        {"label": "Resampling (1000 points)", "value": 1000},
-                        {"label": "Resampling (2000 points)", "value": 2000},
-                        {"label": "Resampling (3000 points)", "value": 3000},
-                        {"label": "Resampling (4000 points)", "value": 4000},
-                        {"label": "Resampling (5000 points)", "value": 5000},
-                        {"label": "Resampling (10000 points)", "value": 10000},
-                        {"label": "Resampling (None)", "value": False},
-                    ],
-                    value=2000,
-                    clearable=False,
-                ),
-            ], style={"display":"inline-block", "width": "15%"}),
-            html.Div([
-                dcc.Dropdown(
-                    id="smoothing",
-                    options=[
-                        {"label": "Rolling Window (2 points)", "value": 2},
-                        {"label": "Rolling Window (4 points)", "value": 4},
-                        {"label": "Rolling Window (8 points)", "value": 8},
-                        {"label": "Rolling Window (None)", "value": False},
-                    ],
-                    value=4,
-                    clearable=False,
-                ),
-            ], style={"display":"inline-block", "width": "15%"}),
-            html.Div([
-                dcc.Dropdown(
-                    id="trim-labels",
-                    options=[
-                        {"label": "Trim Long Labels (64 chars)", "value": True},
-                        {"label": "Show Full Labels", "value": False},
-                    ],
-                    value=True,
-                    clearable=False,
-                ),
-            ], style={"display":"inline-block", "width": "15%"}),
-            html.Div([
-                dcc.Dropdown(
-                    id="auto-refresh",
-                    options=[
-                        {"label": "Disable Auto-Refresh", "value": 0},
-                        {"label": "Auto-Refresh (1 second)", "value": 1},
-                        {"label": "Auto-Refresh (5 seconds)", "value": 5},
-                        {"label": "Auto-Refresh (10 seconds)", "value": 10},
-                        {"label": "Auto-Refresh (30 seconds)", "value": 30},
-                        {"label": "Auto-Refresh (1 minute)", "value": 60},
-                        {"label": "Auto-Refresh (5 minutes)", "value": 300},
-                        {"label": "Auto-Refresh (10 minutes)", "value": 600},
-                    ],
-                    value=0,
-                    clearable=False,
-                ),
-            ], style={"display":"inline-block", "width": "15%"}),
-            html.Div(),
-            html.Div([
-                dcc.Dropdown(
-                    id="select",
-                    options=[{"label": f"Select {dim_labels[x]}", "value": x} for x in all_dims],
-                    value="exe",
-                    clearable=False,
-                ),
-            ], style={"display":"inline-block", "width": "33%"}),
-            html.Div([
-                dcc.Dropdown(
-                    id="where",
-                    options=[{"label": f"Where {dim_labels[x]}", "value": x} for x in all_dims],
-                    placeholder="Where...",
-                ),
-            ], style={"display":"inline-block", "width": "33%"}),
-            html.Div([
-                dcc.Dropdown(
-                    id="whereis",
-                    placeholder="Is...",
-                ),
-            ], style={"display":"inline-block", "width": "33%"}),
-            html.Div([
-                dcc.RadioItems(
-                    id="time_i",
-                    options=[{"label": time_period[i], "value": i} for i in range(len(time_period))],
-                    value=8,
-                    inline=True,
-                ),
-            ]),
-            html.Div([
-                dcc.Slider(
-                    id="time_j",
-                    min=0, max=100, step=1, value=0,
-                    included=False,
-                ),
-                html.Div(id="selected_time_range", style={"border": "1px solid #ccc", "padding": "5px", "text-align": "center"}),
-            ]),
-            dcc.Store(id="store_time", data={"time_i": 8}),
-            dcc.Store(id="store_send", data={"rev": 0, "visible": {}}),
-            dcc.Store(id="store_recv", data={"rev": 0, "visible": {}}),
-            dcc.Graph(id="send", config={"scrollZoom": config["Dash scroll zoom"]}),
-            dcc.Graph(id="recv", config={"scrollZoom": config["Dash scroll zoom"]}),
-            html.Footer(f"picosnitch v{VERSION} ({run_status}) (using {file_path})"),
-        ])
-    try:
-        # try to use dash-bootstrap-components if available and theme exists
-        import dash_bootstrap_components as dbc
-        from dash_bootstrap_templates import load_figure_template
-        load_figure_template(config["Dash theme"].lower())
-        app = Dash(__name__, external_stylesheets=[getattr(dbc.themes, config["Dash theme"].upper())])
-    except Exception:
-        app = Dash(__name__)
-    app.layout = serve_layout
-    @app.callback(Output("interval-component", "disabled"), Output("interval-component", "interval"), Input("auto-refresh", "value"))
-    def toggle_refresh(value):
-        return value == 0, 1000 * value
-    @app.callback(Output("time_j", "value"), Output("store_time", "data"), Input("time_i", "value"), Input("time_j", "value"), Input("store_time", "data"))
-    def update_time_slider_pos(time_i, time_j, store_time):
-        # only trigger on time_i change
-        if not callback_context.triggered:
-            raise PreventUpdate
-        elif time_i == 0 or time_j == 0:
-            # time_i is "all", so time_j should be current, or time_j is current so time_i store just needs updating
-            return 0, {"time_i": time_i}
-        elif store_time["time_i"] == 0:
-            # time_i was "all", so don't change time_j
-            return no_update, {"time_i": time_i}
-        elif time_j != 0 and time_i != store_time["time_i"]:
-            # time_i changed and time_j is not current time, so scale time_j to new time_i
-            # get the old time end offset (smaller value, closer to present time) in minutes, and use to scale to new time_j
-            old_minute_end_offset = (time_j - 2) * time_minutes[store_time["time_i"]]
-            if store_time["time_i"] > time_i:
-                # new time_i is smaller, time_j is larger, and should be slightly after the old time_j to fall between start (earlier) and end (later)
-                new_time_j = math.ceil(old_minute_end_offset / time_minutes[time_i]) + 2
-            else:
-                # new time_i is larger, ..., should be slightly before the old time_j so the entire old period is mostly within the new period
-                new_time_j = math.floor(old_minute_end_offset / time_minutes[time_i]) + 2
-            return max(0, min(100, new_time_j)), {"time_i": time_i}
-        raise PreventUpdate
-    @app.callback(Output("time_j", "marks"), Input("time_i", "value"), Input("time_j", "value"), Input("interval-component", "n_intervals"))
-    def update_time_slider_marks(time_i, time_j, _):
-        return {x: time_round_func(time_i, datetime.datetime.now() - time_deltas[time_i] * (x-2)).strftime("%Y-%m-%d T %H:%M:%S") for x in range(2,100,10)}
-    @app.callback(Output("selected_time_range", "children"), Input("time_i", "value"), Input("time_j", "value"), Input("interval-component", "n_intervals"))
-    def display_time_range(time_i, time_j, _):
-        # may switch later to handleLabel with dash-daq https://dash.plotly.com/dash-core-components/slider https://dash.plotly.com/dash-daq/slider#handle-label
-        # time_i is the index of the time period, time_j is the number of time period steps to go back
-        # time_i=0 means all records and time_j=0 means current time (no rounding), due to rounding for time_j>0, time_j=1 may extend partially into the future
-        if time_j == 0 and time_i != 0:
-            time_history_start = (datetime.datetime.now() - time_deltas[time_i]).strftime("%a. %b. %d, %Y at %H:%M:%S")
-            time_history_end = datetime.datetime.now().strftime("%a. %b. %d, %Y at %H:%M:%S")
-        elif time_i != 0:
-            time_history_start = time_round_func(time_i, datetime.datetime.now() - time_deltas[time_i] * (time_j-1)).strftime("%a. %b. %d, %Y at %H:%M:%S")
-            time_history_end = time_round_func(time_i, datetime.datetime.now() - time_deltas[time_i] * (time_j-2)).strftime("%a. %b. %d, %Y at %H:%M:%S")
-        else:
-            return "all records"
-        return f"{time_history_start} to {time_history_end}"
-    @app.callback(
-            Output("send", "figure"), Output("recv", "figure"), Output("whereis", "options"), Output("store_send", "data"), Output("store_recv", "data"),
-            Input("smoothing", "value"), Input("trim-labels", "value"), Input("resampling", "value"),
-            Input("select", "value"), Input("where", "value"), Input("whereis", "value"), Input("time_i", "value"), Input("time_j", "value"),
-            Input('send', 'relayoutData'), Input('recv', 'relayoutData'), Input('send', 'restyleData'), Input('recv', 'restyleData'),
-            Input("interval-component", "n_intervals"),
-            State("store_send", "data"), State("store_recv", "data"), State("send", "figure"), State("recv", "figure"),
-            prevent_initial_call=True,
-            )
-    def update(smoothing, trim, resampling, dim, where, whereis, time_i, time_j, relayout_send, relayout_recv, restyle_send, restyle_recv, _, store_send, store_recv, fig_send, fig_recv):
-        if not callback_context.triggered or (callback_context.triggered[0]["prop_id"] == "time_j.value" and time_i == 0):
-            raise PreventUpdate
-        input_id = callback_context.triggered[0]["prop_id"]
-        # sync zoom level between figs and prevent zooming outside of the data range
-        if input_id == "send.relayoutData" and relayout_send is not None and 'xaxis.range[0]' in relayout_send:
-            # update fig_recv to match fig_send zoom
-            store_recv["rev"] += 1
-            fig_recv["layout"]["xaxis"]["range"] = [max(relayout_send['xaxis.range[0]'], store_recv["min_x"]), min(relayout_send['xaxis.range[1]'], store_recv["max_x"])]
-            fig_recv["layout"]["uirevision"] = store_recv["rev"]
-            # prevent zooming outside of the data range
-            if store_send["min_x"] > relayout_send['xaxis.range[0]'] or store_send["max_x"] < relayout_send['xaxis.range[1]']:
-                store_send["rev"] += 1
-                fig_send["layout"]["xaxis"]["range"] = [max(relayout_send['xaxis.range[0]'], store_send["min_x"]), min(relayout_send['xaxis.range[1]'], store_send["max_x"])]
-                fig_send["layout"]["uirevision"] = store_send["rev"]
-                return fig_send, fig_recv, no_update, store_send, store_recv
-            return no_update, fig_recv, no_update, no_update, store_recv
-        if input_id == "recv.relayoutData" and relayout_recv is not None and 'xaxis.range[0]' in relayout_recv:
-            # update fig_send to match fig_recv zoom
-            store_send["rev"] += 1
-            fig_send["layout"]["xaxis"]["range"] = [max(relayout_recv['xaxis.range[0]'], store_send["min_x"]), min(relayout_recv['xaxis.range[1]'], store_send["max_x"])]
-            fig_send["layout"]["uirevision"] = store_send["rev"]
-            # prevent zooming outside of the data range
-            if store_recv["min_x"] > relayout_recv['xaxis.range[0]'] or store_recv["max_x"] < relayout_recv['xaxis.range[1]']:
-                store_recv["rev"] += 1
-                fig_recv["layout"]["xaxis"]["range"] = [max(relayout_recv['xaxis.range[0]'], store_recv["min_x"]), min(relayout_recv['xaxis.range[1]'], store_recv["max_x"])]
-                fig_recv["layout"]["uirevision"] = store_recv["rev"]
-                return fig_send, fig_recv, no_update, store_send, store_recv
-            return fig_send, no_update, no_update, store_send, no_update
-        # get visibility of legend items (traces)
-        if input_id == "send.restyleData" and restyle_send is not None and "visible" in restyle_send[0]:
-            for visible, index in zip(restyle_send[0]["visible"], restyle_send[1]):
-                store_send["visible"][store_send["columns"][index]] = visible
-                # update recv fig to match
-                store_recv["visible"][store_recv["columns"][index]] = visible
-                fig_recv["data"][index]["visible"] = visible
-            return no_update, fig_recv, no_update, store_send, store_recv
-        if input_id == "recv.restyleData" and restyle_recv is not None and "visible" in restyle_recv[0]:
-            for visible, index in zip(restyle_recv[0]["visible"], restyle_recv[1]):
-                store_recv["visible"][store_recv["columns"][index]] = visible
-                # update send fig to match
-                store_send["visible"][store_send["columns"][index]] = visible
-                fig_send["data"][index]["visible"] = visible
-            return fig_send, no_update, no_update, store_send, store_recv
-        # generate the query string using the selected options (time_i is the index of the time period, time_j is the number of time period steps to go back)
-        if time_j == 0:
-            time_history_start = (datetime.datetime.now() - time_deltas[time_i]).strftime("%Y-%m-%d %H:%M:%S")
-            time_history_end = "now"
-        elif time_i != 0:
-            time_history_start = time_round_func(time_i, datetime.datetime.now() - time_deltas[time_i] * (time_j-1)).strftime("%Y-%m-%d %H:%M:%S")
-            time_history_end = time_round_func(time_i, datetime.datetime.now() - time_deltas[time_i] * (time_j-2)).strftime("%Y-%m-%d %H:%M:%S")
-        if time_i == 0:
-            time_query = ""
-        else:
-            if where and whereis:
-                time_query = f" AND contime > datetime(\"{time_history_start}\") AND contime < datetime(\"{time_history_end}\")"
-            else:
-                time_query = f" WHERE contime > datetime(\"{time_history_start}\") AND contime < datetime(\"{time_history_end}\")"
-        if where and whereis:
-            query = f"SELECT {dim}, contime, send, recv FROM connections WHERE {where} IS \"{whereis}\"{time_query}"
-        else:
-            query = f"SELECT {dim}, contime, send, recv FROM connections{time_query}"
-        # run query and populate whereis options
-        con = sqlite3.connect(file_path)
-        df = psql.read_sql(query, con)
-        whereis_options = []
-        if where:
-            if time_query.startswith(" AND"):
-                time_query = time_query.replace(" AND", " WHERE", 1)
-            query = f"SELECT DISTINCT {where} FROM connections{time_query}"
-            cur = con.cursor()
-            cur.execute(query)
-            whereis_values = cur.fetchall()
-            if where == "uid":
-                whereis_options = [{"label": f"is {get_user(x[0])}", "value": x[0]} for x in whereis_values]
-            else:
-                whereis_options = [{"label": f"is {trim_label(x[0], trim)}", "value": x[0]} for x in whereis_values]
-        con.close()
-        # structure the data for plotting
-        df_send = df.groupby(["contime", dim])["send"].sum().unstack(dim, fill_value=0)
-        df_recv = df.groupby(["contime", dim])["recv"].sum().unstack(dim, fill_value=0)
-        # store column names before renaming
-        store_send["columns"] = df_send.columns
-        store_recv["columns"] = df_recv.columns
-        # rename columns with nicer labels (add data totals, username, geoip lookup, and trim if requested)
-        df_send_total = df_send.sum()
-        df_recv_total = df_recv.sum()
-        df_send_new_columns = [get_totals(df_send_total, col) for col in df_send.columns]
-        df_recv_new_columns = [get_totals(df_recv_total, col) for col in df_recv.columns]
-        if dim == "uid":
-            df_send_new_columns = [col.replace(str(uid), get_user(uid), 1) for col, uid in zip(df_send_new_columns, df_send.columns)]
-            df_recv_new_columns = [col.replace(str(uid), get_user(uid), 1) for col, uid in zip(df_recv_new_columns, df_recv.columns)]
-        elif dim == "raddr" and geoip_reader is not None:
-            df_send_new_columns = [col.replace(str(ip), get_geoip(ip), 1) for col, ip in zip(df_send_new_columns, df_send.columns)]
-            df_recv_new_columns = [col.replace(str(ip), get_geoip(ip), 1) for col, ip in zip(df_recv_new_columns, df_recv.columns)]
-        df_send_new_columns = [trim_label(col, trim) for col in df_send_new_columns]
-        df_recv_new_columns = [trim_label(col, trim) for col in df_recv_new_columns]
-        df_send.columns = df_send_new_columns
-        df_recv.columns = df_recv_new_columns
-        # resample the data if it is too large for performance, and smooth if requested
-        if resampling:
-            if len(df_send) > resampling:
-                df_send.index = pd.to_datetime(df_send.index)
-                n = len(df_send) // resampling
-                df_send = df_send.resample(f'{n}T').mean().fillna(0)
-            if len(df_recv) > resampling:
-                df_recv.index = pd.to_datetime(df_recv.index)
-                n = len(df_recv) // resampling
-                df_recv = df_recv.resample(f'{n}T').mean().fillna(0)
-        if smoothing:
-            df_send = df_send.rolling(smoothing, center=True, closed="both", min_periods=smoothing//2).mean()
-            df_recv = df_recv.rolling(smoothing, center=True, closed="both", min_periods=smoothing//2).mean()
-        # update the store and figure
-        store_send["min_x"] = df_send.index.min()
-        store_send["max_x"] = df_send.index.max()
-        store_recv["min_x"] = df_recv.index.min()
-        store_recv["max_x"] = df_recv.index.max()
-        store_send["rev"] += 1
-        store_recv["rev"] += 1
-        fig_send = px.line(df_send, line_shape="linear", render_mode="svg", labels={
-            "contime": "", "value": "Data Sent (bytes)", dim: dim_labels[dim]})
-        fig_send.update_layout(uirevision=store_send["rev"])
-        fig_send.update_xaxes(range=[store_send["min_x"], store_send["max_x"]])
-        fig_send.update_yaxes(fixedrange=True)
-        fig_send.update_traces(fill="tozeroy", line_simplify=True)
-        fig_recv = px.line(df_recv, line_shape="linear", render_mode="svg", labels={
-            "contime": "", "value": "Data Received (bytes)", dim: dim_labels[dim]})
-        fig_recv.update_layout(uirevision=store_recv["rev"])
-        fig_recv.update_xaxes(range=[store_recv["min_x"], store_recv["max_x"]])
-        fig_recv.update_yaxes(fixedrange=True)
-        fig_recv.update_traces(fill="tozeroy", line_simplify=True)
-        # carry over visibility settings manually (instead keeping uirevision fixed) since column indices may not line up
-        for i in range(len(fig_send.data)):
-            fig_send.data[i].visible = True
-            if store_send["columns"][i] in store_send["visible"]:
-                fig_send.data[i].visible = store_send["visible"][store_send["columns"][i]]
-        for i in range(len(fig_recv.data)):
-            fig_recv.data[i].visible = True
-            if store_recv["columns"][i] in store_recv["visible"]:
-                fig_recv.data[i].visible = store_recv["visible"][store_recv["columns"][i]]
-        for column in list(store_send["visible"].keys()):
-            if column not in store_send["columns"]:
-                _ = store_send["visible"].pop(column)
-        for column in list(store_recv["visible"].keys()):
-            if column not in store_recv["columns"]:
-                _ = store_recv["visible"].pop(column)
-        return fig_send, fig_recv, whereis_options, store_send, store_recv
-    @app.callback(Output("exit", "n_clicks"), Input("exit", "n_clicks"))
-    def exit(clicks):
-        if clicks:
-            os.kill(os.getpid(), signal.SIGTERM)
-        return 0
-    app.run_server(host=os.getenv("HOST", "localhost"), port=os.getenv("PORT", "5100"), debug=bool(eval(os.getenv("DASH_DEBUG", "False"))))
-
-
-### startup
-def main():
-    """init picosnitch"""
-    # master copy of the snitch dictionary, all subprocesses only receive a static copy of it from this point in time
-    snitch = read_snitch()
-    # start picosnitch process monitor
-    with open("/run/picosnitch.pid", "r") as f:
-        assert int(f.read().strip()) == os.getpid()
-    if __name__ == "__main__" or sys.argv[1] == "start-no-daemon":
-        sys.exit(main_process(snitch))
-    print("Snitch subprocess init failed, __name__ != __main__", file=sys.stderr)
-    sys.exit(1)
-
-
-def start_picosnitch():
-    """command line interface, pre-startup checks, and run"""
-    readme = textwrap.dedent(f"""    Monitor your system for applications that make network connections, track their
-    bandwidth, verify hashes, and receive notifications.
-
-    picosnitch comes with ABSOLUTELY NO WARRANTY. This is free software, and you
-    are welcome to redistribute it under certain conditions. See version 3 of the
-    GNU General Public License for details.
-
-    website: https://elesiuta.github.io/picosnitch
-    version: {VERSION} ({os.path.abspath(__file__)})
-    config and log files: {BASE_PATH}
-
-    usage:
-        picosnitch dash|view|status|version|help
-                    |    |    |      |       |--> this text
-                    |    |    |      |--> version info
-                    |    |    |--> show pid
-                    |    |--> curses tui
-                    |--> start web gui (http://{os.getenv("HOST", "localhost")}:{os.getenv("PORT", "5100")})
-
-        systemctl enable|disable|start|stop|restart|status picosnitch
-                   |      |       |     |    |       |--> show status with systemd
-                   |      |       |_____|____|--> start/stop/restart picosnitch
-                   |______|--> enable/disable autostart on reboot
-
-    * if systemctl isn't working, recreate the service with `picosnitch systemd`
-    * if you don't use systemd, you can use `picosnitch start|stop|restart` instead
-    * if the daemon isn't working, try `picosnitch start-no-daemon`
-    * if dash isn't working, try `picosnitch start-dash` to see any errors
-    * available environment variables for dash: HOST, PORT, DASH_DEBUG
-    """)
-    systemd_service = textwrap.dedent(f"""    [Unit]
-    Description=picosnitch
-
-    [Service]
-    Type=simple
-    Restart=always
-    RestartSec=5
-    Environment="SUDO_UID={os.getenv("SUDO_UID")}" "SUDO_USER={os.getenv("SUDO_USER")}" "DBUS_SESSION_BUS_ADDRESS={os.getenv("DBUS_SESSION_BUS_ADDRESS")}" "PYTHON_USER_SITE={site.USER_SITE}"
-    ExecStart={sys.executable} "{os.path.abspath(__file__)}" start-no-daemon
-    PIDFile=/run/picosnitch.pid
-
-    [Install]
-    WantedBy=multi-user.target
-    """)
-    if len(sys.argv) == 2:
-        # platform checks
-        if sys.executable.startswith("/snap/"):
-            if sys.argv[1] in ["start", "stop", "restart", "systemd"]:
-                print("Command not supported by picosnitch snap, use `snap <command> picosnitch` or `systemctl <command> snap.picosnitch.daemon`", file=sys.stderr)
-                return 2
-        elif sys.executable.startswith("/nix/"):
-            if sys.argv[1] in ["start", "stop", "restart", "start-no-daemon"]:
-                if sys.argv[1] in ["start", "stop", "restart"]:
-                    print("WARNING: built in daemon mode is not supported on Nix, use picosnitch start-no-daemon or systemctl instead", file=sys.stderr)
-                if os.getuid() != 0:
-                    print("ERROR: picosnitch requires root privileges to run", file=sys.stderr)
-                    return 1
-            elif sys.argv[1] == "systemd":
-                print("Command not supported on Nix, add `services.picosnitch.enable = true;` to your Nix configuration", file=sys.stderr)
-                return 2
-        # privelage checks if required or just show help and exit
-        if sys.argv[1] == "help":
-            print(readme)
-            return 0
-        elif sys.argv[1] in ["start", "stop", "restart", "start-no-daemon", "systemd"]:
-            if os.getuid() != 0:
-                args = ["sudo", "-E", sys.executable, os.path.abspath(__file__), sys.argv[1]]
-                os.execvp("sudo", args)
-            with open("/proc/self/status", "r") as f:
-                proc_status = f.read()
-                capeff = int(proc_status[proc_status.find("CapEff:")+8:].splitlines()[0].strip(), base=16)
-                cap_sys_admin = 2**21
-                assert capeff & cap_sys_admin, "Missing capability CAP_SYS_ADMIN"
-            assert importlib.util.find_spec("bcc"), "Requires BCC https://github.com/iovisor/bcc/blob/master/INSTALL.md"
-        # config and database checks and init
-        tmp_snitch = read_snitch()
-        assert os.path.exists(os.path.join(BASE_PATH, "snitch.db")) or os.getuid() == 0, "Requires root privileges to create database"
-        con = sqlite3.connect(os.path.join(BASE_PATH, "snitch.db"))
-        cur = con.cursor()
-        cur.execute(''' SELECT count(name) FROM sqlite_master WHERE type='table' AND name='connections' ''')
-        if cur.fetchone()[0] != 1:
-            cur.execute(''' CREATE TABLE connections
-                            (contime text, send integer, recv integer, exe text, name text, cmdline text, sha256 text, pexe text, pname text, pcmdline text, psha256 text, uid integer, lport integer, rport integer, laddr text, raddr text, domain text) ''')
-            cur.execute(''' PRAGMA user_version = 3 ''')
-            con.commit()
-        else:
-            cur.execute(''' PRAGMA user_version ''')
-            user_version = cur.fetchone()[0]
-            if user_version <= 2:
-                assert not os.path.exists("/run/picosnitch.pid"), "cannot upgrade database while picosnitch daemon is running"
-                print("Upgrading database, please wait...")
-            if user_version == 0:
-                cur.execute(''' ALTER TABLE connections RENAME COLUMN events TO conns ''')
-                cur.execute(''' ALTER TABLE connections ADD COLUMN send integer DEFAULT 0 NOT NULL ''')
-                cur.execute(''' ALTER TABLE connections ADD COLUMN recv integer DEFAULT 0 NOT NULL ''')
-                cur.execute(''' PRAGMA user_version = 1 ''')
-                con.commit()
-            if user_version <= 1:
-                cur.execute(''' ALTER TABLE connections RENAME TO tmp ''')
-                cur.execute(''' CREATE TABLE connections
-                                (exe text, name text, cmdline text, sha256 text, contime text, domain text, ip text, port integer, uid integer, pexe text DEFAULT "", pname text DEFAULT "", pcmdline text DEFAULT "", psha256 text DEFAULT "", conns integer, send integer, recv integer) ''')
-                cur.execute(''' INSERT INTO connections
-                                (exe, name, cmdline, sha256, contime, domain, ip, port, uid, conns, send, recv) SELECT exe, name, cmdline, sha256, contime, domain, ip, port, uid, conns, send, recv FROM tmp ''')
-                cur.execute(''' DROP TABLE tmp ''')
-                cur.execute(''' PRAGMA user_version = 2 ''')
-                con.commit()
-            if user_version <= 2:
-                cur.execute(''' ALTER TABLE connections RENAME TO tmp ''')
-                cur.execute(''' CREATE TABLE connections
-                                (contime text, send integer, recv integer, exe text, name text, cmdline text, sha256 text, pexe text, pname text, pcmdline text, psha256 text, uid integer, lport integer, rport integer, laddr text, raddr text, domain text) ''')
-                cur.execute(''' INSERT INTO connections
-                                (contime, send, recv, exe, name, cmdline, sha256, pexe, pname, pcmdline, psha256, uid, lport, rport, laddr, raddr, domain) SELECT contime, send, recv, exe, name, cmdline, sha256, pexe, pname, pcmdline, psha256, uid, -1, port, "", ip, domain FROM tmp ''')
-                cur.execute(''' DROP TABLE tmp ''')
-                cur.execute(''' PRAGMA user_version = 3 ''')
-                con.commit()
-                con.execute(''' VACUUM ''')
-                print("Database upgrade complete")
-        con.close()
-        # optional remote database
-        if sql_kwargs := tmp_snitch["Config"]["DB sql server"]:
-            sql_client = sql_kwargs.pop("client", "no client error")
-            table_name = sql_kwargs.pop("table_name", "connections")
-            sql = importlib.import_module(sql_client)
-            if sql_client not in ["mariadb", "psycopg", "psycopg2", "pymysql"]:
-                print(f"Warning, using {sql_client} for \"DB sql server\" \"client\" may not be supported, ensure it implements PEP 249", file=sys.stderr)
-            try:
-                con = sql.connect(**sql_kwargs)
-                cur = con.cursor()
-                cur.execute(f''' CREATE TABLE IF NOT EXISTS {table_name}
-                                 (contime text, send integer, recv integer, exe text, name text, cmdline text, sha256 text, pexe text, pname text, pcmdline text, psha256 text, uid integer, lport integer, rport integer, laddr text, raddr text, domain text) ''')
-                con.commit()
-                con.close()
-            except Exception as e:
-                print("Warning: %s%s on line %s" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno), file=sys.stderr)
-        # offer to use systemctl instead of built in daemon
-        if sys.argv[1] in ["start", "stop", "restart"]:
-            if os.path.exists("/usr/lib/systemd/system/picosnitch.service") or os.path.exists("/etc/systemd/system/picosnitch.service"):
-                print("Found picosnitch.service but you are not using systemctl")
-                if sys.stdin.isatty():
-                    confirm = input(f"Did you intend to run `systemctl {sys.argv[1]} picosnitch` (y/N)? ")
-                    if confirm.lower().startswith("y"):
-                        subprocess.run(["systemctl", sys.argv[1], "picosnitch"])
-                        return 0
-        # init built in daemon control
-        class PicoDaemon(Daemon):
-            def run(self):
-                main()
-        daemon = PicoDaemon("/run/picosnitch.pid")
-        # process command line arguments
-        if sys.argv[1] == "start":
-            print("starting picosnitch daemon")
-            daemon.start()
-        elif sys.argv[1] == "stop":
-            print("stopping picosnitch daemon")
-            daemon.stop()
-        elif sys.argv[1] == "restart":
-            print("restarting picosnitch daemon")
-            daemon.restart()
-        # daemon pid (for built in or systemd)
-        elif sys.argv[1] == "status":
-            daemon.status()
-        # create systemd service file (intended for installing from PyPI or runnning script directly)
-        elif sys.argv[1] == "systemd":
-            with open("/usr/lib/systemd/system/picosnitch.service", "w") as f:
-                f.write(systemd_service)
-            subprocess.run(["systemctl", "daemon-reload"])
-            print("Wrote /usr/lib/systemd/system/picosnitch.service\nYou can now run picosnitch using systemctl")
-            return 0
-        # simple mode (intended for running from systemd or debugging)
-        elif sys.argv[1] == "start-no-daemon":
-            assert not os.path.exists("/run/picosnitch.pid"), "pid file already exists"
-            def delpid():
-                os.remove("/run/picosnitch.pid")
-            atexit.register(delpid)
-            if sys.executable.startswith("/nix/"):
-                os.makedirs("/run/picosnitch", exist_ok=True)
-            with open("/run/picosnitch.pid", "w") as f:
-                f.write(str(os.getpid()) + "\n")
-            print("starting picosnitch in simple mode")
-            print(f"using config and log files from: {BASE_PATH}")
-            print(f"using DBUS_SESSION_BUS_ADDRESS: {os.getenv('DBUS_SESSION_BUS_ADDRESS')}")
-            sys.exit(main())
-        # web gui (launches browser and detaches from terminal on supported platforms (not snap or nix))
-        elif sys.argv[1] == "dash":
-            site.addsitedir(os.path.expanduser(f"~/.local/pipx/venvs/dash/lib/python{sys.version_info.major}.{sys.version_info.minor}/site-packages"))
-            site.addsitedir(os.path.expandvars(f"$PIPX_HOME/venvs/dash/lib/python{sys.version_info.major}.{sys.version_info.minor}/site-packages"))
-            import dash, pandas, plotly
-            assert dash.__version__ and pandas.__version__ and plotly.__version__
-            try:
-                os.setgid(int(os.getenv("SUDO_UID")))
-                os.setuid(int(os.getenv("SUDO_UID")))
-            except Exception:
-                pass
-            print(f"serving web gui on http://{os.getenv('HOST', 'localhost')}:{os.getenv('PORT', '5100')}")
-            print("if this fails, try running `picosnitch start-dash` to see any errors")
-            if sys.executable.startswith("/snap/") or sys.executable.startswith("/nix/"):
-                subprocess.Popen(["bash", "-c", f'/usr/bin/env python3 -m webbrowser -t http://{os.getenv("HOST", "localhost")}:{os.getenv("PORT", "5100")}'], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-                return ui_dash()
-            subprocess.Popen(["bash", "-c", f'let i=0; rm {BASE_PATH}/dash; while [[ ! -f {BASE_PATH}/dash || "$i" -gt 30 ]]; do let i++; sleep 1; done; rm {BASE_PATH}/dash && /usr/bin/env python3 -m webbrowser -t http://{os.getenv("HOST", "localhost")}:{os.getenv("PORT", "5100")}'], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-            args = ["bash", "-c", f"touch {BASE_PATH}/dash; nohup {sys.executable} \"{os.path.abspath(__file__)}\" start-dash > /dev/null 2>&1 &"]
-            os.execvp("bash", args)
-        # web gui without launching browser or detaching from terminal (intended for debugging)
-        elif sys.argv[1] == "start-dash":
-            return ui_dash()
-        # terminal interface
-        elif sys.argv[1] == "view":
-            return ui_init()
-        # show version or help if invalid argument and exit
-        elif sys.argv[1] == "version":
-            print(f"version: {VERSION} ({os.path.abspath(__file__)})\nconfig and log files: {BASE_PATH}")
-            return 0
-        else:
-            print(readme)
-            return 2
-        return 0
-    else:
-        print(readme)
-        return 2
-
-
-### bpf program
-bpf_text_base = """
-// This eBPF program was based on the following sources
-// https://github.com/p-/socket-connect-bpf/blob/7f386e368759e53868a078570254348e73e73e22/securitySocketConnectSrc.bpf
-// https://github.com/iovisor/bcc/blob/master/tools/execsnoop.py
-// https://github.com/iovisor/bcc/blob/master/tools/gethostlatency.py
-// https://github.com/iovisor/bcc/blob/master/tools/tcpconnect.py
-// https://www.gcardone.net/2020-07-31-per-process-bandwidth-monitoring-on-Linux-with-bpftrace/
-
-#include <uapi/linux/ptrace.h>
-#include <linux/socket.h>
-#include <linux/sched.h>
-#include <linux/in.h>
-#include <linux/in6.h>
-#include <linux/ip.h>
-#include <net/sock.h>
-
-struct addrinfo {
-    int ai_flags;
-    int ai_family;
-    int ai_socktype;
-    int ai_protocol;
-    u32 ai_addrlen;
-    struct sockaddr *ai_addr;
-    char *ai_canonname;
-    struct addrinfo *ai_next;
-};
-
-struct dns_val_t {
-    char host[80];
-    struct addrinfo **res;
-};
-BPF_HASH(dns_hash, u32, struct dns_val_t);
-
-struct dns_event_t {
-    char host[80];
-    u32 daddr;
-    unsigned __int128 daddr6;
-} __attribute__((packed));
-BPF_PERF_OUTPUT(dns_events);
-
-struct exec_event_t {
-    char comm[TASK_COMM_LEN];
-    char pcomm[TASK_COMM_LEN];
-    u64 ino;
-    u64 pino;
-    u32 pid;
-    u32 ppid;
-    u32 uid;
-    u32 dev;
-    u32 pdev;
-} __attribute__((packed));
-BPF_PERF_OUTPUT(exec_events);
-
-int dns_entry(struct pt_regs *ctx, const char *node, const char *service, const struct addrinfo *hints, struct addrinfo **res) {
-    if (PT_REGS_PARM1(ctx)) {
-        struct dns_val_t val = {.res = res};
-        if (bpf_probe_read_user(&val.host, sizeof(val.host), (void *)PT_REGS_PARM1(ctx)) == 0) {
-            u32 tid = (u32)bpf_get_current_pid_tgid();
-            dns_hash.update(&tid, &val);
-        }
-    }
-    return 0;
-}
-
-int dns_return(struct pt_regs *ctx) {
-    struct dns_val_t *valp;
-    u32 tid = (u32)bpf_get_current_pid_tgid();
-    valp = dns_hash.lookup(&tid);
-    if (valp) {
-        struct dns_event_t data = {};
-        bpf_probe_read_kernel(&data.host, sizeof(data.host), (void *)valp->host);
-        struct addrinfo *address;
-        bpf_probe_read(&address, sizeof(address), valp->res);
-        for (int i = 0; i < 8; i++) {
-            u32 address_family;
-            bpf_probe_read(&address_family, sizeof(address_family), &address->ai_family);
-            if (address_family == AF_INET) {
-                struct sockaddr_in *daddr;
-                bpf_probe_read(&daddr, sizeof(daddr), &address->ai_addr);
-                bpf_probe_read(&data.daddr, sizeof(data.daddr), &daddr->sin_addr.s_addr);
-                dns_events.perf_submit(ctx, &data, sizeof(data));
-            }
-            else if (address_family == AF_INET6) {
-                struct sockaddr_in6 *daddr6;
-                bpf_probe_read(&daddr6, sizeof(daddr6), &address->ai_addr);
-                bpf_probe_read(&data.daddr6, sizeof(data.daddr6), &daddr6->sin6_addr.in6_u.u6_addr32);
-                dns_events.perf_submit(ctx, &data, sizeof(data));
-            }
-            if (bpf_probe_read(&address, sizeof(address), &address->ai_next) != 0) break;
-            struct dns_event_t data = {};
-            bpf_probe_read_kernel(&data.host, sizeof(data.host), (void *)valp->host);
-        }
-        dns_hash.delete(&tid);
-    }
-    return 0;
-}
-
-int exec_entry(struct pt_regs *ctx) {
-    if (PT_REGS_RC(ctx) == 0) {
-        struct exec_event_t data = {};
-        data.pid = bpf_get_current_pid_tgid() >> 32;
-        data.uid = bpf_get_current_uid_gid();
-        struct task_struct *task = (struct task_struct *)bpf_get_current_task();
-        data.ppid = task->real_parent->tgid;
-        data.ino = task->mm->exe_file->f_path.dentry->d_inode->i_ino;
-        data.dev = task->mm->exe_file->f_path.dentry->d_inode->i_sb->s_dev;
-        data.dev = new_encode_dev(data.dev);
-        data.pino = task->real_parent->mm->exe_file->f_path.dentry->d_inode->i_ino;
-        data.pdev = task->real_parent->mm->exe_file->f_path.dentry->d_inode->i_sb->s_dev;
-        data.pdev = new_encode_dev(data.pdev);
-        bpf_get_current_comm(&data.comm, sizeof(data.comm));
-        bpf_probe_read_kernel_str(&data.pcomm, sizeof(data.pcomm), &task->real_parent->comm);
-        exec_events.perf_submit(ctx, &data, sizeof(data));
-    }
-    return 0;
-}
-"""
-
-bpf_text_bandwidth_structs = """
-struct sendrecv_event_t {
-    char comm[TASK_COMM_LEN];
-    char pcomm[TASK_COMM_LEN];
-    u64 ino;
-    u64 pino;
-    u32 pid;
-    u32 ppid;
-    u32 uid;
-    u32 dev;
-    u32 pdev;
-    u32 bytes;
-    u32 daddr;
-    u32 saddr;
-    u16 dport;
-    u16 lport;
-} __attribute__((packed));
-BPF_PERF_OUTPUT(sendmsg_events);
-BPF_PERF_OUTPUT(recvmsg_events);
-
-struct sendrecv6_event_t {
-    char comm[TASK_COMM_LEN];
-    char pcomm[TASK_COMM_LEN];
-    unsigned __int128 daddr;
-    unsigned __int128 saddr;
-    u64 ino;
-    u64 pino;
-    u32 pid;
-    u32 ppid;
-    u32 uid;
-    u32 dev;
-    u32 pdev;
-    u32 bytes;
-    u16 dport;
-    u16 lport;
-} __attribute__((packed));
-BPF_PERF_OUTPUT(sendmsg6_events);
-BPF_PERF_OUTPUT(recvmsg6_events);
-"""
-
-bpf_text_bandwidth_probe = """
-KRETFUNC_PROBE(sock_sendmsg, struct socket *sock, struct msghdr *msg, int flags, u32 retval) {
-    if (retval >= 0 && retval < 0x7fffffff) {
-        u32 pid = bpf_get_current_pid_tgid() >> 32;
-        u32 uid = bpf_get_current_uid_gid();
-        struct task_struct *task, *parent;
-        struct mm_struct *mm;
-        struct file *exe_file;
-        struct dentry *exe_dentry;
-        struct inode *exe_inode;
-        struct super_block *exe_sb;
-        u64 ino, pino;
-        u32 ppid, dev, pdev;
-        task = (struct task_struct *)bpf_get_current_task();
-        // u32 ppid = task->real_parent->tgid;
-        // u64 ino = task->mm->exe_file->f_path.dentry->d_inode->i_ino;
-        // u32 dev = task->mm->exe_file->f_path.dentry->d_inode->i_sb->s_dev;
-        if (bpf_probe_read_kernel(&parent, sizeof(parent), &task->real_parent)) return 0;
-        if (bpf_probe_read_kernel(&ppid, sizeof(ppid), &parent->tgid)) return 0;
-        if (bpf_probe_read_kernel(&mm, sizeof(mm), &task->mm)) return 0;
-        if (bpf_probe_read_kernel(&exe_file, sizeof(exe_file), &mm->exe_file)) return 0;
-        if (bpf_probe_read_kernel(&exe_dentry, sizeof(exe_dentry), &exe_file->f_path.dentry)) return 0;
-        if (bpf_probe_read_kernel(&exe_inode, sizeof(exe_inode), &exe_dentry->d_inode)) return 0;
-        if (bpf_probe_read_kernel(&ino, sizeof(ino), &exe_inode->i_ino)) return 0;
-        if (bpf_probe_read_kernel(&exe_sb, sizeof(exe_sb), &exe_inode->i_sb)) return 0;
-        if (bpf_probe_read_kernel(&dev, sizeof(dev), &exe_sb->s_dev)) return 0;
-        dev = new_encode_dev(dev);
-        // u64 pino = task->real_parent->mm->exe_file->f_path.dentry->d_inode->i_ino;
-        // u32 pdev = task->real_parent->mm->exe_file->f_path.dentry->d_inode->i_sb->s_dev;
-        if (bpf_probe_read_kernel(&mm, sizeof(mm), &parent->mm)) return 0;
-        if (bpf_probe_read_kernel(&exe_file, sizeof(exe_file), &mm->exe_file)) return 0;
-        if (bpf_probe_read_kernel(&exe_dentry, sizeof(exe_dentry), &exe_file->f_path.dentry)) return 0;
-        if (bpf_probe_read_kernel(&exe_inode, sizeof(exe_inode), &exe_dentry->d_inode)) return 0;
-        if (bpf_probe_read_kernel(&pino, sizeof(pino), &exe_inode->i_ino)) return 0;
-        if (bpf_probe_read_kernel(&exe_sb, sizeof(exe_sb), &exe_inode->i_sb)) return 0;
-        if (bpf_probe_read_kernel(&pdev, sizeof(pdev), &exe_sb->s_dev)) return 0;
-        pdev = new_encode_dev(pdev);
-        u32 address_family = sock->sk->__sk_common.skc_family;
-        if (address_family == AF_INET) {
-            struct sendrecv_event_t data = {.pid = pid, .ppid = ppid, .uid = uid, .dev = dev, .pdev = pdev, .ino = ino, .pino = pino, .bytes = retval};
-            bpf_get_current_comm(&data.comm, sizeof(data.comm));
-            bpf_probe_read_kernel_str(&data.pcomm, sizeof(data.pcomm), &parent->comm);
-            bpf_probe_read(&data.daddr, sizeof(data.daddr), &sock->sk->__sk_common.skc_daddr);
-            bpf_probe_read(&data.saddr, sizeof(data.saddr), &sock->sk->__sk_common.skc_rcv_saddr);
-            bpf_probe_read(&data.dport, sizeof(data.dport), &sock->sk->__sk_common.skc_dport);
-            bpf_probe_read(&data.lport, sizeof(data.lport), &sock->sk->__sk_common.skc_num);
-            data.dport = ntohs(data.dport);
-            sendmsg_events.perf_submit(ctx, &data, sizeof(data));
-        }
-        else if (address_family == AF_INET6) {
-            struct sendrecv6_event_t data = {.pid = pid, .ppid = ppid, .uid = uid, .dev = dev, .pdev = pdev, .ino = ino, .pino = pino, .bytes = retval};
-            bpf_get_current_comm(&data.comm, sizeof(data.comm));
-            bpf_probe_read_kernel_str(&data.pcomm, sizeof(data.pcomm), &parent->comm);
-            bpf_probe_read(&data.daddr, sizeof(data.daddr), &sock->sk->__sk_common.skc_v6_daddr);
-            bpf_probe_read(&data.saddr, sizeof(data.saddr), &sock->sk->__sk_common.skc_v6_rcv_saddr);
-            bpf_probe_read(&data.dport, sizeof(data.dport), &sock->sk->__sk_common.skc_dport);
-            bpf_probe_read(&data.lport, sizeof(data.lport), &sock->sk->__sk_common.skc_num);
-            data.dport = ntohs(data.dport);
-            sendmsg6_events.perf_submit(ctx, &data, sizeof(data));
-        }
-    }
-    return 0;
-}
-"""
-
-if __name__ == "__main__":
-    sys.exit(start_picosnitch())
diff --git a/picosnitch/__init__.py b/picosnitch/__init__.py
new file mode 100755
index 0000000..b6f29c5
--- /dev/null
+++ b/picosnitch/__init__.py
@@ -0,0 +1,18 @@
+#!/usr/bin/env python3
+# picosnitch
+# Copyright (C) 2020-2023 Eric Lesiuta
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+# https://github.com/elesiuta/picosnitch
diff --git a/picosnitch/__main__.py b/picosnitch/__main__.py
new file mode 100755
index 0000000..fcf5838
--- /dev/null
+++ b/picosnitch/__main__.py
@@ -0,0 +1,24 @@
+#!/usr/bin/env python3
+# picosnitch
+# Copyright (C) 2020-2023 Eric Lesiuta
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+# https://github.com/elesiuta/picosnitch
+
+import sys
+from .cli import start_picosnitch
+
+if __name__ == "__main__":
+    sys.exit(start_picosnitch())
diff --git a/picosnitch/cli.py b/picosnitch/cli.py
new file mode 100755
index 0000000..69351a9
--- /dev/null
+++ b/picosnitch/cli.py
@@ -0,0 +1,274 @@
+#!/usr/bin/env python3
+# picosnitch
+# Copyright (C) 2020-2023 Eric Lesiuta
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+# https://github.com/elesiuta/picosnitch
+
+import atexit
+import importlib
+import importlib.util
+import os
+import site
+import sqlite3
+import subprocess
+import sys
+import textwrap
+
+from .constants import BASE_PATH, VERSION
+from .daemon import Daemon
+from .main_process import main_process
+from .user_interface import ui_dash, ui_init
+from .utils import read_snitch
+
+
+def main():
+    """init picosnitch"""
+    # master copy of the snitch dictionary, all subprocesses only receive a static copy of it from this point in time
+    snitch = read_snitch()
+    # start picosnitch process monitor
+    with open("/run/picosnitch.pid", "r") as f:
+        assert int(f.read().strip()) == os.getpid()
+    if __name__ == "__main__" or sys.argv[1] == "start-no-daemon":
+        sys.exit(main_process(snitch))
+    print("Snitch subprocess init failed, __name__ != __main__", file=sys.stderr)
+    sys.exit(1)
+
+
+def start_picosnitch():
+    """command line interface, pre-startup checks, and run"""
+    readme = textwrap.dedent(f"""    Monitor your system for applications that make network connections, track their
+    bandwidth, verify hashes, and receive notifications.
+
+    picosnitch comes with ABSOLUTELY NO WARRANTY. This is free software, and you
+    are welcome to redistribute it under certain conditions. See version 3 of the
+    GNU General Public License for details.
+
+    website: https://elesiuta.github.io/picosnitch
+    version: {VERSION} ({os.path.abspath(__file__)})
+    config and log files: {BASE_PATH}
+
+    usage:
+        picosnitch dash|view|status|version|help
+                    |    |    |      |       |--> this text
+                    |    |    |      |--> version info
+                    |    |    |--> show pid
+                    |    |--> curses tui
+                    |--> start web gui (http://{os.getenv("HOST", "localhost")}:{os.getenv("PORT", "5100")})
+
+        systemctl enable|disable|start|stop|restart|status picosnitch
+                   |      |       |     |    |       |--> show status with systemd
+                   |      |       |_____|____|--> start/stop/restart picosnitch
+                   |______|--> enable/disable autostart on reboot
+
+    * if systemctl isn't working, recreate the service with `picosnitch systemd`
+    * if you don't use systemd, you can use `picosnitch start|stop|restart` instead
+    * if the daemon isn't working, try `picosnitch start-no-daemon`
+    * if dash isn't working, try `picosnitch start-dash` to see any errors
+    * available environment variables for dash: HOST, PORT, DASH_DEBUG
+    """)
+    systemd_service = textwrap.dedent(f"""    [Unit]
+    Description=picosnitch
+
+    [Service]
+    Type=simple
+    Restart=always
+    RestartSec=5
+    Environment="SUDO_UID={os.getenv("SUDO_UID")}" "SUDO_USER={os.getenv("SUDO_USER")}" "DBUS_SESSION_BUS_ADDRESS={os.getenv("DBUS_SESSION_BUS_ADDRESS")}" "PYTHON_USER_SITE={site.USER_SITE}"
+    ExecStart={sys.executable} "{os.path.abspath(__file__)}" start-no-daemon
+    PIDFile=/run/picosnitch.pid
+
+    [Install]
+    WantedBy=multi-user.target
+    """)
+    if len(sys.argv) == 2:
+        # platform checks
+        if sys.executable.startswith("/snap/"):
+            if sys.argv[1] in ["start", "stop", "restart", "systemd"]:
+                print("Command not supported by picosnitch snap, use `snap <command> picosnitch` or `systemctl <command> snap.picosnitch.daemon`", file=sys.stderr)
+                return 2
+        elif sys.executable.startswith("/nix/"):
+            if sys.argv[1] in ["start", "stop", "restart", "start-no-daemon"]:
+                if sys.argv[1] in ["start", "stop", "restart"]:
+                    print("WARNING: built in daemon mode is not supported on Nix, use picosnitch start-no-daemon or systemctl instead", file=sys.stderr)
+                if os.getuid() != 0:
+                    print("ERROR: picosnitch requires root privileges to run", file=sys.stderr)
+                    return 1
+            elif sys.argv[1] == "systemd":
+                print("Command not supported on Nix, add `services.picosnitch.enable = true;` to your Nix configuration", file=sys.stderr)
+                return 2
+        # privelage checks if required or just show help and exit
+        if sys.argv[1] == "help":
+            print(readme)
+            return 0
+        elif sys.argv[1] in ["start", "stop", "restart", "start-no-daemon", "systemd"]:
+            if os.getuid() != 0:
+                args = ["sudo", "-E", sys.executable, os.path.abspath(__file__), sys.argv[1]]
+                os.execvp("sudo", args)
+            with open("/proc/self/status", "r") as f:
+                proc_status = f.read()
+                capeff = int(proc_status[proc_status.find("CapEff:")+8:].splitlines()[0].strip(), base=16)
+                cap_sys_admin = 2**21
+                assert capeff & cap_sys_admin, "Missing capability CAP_SYS_ADMIN"
+            assert importlib.util.find_spec("bcc"), "Requires BCC https://github.com/iovisor/bcc/blob/master/INSTALL.md"
+        # config and database checks and init
+        tmp_snitch = read_snitch()
+        assert os.path.exists(os.path.join(BASE_PATH, "snitch.db")) or os.getuid() == 0, "Requires root privileges to create database"
+        con = sqlite3.connect(os.path.join(BASE_PATH, "snitch.db"))
+        cur = con.cursor()
+        cur.execute(''' SELECT count(name) FROM sqlite_master WHERE type='table' AND name='connections' ''')
+        if cur.fetchone()[0] != 1:
+            cur.execute(''' CREATE TABLE connections
+                            (contime text, send integer, recv integer, exe text, name text, cmdline text, sha256 text, pexe text, pname text, pcmdline text, psha256 text, uid integer, lport integer, rport integer, laddr text, raddr text, domain text) ''')
+            cur.execute(''' PRAGMA user_version = 3 ''')
+            con.commit()
+        else:
+            cur.execute(''' PRAGMA user_version ''')
+            user_version = cur.fetchone()[0]
+            if user_version <= 2:
+                assert not os.path.exists("/run/picosnitch.pid"), "cannot upgrade database while picosnitch daemon is running"
+                print("Upgrading database, please wait...")
+            if user_version == 0:
+                cur.execute(''' ALTER TABLE connections RENAME COLUMN events TO conns ''')
+                cur.execute(''' ALTER TABLE connections ADD COLUMN send integer DEFAULT 0 NOT NULL ''')
+                cur.execute(''' ALTER TABLE connections ADD COLUMN recv integer DEFAULT 0 NOT NULL ''')
+                cur.execute(''' PRAGMA user_version = 1 ''')
+                con.commit()
+            if user_version <= 1:
+                cur.execute(''' ALTER TABLE connections RENAME TO tmp ''')
+                cur.execute(''' CREATE TABLE connections
+                                (exe text, name text, cmdline text, sha256 text, contime text, domain text, ip text, port integer, uid integer, pexe text DEFAULT "", pname text DEFAULT "", pcmdline text DEFAULT "", psha256 text DEFAULT "", conns integer, send integer, recv integer) ''')
+                cur.execute(''' INSERT INTO connections
+                                (exe, name, cmdline, sha256, contime, domain, ip, port, uid, conns, send, recv) SELECT exe, name, cmdline, sha256, contime, domain, ip, port, uid, conns, send, recv FROM tmp ''')
+                cur.execute(''' DROP TABLE tmp ''')
+                cur.execute(''' PRAGMA user_version = 2 ''')
+                con.commit()
+            if user_version <= 2:
+                cur.execute(''' ALTER TABLE connections RENAME TO tmp ''')
+                cur.execute(''' CREATE TABLE connections
+                                (contime text, send integer, recv integer, exe text, name text, cmdline text, sha256 text, pexe text, pname text, pcmdline text, psha256 text, uid integer, lport integer, rport integer, laddr text, raddr text, domain text) ''')
+                cur.execute(''' INSERT INTO connections
+                                (contime, send, recv, exe, name, cmdline, sha256, pexe, pname, pcmdline, psha256, uid, lport, rport, laddr, raddr, domain) SELECT contime, send, recv, exe, name, cmdline, sha256, pexe, pname, pcmdline, psha256, uid, -1, port, "", ip, domain FROM tmp ''')
+                cur.execute(''' DROP TABLE tmp ''')
+                cur.execute(''' PRAGMA user_version = 3 ''')
+                con.commit()
+                con.execute(''' VACUUM ''')
+                print("Database upgrade complete")
+        con.close()
+        # optional remote database
+        if sql_kwargs := tmp_snitch["Config"]["DB sql server"]:
+            sql_client = sql_kwargs.pop("client", "no client error")
+            table_name = sql_kwargs.pop("table_name", "connections")
+            sql = importlib.import_module(sql_client)
+            if sql_client not in ["mariadb", "psycopg", "psycopg2", "pymysql"]:
+                print(f"Warning, using {sql_client} for \"DB sql server\" \"client\" may not be supported, ensure it implements PEP 249", file=sys.stderr)
+            try:
+                con = sql.connect(**sql_kwargs)
+                cur = con.cursor()
+                cur.execute(f''' CREATE TABLE IF NOT EXISTS {table_name}
+                                 (contime text, send integer, recv integer, exe text, name text, cmdline text, sha256 text, pexe text, pname text, pcmdline text, psha256 text, uid integer, lport integer, rport integer, laddr text, raddr text, domain text) ''')
+                con.commit()
+                con.close()
+            except Exception as e:
+                print("Warning: %s%s on line %s" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno), file=sys.stderr)
+        # offer to use systemctl instead of built in daemon
+        if sys.argv[1] in ["start", "stop", "restart"]:
+            if os.path.exists("/usr/lib/systemd/system/picosnitch.service") or os.path.exists("/etc/systemd/system/picosnitch.service"):
+                print("Found picosnitch.service but you are not using systemctl")
+                if sys.stdin.isatty():
+                    confirm = input(f"Did you intend to run `systemctl {sys.argv[1]} picosnitch` (y/N)? ")
+                    if confirm.lower().startswith("y"):
+                        subprocess.run(["systemctl", sys.argv[1], "picosnitch"])
+                        return 0
+        # init built in daemon control
+        class PicoDaemon(Daemon):
+            def run(self):
+                main()
+        daemon = PicoDaemon("/run/picosnitch.pid")
+        # process command line arguments
+        if sys.argv[1] == "start":
+            print("starting picosnitch daemon")
+            daemon.start()
+        elif sys.argv[1] == "stop":
+            print("stopping picosnitch daemon")
+            daemon.stop()
+        elif sys.argv[1] == "restart":
+            print("restarting picosnitch daemon")
+            daemon.restart()
+        # daemon pid (for built in or systemd)
+        elif sys.argv[1] == "status":
+            daemon.status()
+        # create systemd service file (intended for installing from PyPI or runnning script directly)
+        elif sys.argv[1] == "systemd":
+            with open("/usr/lib/systemd/system/picosnitch.service", "w") as f:
+                f.write(systemd_service)
+            subprocess.run(["systemctl", "daemon-reload"])
+            print("Wrote /usr/lib/systemd/system/picosnitch.service\nYou can now run picosnitch using systemctl")
+            return 0
+        # simple mode (intended for running from systemd or debugging)
+        elif sys.argv[1] == "start-no-daemon":
+            assert not os.path.exists("/run/picosnitch.pid"), "pid file already exists"
+            def delpid():
+                os.remove("/run/picosnitch.pid")
+            atexit.register(delpid)
+            if sys.executable.startswith("/nix/"):
+                os.makedirs("/run/picosnitch", exist_ok=True)
+            with open("/run/picosnitch.pid", "w") as f:
+                f.write(str(os.getpid()) + "\n")
+            print("starting picosnitch in simple mode")
+            print(f"using config and log files from: {BASE_PATH}")
+            print(f"using DBUS_SESSION_BUS_ADDRESS: {os.getenv('DBUS_SESSION_BUS_ADDRESS')}")
+            sys.exit(main())
+        # web gui (launches browser and detaches from terminal on supported platforms (not snap or nix))
+        elif sys.argv[1] == "dash":
+            site.addsitedir(os.path.expanduser(f"~/.local/pipx/venvs/dash/lib/python{sys.version_info.major}.{sys.version_info.minor}/site-packages"))
+            site.addsitedir(os.path.expandvars(f"$PIPX_HOME/venvs/dash/lib/python{sys.version_info.major}.{sys.version_info.minor}/site-packages"))
+            import dash, pandas, plotly
+            assert dash.__version__ and pandas.__version__ and plotly.__version__
+            try:
+                os.setgid(int(os.getenv("SUDO_UID")))
+                os.setuid(int(os.getenv("SUDO_UID")))
+            except Exception:
+                pass
+            print(f"serving web gui on http://{os.getenv('HOST', 'localhost')}:{os.getenv('PORT', '5100')}")
+            print("if this fails, try running `picosnitch start-dash` to see any errors")
+            if sys.executable.startswith("/snap/") or sys.executable.startswith("/nix/"):
+                subprocess.Popen(["bash", "-c", f'/usr/bin/env python3 -m webbrowser -t http://{os.getenv("HOST", "localhost")}:{os.getenv("PORT", "5100")}'], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+                return ui_dash()
+            subprocess.Popen(["bash", "-c", f'let i=0; rm {BASE_PATH}/dash; while [[ ! -f {BASE_PATH}/dash || "$i" -gt 30 ]]; do let i++; sleep 1; done; rm {BASE_PATH}/dash && /usr/bin/env python3 -m webbrowser -t http://{os.getenv("HOST", "localhost")}:{os.getenv("PORT", "5100")}'], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+            args = ["bash", "-c", f"touch {BASE_PATH}/dash; nohup {sys.executable} \"{os.path.abspath(__file__)}\" start-dash > /dev/null 2>&1 &"]
+            os.execvp("bash", args)
+        # web gui without launching browser or detaching from terminal (intended for debugging)
+        elif sys.argv[1] == "start-dash":
+            return ui_dash()
+        # terminal interface
+        elif sys.argv[1] == "view":
+            return ui_init()
+        # show version or help if invalid argument and exit
+        elif sys.argv[1] == "version":
+            print(f"version: {VERSION} ({os.path.abspath(__file__)})\nconfig and log files: {BASE_PATH}")
+            return 0
+        else:
+            print(readme)
+            return 2
+        return 0
+    else:
+        print(readme)
+        return 2
+
+
+if __name__ == "__main__":
+    sys.exit(start_picosnitch())
+
diff --git a/picosnitch/constants.py b/picosnitch/constants.py
new file mode 100755
index 0000000..4537f5a
--- /dev/null
+++ b/picosnitch/constants.py
@@ -0,0 +1,99 @@
+#!/usr/bin/env python3
+# picosnitch
+# Copyright (C) 2020-2023 Eric Lesiuta
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+# https://github.com/elesiuta/picosnitch
+
+import json
+import os
+import pwd
+import resource
+import site
+import sys
+import time
+import typing
+
+# add site dirs for system and user installed packages (to import bcc with picosnitch installed via pipx/venv, or dependencies installed via user)
+site.addsitedir("/usr/lib/python3/dist-packages")
+site.addsitedir(os.path.expandvars("$PYTHON_USER_SITE"))
+import psutil
+
+# picosnitch version and supported platform
+VERSION: typing.Final[str] = "1.0.1"
+assert sys.version_info >= (3, 8), "Python version >= 3.8 is required"
+assert sys.platform.startswith("linux"), "Did not detect a supported operating system"
+
+# warning about -O (optimize) flag since asserts are disabled and some are critical
+if sys.flags.optimize > 0:
+    print("Warning: picosnitch does not function properly with the -O (optimize) flag", file=sys.stderr)
+
+# set constants and RLIMIT_NOFILE if configured
+if os.getuid() == 0:
+    if os.getenv("SUDO_UID"):
+        home_user = pwd.getpwuid(int(os.getenv("SUDO_UID"))).pw_name
+    elif os.getenv("SUDO_USER"):
+        home_user = os.getenv("SUDO_USER")
+    else:
+        for home_user in os.listdir("/home"):
+            try:
+                if pwd.getpwnam(home_user).pw_uid >= 1000:
+                    break
+            except Exception:
+                pass
+    home_dir = pwd.getpwnam(home_user).pw_dir
+    if not os.getenv("SUDO_UID"):
+        os.environ["SUDO_UID"] = str(pwd.getpwnam(home_user).pw_uid)
+    if not os.getenv("DBUS_SESSION_BUS_ADDRESS"):
+        os.environ["DBUS_SESSION_BUS_ADDRESS"] = f"unix:path=/run/user/{pwd.getpwnam(home_user).pw_uid}/bus"
+else:
+    home_dir = os.path.expanduser("~")
+    if sys.executable.startswith("/snap/"):
+        home_dir = home_dir.split("/snap/picosnitch")[0]
+BASE_PATH: typing.Final[str] = os.path.join(home_dir, ".config", "picosnitch")
+try:
+    file_path = os.path.join(BASE_PATH, "config.json")
+    with open(file_path, "r", encoding="utf-8", errors="surrogateescape") as json_file:
+        nofile = json.load(json_file)["Set RLIMIT_NOFILE"]
+    if type(nofile) == int:
+        try:
+            new_limit = (nofile, resource.getrlimit(resource.RLIMIT_NOFILE)[1])
+            resource.setrlimit(resource.RLIMIT_NOFILE, new_limit)
+            time.sleep(0.5)
+        except Exception as e:
+            print(type(e).__name__ + str(e.args), file=sys.stderr)
+            print("Error: Set RLIMIT_NOFILE was found in config.json but it could not be set", file=sys.stderr)
+except Exception:
+    pass
+FD_CACHE: typing.Final[int] = resource.getrlimit(resource.RLIMIT_NOFILE)[0] - 128
+PID_CACHE: typing.Final[int] = max(8192, 2*FD_CACHE)
+st_dev_mask = 0xffffffff
+try:
+    for part in psutil.disk_partitions():
+        if part.fstype == "btrfs":
+            st_dev_mask = 0
+            if not os.path.exists(os.path.join(BASE_PATH, "config.json")):
+                # only warn users about btrfs on first run (by checking for config.json)
+                print("Warning: running picosnitch on systems with btrfs is not fully supported due to dev number strangeness and non-unique inodes (this is still fine for most use cases)", file=sys.stderr)
+            break
+    file_path = os.path.join(BASE_PATH, "config.json")
+    with open(file_path, "r", encoding="utf-8", errors="surrogateescape") as json_file:
+        set_mask = json.load(json_file)["Set st_dev mask"]
+    if type(set_mask) == int:
+        st_dev_mask = set_mask
+except Exception:
+    pass
+ST_DEV_MASK: typing.Final[int] = st_dev_mask
+
diff --git a/picosnitch/daemon.py b/picosnitch/daemon.py
new file mode 100755
index 0000000..67b0cd1
--- /dev/null
+++ b/picosnitch/daemon.py
@@ -0,0 +1,140 @@
+#!/usr/bin/env python3
+# picosnitch
+# Copyright (C) 2020-2023 Eric Lesiuta
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+# https://github.com/elesiuta/picosnitch
+
+import atexit
+import os
+import signal
+import sys
+import time
+
+
+class Daemon:
+    """A generic daemon class based on http://www.jejik.com/files/examples/daemon3x.py"""
+    def __init__(self, pidfile):
+        self.pidfile = pidfile
+
+    def daemonize(self):
+        """Daemonize class. UNIX double fork mechanism."""
+        try:
+            pid = os.fork()
+            if pid > 0:
+                # exit first parent
+                sys.exit(0)
+        except OSError as err:
+            sys.stderr.write('fork #1 failed: {0}\n'.format(err))
+            sys.exit(1)
+        # decouple from parent environment
+        os.chdir('/')
+        os.setsid()
+        os.umask(0)
+        # do second fork
+        try:
+            pid = os.fork()
+            if pid > 0:
+                # exit from second parent
+                sys.exit(0)
+        except OSError as err:
+            sys.stderr.write('fork #2 failed: {0}\n'.format(err))
+            sys.exit(1)
+        # redirect standard file descriptors
+        sys.stdout.flush()
+        sys.stderr.flush()
+        si = open(os.devnull, 'r')
+        so = open(os.devnull, 'a+')
+        se = open(os.devnull, 'a+')
+        os.dup2(si.fileno(), sys.stdin.fileno())
+        os.dup2(so.fileno(), sys.stdout.fileno())
+        os.dup2(se.fileno(), sys.stderr.fileno())
+        # write pidfile
+        atexit.register(self.delpid)
+        pid = str(os.getpid())
+        with open(self.pidfile,'w+') as f:
+            f.write(pid + '\n')
+
+    def delpid(self):
+        os.remove(self.pidfile)
+
+    def getpid(self):
+        """Get the pid from the pidfile"""
+        try:
+            with open(self.pidfile, "r") as f:
+                pid = int(f.read().strip())
+        except IOError:
+            pid = None
+        return pid
+
+    def start(self):
+        """Start the daemon."""
+        # Check for a pidfile to see if the daemon already runs
+        pid = self.getpid()
+        if pid:
+            message = "pidfile {0} already exist. " + \
+                    "picosnitch already running?\n"
+            sys.stderr.write(message.format(self.pidfile))
+            sys.exit(1)
+        # Start the daemon
+        self.daemonize()
+        self.run()
+
+    def stop(self):
+        """Stop the daemon."""
+        pid = self.getpid()
+        if not pid:
+            message = "pidfile {0} does not exist. " + \
+                    "picosnitch not running?\n"
+            sys.stderr.write(message.format(self.pidfile))
+            return # not an error in a restart
+        # Try killing the daemon process
+        try:
+            while 1:
+                os.kill(pid, signal.SIGTERM)
+                time.sleep(0.1)
+        except OSError as err:
+            e = str(err.args)
+            if e.find("No such process") > 0:
+                if os.path.exists(self.pidfile):
+                    os.remove(self.pidfile)
+            else:
+                print (str(err.args))
+                sys.exit(1)
+
+    def restart(self):
+        """Restart the daemon."""
+        self.stop()
+        self.start()
+
+    def status(self):
+        """Get daemon status."""
+        pid = self.getpid()
+        if pid:
+            try:
+                with open(f"/proc/{pid}/cmdline", "r") as f:
+                    cmdline = f.read()
+            except Exception:
+                cmdline = ""
+            if "picosnitch" in cmdline:
+                print(f"picosnitch is currently running with pid {pid}.")
+            else:
+                print("pidfile exists however picosnitch was not detected.")
+        else:
+            print("picosnitch does not appear to be running.")
+
+    def run(self):
+        """Subclass Daemon and override this method"""
+
diff --git a/picosnitch/event_structures.py b/picosnitch/event_structures.py
new file mode 100755
index 0000000..57617c5
--- /dev/null
+++ b/picosnitch/event_structures.py
@@ -0,0 +1,61 @@
+#!/usr/bin/env python3
+# picosnitch
+# Copyright (C) 2020-2023 Eric Lesiuta
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+# https://github.com/elesiuta/picosnitch
+
+import ctypes
+import typing
+
+
+class BpfEvent(typing.TypedDict):
+    """Process and connection data for each event captured by the BPF program, and sent to the main & secondary processes"""
+    pid: int
+    name: str
+    fd: int
+    dev: int
+    ino: int
+    exe: str
+    cmdline: str
+    ppid: int
+    pname: str
+    pfd: int
+    pdev: int
+    pino: int
+    pexe: str
+    pcmdline: str
+    uid: int
+    send: int
+    recv: int
+    lport: int
+    rport: int
+    laddr: str
+    raddr: str
+    domain: str
+
+
+class FanotifyEventMetadata(ctypes.Structure):
+    """https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/uapi/linux/fanotify.h"""
+    _fields_ = [
+        ("event_len", ctypes.c_uint32),
+        ("vers", ctypes.c_uint8),
+        ("reserved", ctypes.c_uint8),
+        ("metadata_len", ctypes.c_uint16),
+        ("mask", ctypes.c_uint64),
+        ("fd", ctypes.c_int32),
+        ("pid", ctypes.c_int32)
+    ]
+
diff --git a/picosnitch/main_process.py b/picosnitch/main_process.py
new file mode 100755
index 0000000..c19118a
--- /dev/null
+++ b/picosnitch/main_process.py
@@ -0,0 +1,102 @@
+#!/usr/bin/env python3
+# picosnitch
+# Copyright (C) 2020-2023 Eric Lesiuta
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+# https://github.com/elesiuta/picosnitch
+
+import ctypes
+import ctypes.util
+import multiprocessing
+import os
+import signal
+import subprocess
+import sys
+import time
+
+from .constants import FD_CACHE
+from .monitor_subprocess import monitor_subprocess
+from .primary_subprocess import primary_subprocess
+from .process_manager import ProcessManager
+from .rfuse_subprocess import rfuse_subprocess
+from .secondary_subprocess import secondary_subprocess
+from .virustotal_subprocess import virustotal_subprocess
+
+
+def main_process(snitch: dict):
+    """coordinates all picosnitch subprocesses"""
+    # init fanotify
+    libc = ctypes.CDLL(ctypes.util.find_library("c"))
+    _FAN_CLASS_CONTENT = 0x4
+    _FAN_UNLIMITED_MARKS = 0x20
+    flags = _FAN_CLASS_CONTENT if FD_CACHE < 8192 else _FAN_CLASS_CONTENT | _FAN_UNLIMITED_MARKS
+    fan_fd = libc.fanotify_init(flags, os.O_RDONLY)
+    assert fan_fd >= 0, "fanotify_init() failed"
+    # start subprocesses
+    snitch_pipes = [multiprocessing.Pipe(duplex=False) for i in range(5)]
+    snitch_recv_pipes, snitch_send_pipes = zip(*snitch_pipes)
+    secondary_recv_pipe, secondary_send_pipe = multiprocessing.Pipe(duplex=False)
+    q_error = multiprocessing.Queue()
+    p_monitor = ProcessManager(name="snitchmonitor", target=monitor_subprocess,
+                               init_args=(snitch["Config"], fan_fd, snitch_send_pipes, q_error,))
+    p_rfuse = ProcessManager(name="snitchrfuse", target=rfuse_subprocess,
+                             init_args=(snitch["Config"], q_error,))
+    p_virustotal = ProcessManager(name="snitchvirustotal", target=virustotal_subprocess,
+                                  init_args=(snitch["Config"], q_error,))
+    p_primary = ProcessManager(name="snitchprimary", target=primary_subprocess,
+                               init_args=(snitch, snitch_recv_pipes, secondary_send_pipe, q_error,))
+    p_secondary = ProcessManager(name="snitchsecondary", target=secondary_subprocess,
+                           init_args=(snitch, fan_fd, p_rfuse, p_virustotal, secondary_recv_pipe, p_primary.q_in, q_error,))
+    # set signals
+    subprocesses = [p_monitor, p_rfuse, p_virustotal, p_primary, p_secondary]
+    def clean_exit():
+        _ = [p.terminate() for p in subprocesses]
+        sys.exit(0)
+    signal.signal(signal.SIGINT, lambda *args: clean_exit())
+    signal.signal(signal.SIGTERM, lambda *args: clean_exit())
+    # watch subprocesses
+    suspend_check_last = time.time()
+    try:
+        while True:
+            time.sleep(5)
+            if not all(p.is_alive() for p in subprocesses):
+                dead = " ".join([p.name for p in subprocesses if not p.is_alive()])
+                q_error.put(f"picosnitch subprocess died, attempting restart, terminate by running `picosnitch stop` ({dead})")
+                break
+            if any(p.is_zombie() for p in subprocesses):
+                zombies = " ".join([p.name for p in subprocesses if p.is_zombie()])
+                q_error.put(f"picosnitch subprocess became a zombie, attempting restart ({zombies})")
+                break
+            if sum(p.memory() for p in subprocesses) > 4096000000:
+                q_error.put("picosnitch memory usage exceeded 4096 MB, attempting restart")
+                break
+            suspend_check_now = time.time()
+            if suspend_check_now - suspend_check_last > 20:
+                p_monitor.q_in.put("terminate")
+                p_monitor.terminate()
+                _ = p_monitor.q_in.get()
+                p_monitor.start()
+            suspend_check_last = suspend_check_now
+    except Exception as e:
+        q_error.put("picosnitch subprocess exception: %s%s on line %s" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno))
+    if sys.argv[1] == "start-no-daemon":
+        return 1
+    # attempt to restart picosnitch (terminate by running `picosnitch stop`)
+    time.sleep(5)
+    _ = [p.terminate() for p in subprocesses]
+    args = [sys.executable, os.path.abspath(__file__), "restart"]
+    subprocess.Popen(args)
+    return 0
+
diff --git a/picosnitch/monitor_subprocess.py b/picosnitch/monitor_subprocess.py
new file mode 100755
index 0000000..3149cf8
--- /dev/null
+++ b/picosnitch/monitor_subprocess.py
@@ -0,0 +1,495 @@
+#!/usr/bin/env python3
+# picosnitch
+# Copyright (C) 2020-2023 Eric Lesiuta
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+# https://github.com/elesiuta/picosnitch
+
+import collections
+import ctypes
+import ctypes.util
+import functools
+import ipaddress
+import multiprocessing
+import os
+import pickle
+import signal
+import site
+import socket
+import struct
+import sys
+import time
+import typing
+
+# add site dirs for system and user installed packages (to import bcc with picosnitch installed via pipx/venv, or dependencies installed via user)
+site.addsitedir("/usr/lib/python3/dist-packages")
+site.addsitedir(os.path.expandvars("$PYTHON_USER_SITE"))
+import psutil
+
+from .constants import FD_CACHE, PID_CACHE, ST_DEV_MASK
+
+
+def monitor_subprocess_initial_poll() -> list:
+    """poll initial processes and connections using psutil"""
+    initial_processes = []
+    for pid in psutil.pids():
+        try:
+            proc = psutil.Process(pid).as_dict(attrs=["name", "exe", "pid", "ppid", "uids"], ad_value="")
+            proc["uid"] = proc["uids"][0]
+            proc["pname"] = psutil.Process(proc["ppid"]).name()
+            proc["raddr"] = ""
+            proc["rport"] = -1
+            proc["laddr"] = ""
+            proc["lport"] = -1
+            initial_processes.append(proc)
+        except Exception:
+            pass
+    for conn in psutil.net_connections(kind="all"):
+        try:
+            proc = psutil.Process(conn.pid).as_dict(attrs=["name", "exe", "pid", "ppid", "uids"], ad_value="")
+            proc["uid"] = proc["uids"][0]
+            proc["pname"] = psutil.Process(proc["ppid"]).name()
+            proc["raddr"] = conn.raddr.ip
+            proc["rport"] = conn.raddr.port
+            proc["laddr"] = conn.laddr.ip
+            proc["lport"] = conn.laddr.port
+            initial_processes.append(proc)
+        except Exception:
+            pass
+    return initial_processes
+
+
+def monitor_subprocess(config: dict, fan_fd, snitch_pipes, q_error, q_in, _q_out):
+    """runs a bpf program to monitor the system for new connections and puts info into a pipe for primary_subprocess"""
+    # initialization of subprocess
+    try:
+        os.nice(-20)
+    except Exception:
+        pass
+    import bcc
+    from bcc import BPF
+    parent_process = multiprocessing.parent_process()
+    signal.signal(signal.SIGTERM, lambda *args: sys.exit(0))
+    snitch_pipe_0, snitch_pipe_1, snitch_pipe_2, snitch_pipe_3, snitch_pipe_4 = snitch_pipes
+    EVERY_EXE: typing.Final[bool] = config["Every exe (not just conns)"]
+    PAGE_CNT: typing.Final[int] = config["Perf ring buffer (pages)"]
+    # fanotify (for watching executables for modification)
+    libc = ctypes.CDLL(ctypes.util.find_library("c"))
+    _FAN_MARK_ADD = 0x1
+    _FAN_MARK_REMOVE = 0x2
+    _FAN_MARK_FLUSH = 0x80
+    _FAN_MODIFY = 0x2
+    libc.fanotify_mark(fan_fd, _FAN_MARK_FLUSH, _FAN_MODIFY, -1, None)
+    # domain and file descriptor cache, domains are cached for the life of the program, fd has a fixed size, populate with dummy values
+    domain_dict = collections.defaultdict(str)
+    fd_dict = collections.OrderedDict()
+    for x in range(FD_CACHE):
+        fd_dict[f"tmp{x}"] = (0,)
+    self_pid = os.getpid()
+    # function for getting an existing or opening a new file descriptor based on st_dev and st_ino
+    def get_fd(st_dev: int, st_ino: int, pid: int, port: int) -> typing.Tuple[int, int, int, str, str]:
+        st_dev = st_dev & ST_DEV_MASK
+        sig = f"{st_dev} {st_ino}"
+        try:
+            # check if it is in the cache and move it to the most recent position
+            fd_dict.move_to_end(sig)
+            fd, fd_path, exe = fd_dict[sig]
+            if not fd:
+                # sig is in cache but fd is 0, try again to open it
+                # add a dummy value to the oldest postition to be popped off on retry so cache size is maintained
+                # since sig is already in cache, value will just be updated without increasing cache size
+                fd_dict[f"tmp{sig}"] = (0,)
+                fd_dict.move_to_end(f"tmp{sig}", last=False)
+                raise Exception("previous attempt failed, probably due to process terminating too quickly, try again")
+        except Exception:
+            # open a new file descriptor and pop off the oldest one
+            # watch it with fanotify, and also cache the apparent executable path with it
+            try:
+                fd = os.open(f"/proc/{pid}/exe", os.O_RDONLY)
+                libc.fanotify_mark(fan_fd, _FAN_MARK_ADD, _FAN_MODIFY, fd, None)
+                fd_path = f"/proc/{self_pid}/fd/{fd}"
+            except Exception:
+                fd, fd_path = 0, ""
+            try:
+                exe = os.readlink(f"/proc/{pid}/exe")
+            except Exception:
+                exe = ""
+            if fd and (st_dev, st_ino) != get_fstat(fd):
+                if EVERY_EXE or port != -1:
+                    q_error.put(f"Exe inode changed for (pid: {pid} fd: {fd} dev: {st_dev} ino: {st_ino}) before FD could be opened, using port: {port}")
+                st_dev, st_ino = get_fstat(fd)
+                sig = f"{st_dev} {st_ino}"
+                if EVERY_EXE or port != -1:
+                    q_error.put(f"New inode for (pid: {pid} fd: {fd} dev: {st_dev} ino: {st_ino} exe: {exe})")
+            fd_dict[sig] = (fd, fd_path, exe)
+            try:
+                if fd_old := fd_dict.popitem(last=False)[1][0]:
+                    libc.fanotify_mark(fan_fd, _FAN_MARK_REMOVE, _FAN_MODIFY, fd_old, None)
+                    os.close(fd_old)
+            except Exception:
+                pass
+        return (st_dev, st_ino, pid, fd_path, exe)
+    # function for getting or looking up the cmdline for a pid
+    @functools.lru_cache(maxsize=PID_CACHE)
+    def get_cmdline(pid: int) -> str:
+        try:
+            with open(f"/proc/{pid}/cmdline", "r") as f:
+                return f.read()
+        except Exception:
+            return ""
+    # get current connections
+    for proc in monitor_subprocess_initial_poll():
+        try:
+            stat = os.stat(f"/proc/{proc['pid']}/exe")
+            pstat = os.stat(f"/proc/{proc['ppid']}/exe")
+            cmd = get_cmdline(proc["pid"])
+            pcmd = get_cmdline(proc["ppid"])
+            st_dev, st_ino, pid, fd, exe = get_fd(stat.st_dev, stat.st_ino, proc["pid"], proc["rport"])
+            pst_dev, pst_ino, ppid, pfd, pexe = get_fd(pstat.st_dev, pstat.st_ino, proc["ppid"], -1)
+            if EVERY_EXE or proc["rport"] != -1:
+                snitch_pipe_0.send_bytes(pickle.dumps({"pid": pid, "name": proc["name"], "fd": fd, "dev": st_dev, "ino": st_ino, "exe": exe, "cmdline": cmd,
+                                                     "ppid": ppid, "pname": proc["pname"], "pfd": pfd, "pdev": pst_dev, "pino": pst_ino, "pexe": pexe, "pcmdline": pcmd,
+                                                     "uid": proc["uid"], "send": 0, "recv": 0, "lport": proc["lport"], "rport": proc["rport"], "laddr": proc["laddr"], "raddr": proc["raddr"], "domain": domain_dict[proc["raddr"]]}))
+        except Exception:
+            pass
+    # initialize bpf program
+    bpf_text = bpf_text_base + bpf_text_bandwidth_structs + bpf_text_bandwidth_probe.replace("int flags, ", "") + bpf_text_bandwidth_probe.replace("sendmsg", "recvmsg")
+    try:
+        assert BPF.support_kfunc(), "BPF.support_kfunc() was not True, check BCC version or Kernel Configuration"
+        b = BPF(text=bpf_text)
+        b.attach_kretprobe(event=b.get_syscall_fnname("execve"), fn_name="exec_entry")
+    except Exception as e:
+        q_error.put("Init BPF %s%s on line %s" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno))
+        time.sleep(5)
+        os.kill(parent_process.pid, signal.SIGTERM)
+        raise e
+    use_getaddrinfo_uprobe = False
+    if bcc.__version__ == "EAD-HASH-NOTFOUND+GITDIR-N" or tuple(map(int, bcc.__version__.split(".")[0:2])) >= (0, 23):
+        try:
+            b.attach_uprobe(name="c", sym="getaddrinfo", fn_name="dns_entry")
+            b.attach_uretprobe(name="c", sym="getaddrinfo", fn_name="dns_return")
+            use_getaddrinfo_uprobe = True
+        except Exception:
+            q_error.put("BPF.attach_uprobe() failed for getaddrinfo, falling back to only using reverse DNS lookup")
+    # callbacks for bpf events, read event and put into a pipe for primary_subprocess
+    def queue_lost(event, *args):
+        q_error.put(f"BPF callbacks not processing fast enough, missed {event} event, try increasing 'Perf ring buffer (pages)' (power of two) if this continues")
+    def queue_sendv4_event(cpu, data, size):
+        event = b["sendmsg_events"].event(data)
+        st_dev, st_ino, pid, fd, exe = get_fd(event.dev, event.ino, event.pid, event.dport)
+        pst_dev, pst_ino, ppid, pfd, pexe = get_fd(event.pdev, event.pino, event.ppid, -1)
+        cmd = get_cmdline(event.pid)
+        pcmd = get_cmdline(event.ppid)
+        laddr = socket.inet_ntop(socket.AF_INET, struct.pack("I", event.saddr))
+        raddr = socket.inet_ntop(socket.AF_INET, struct.pack("I", event.daddr))
+        snitch_pipe_0.send_bytes(pickle.dumps({"pid": pid, "name": event.comm.decode(), "fd": fd, "dev": st_dev, "ino": st_ino, "exe": exe, "cmdline": cmd,
+                                             "ppid": ppid, "pname": event.pcomm.decode(), "pfd": pfd, "pdev": pst_dev, "pino": pst_ino, "pexe": pexe, "pcmdline": pcmd,
+                                             "uid": event.uid, "send": event.bytes, "recv": 0, "lport": event.lport, "rport": event.dport, "laddr": laddr, "raddr": raddr, "domain": domain_dict[raddr]}))
+    def queue_sendv6_event(cpu, data, size):
+        event = b["sendmsg6_events"].event(data)
+        st_dev, st_ino, pid, fd, exe = get_fd(event.dev, event.ino, event.pid, event.dport)
+        pst_dev, pst_ino, ppid, pfd, pexe = get_fd(event.pdev, event.pino, event.ppid, -1)
+        cmd = get_cmdline(event.pid)
+        pcmd = get_cmdline(event.ppid)
+        laddr = socket.inet_ntop(socket.AF_INET6, event.saddr)
+        raddr = socket.inet_ntop(socket.AF_INET6, event.daddr)
+        snitch_pipe_1.send_bytes(pickle.dumps({"pid": pid, "name": event.comm.decode(), "fd": fd, "dev": st_dev, "ino": st_ino, "exe": exe, "cmdline": cmd,
+                                             "ppid": ppid, "pname": event.pcomm.decode(), "pfd": pfd, "pdev": pst_dev, "pino": pst_ino, "pexe": pexe, "pcmdline": pcmd,
+                                             "uid": event.uid, "send": event.bytes, "recv": 0, "lport": event.lport, "rport": event.dport, "laddr": laddr, "raddr": raddr, "domain": domain_dict[raddr]}))
+    def queue_recvv4_event(cpu, data, size):
+        event = b["recvmsg_events"].event(data)
+        st_dev, st_ino, pid, fd, exe = get_fd(event.dev, event.ino, event.pid, event.dport)
+        pst_dev, pst_ino, ppid, pfd, pexe = get_fd(event.pdev, event.pino, event.ppid, -1)
+        cmd = get_cmdline(event.pid)
+        pcmd = get_cmdline(event.ppid)
+        laddr = socket.inet_ntop(socket.AF_INET, struct.pack("I", event.saddr))
+        raddr = socket.inet_ntop(socket.AF_INET, struct.pack("I", event.daddr))
+        snitch_pipe_2.send_bytes(pickle.dumps({"pid": pid, "name": event.comm.decode(), "fd": fd, "dev": st_dev, "ino": st_ino, "exe": exe, "cmdline": cmd,
+                                             "ppid": ppid, "pname": event.pcomm.decode(), "pfd": pfd, "pdev": pst_dev, "pino": pst_ino, "pexe": pexe, "pcmdline": pcmd,
+                                             "uid": event.uid, "send": 0, "recv": event.bytes, "lport": event.lport, "rport": event.dport, "laddr": laddr, "raddr": raddr, "domain": domain_dict[raddr]}))
+    def queue_recvv6_event(cpu, data, size):
+        event = b["recvmsg6_events"].event(data)
+        st_dev, st_ino, pid, fd, exe = get_fd(event.dev, event.ino, event.pid, event.dport)
+        pst_dev, pst_ino, ppid, pfd, pexe = get_fd(event.pdev, event.pino, event.ppid, -1)
+        cmd = get_cmdline(event.pid)
+        pcmd = get_cmdline(event.ppid)
+        laddr = socket.inet_ntop(socket.AF_INET6, event.saddr)
+        raddr = socket.inet_ntop(socket.AF_INET6, event.daddr)
+        snitch_pipe_3.send_bytes(pickle.dumps({"pid": pid, "name": event.comm.decode(), "fd": fd, "dev": st_dev, "ino": st_ino, "exe": exe, "cmdline": cmd,
+                                             "ppid": ppid, "pname": event.pcomm.decode(), "pfd": pfd, "pdev": pst_dev, "pino": pst_ino, "pexe": pexe, "pcmdline": pcmd,
+                                             "uid": event.uid, "send": 0, "recv": event.bytes, "lport": event.lport, "rport": event.dport, "laddr": laddr, "raddr": raddr, "domain": domain_dict[raddr]}))
+    def queue_exec_event(cpu, data, size):
+        event = b["exec_events"].event(data)
+        st_dev, st_ino, pid, fd, exe = get_fd(event.dev, event.ino, event.pid, -1)
+        pst_dev, pst_ino, ppid, pfd, pexe = get_fd(event.pdev, event.pino, event.ppid, -1)
+        cmd = get_cmdline(event.pid)
+        pcmd = get_cmdline(event.ppid)
+        if EVERY_EXE:
+            snitch_pipe_4.send_bytes(pickle.dumps({"pid": pid, "name": event.comm.decode(), "fd": fd, "dev": st_dev, "ino": st_ino, "exe": exe, "cmdline": cmd,
+                                                 "ppid": ppid, "pname": event.pcomm.decode(), "pfd": pfd, "pdev": pst_dev, "pino": pst_ino, "pexe": pexe, "pcmdline": pcmd,
+                                                 "uid": event.uid, "send": 0, "recv": 0, "lport": -1, "rport": -1, "laddr": "", "raddr": "", "domain": ""}))
+    def queue_dns_event(cpu, data, size):
+        event = b["dns_events"].event(data)
+        if event.daddr:
+            ip = socket.inet_ntop(socket.AF_INET, struct.pack("I", event.daddr))
+        else:
+            ip = socket.inet_ntop(socket.AF_INET6, event.daddr6)
+        domain = event.host.decode("utf-8", "replace")
+        try:
+            _ = ipaddress.ip_address(domain)
+        except ValueError:
+            domain_dict[ip] = ".".join(reversed(domain.split(".")))
+    b["exec_events"].open_perf_buffer(queue_exec_event, page_cnt=PAGE_CNT, lost_cb=lambda *args: queue_lost("exec", *args))
+    if use_getaddrinfo_uprobe:
+        b["dns_events"].open_perf_buffer(queue_dns_event, page_cnt=PAGE_CNT, lost_cb=lambda *args: queue_lost("dns", *args))
+    b["sendmsg_events"].open_perf_buffer(queue_sendv4_event, page_cnt=PAGE_CNT*4, lost_cb=lambda *args: queue_lost("sendv4", *args))
+    b["sendmsg6_events"].open_perf_buffer(queue_sendv6_event, page_cnt=PAGE_CNT*4, lost_cb=lambda *args: queue_lost("sendv6", *args))
+    b["recvmsg_events"].open_perf_buffer(queue_recvv4_event, page_cnt=PAGE_CNT*4, lost_cb=lambda *args: queue_lost("recvv4", *args))
+    b["recvmsg6_events"].open_perf_buffer(queue_recvv6_event, page_cnt=PAGE_CNT*4, lost_cb=lambda *args: queue_lost("recvv6", *args))
+    # main loop
+    while True:
+        if not parent_process.is_alive() or not q_in.empty():
+            return 0
+        try:
+            b.perf_buffer_poll(timeout=-1)
+        except Exception as e:
+            q_error.put("BPF %s%s on line %s" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno))
+
+
+bpf_text_base = """
+// This eBPF program was based on the following sources
+// https://github.com/p-/socket-connect-bpf/blob/7f386e368759e53868a078570254348e73e73e22/securitySocketConnectSrc.bpf
+// https://github.com/iovisor/bcc/blob/master/tools/execsnoop.py
+// https://github.com/iovisor/bcc/blob/master/tools/gethostlatency.py
+// https://github.com/iovisor/bcc/blob/master/tools/tcpconnect.py
+// https://www.gcardone.net/2020-07-31-per-process-bandwidth-monitoring-on-Linux-with-bpftrace/
+
+#include <uapi/linux/ptrace.h>
+#include <linux/socket.h>
+#include <linux/sched.h>
+#include <linux/in.h>
+#include <linux/in6.h>
+#include <linux/ip.h>
+#include <net/sock.h>
+
+struct addrinfo {
+    int ai_flags;
+    int ai_family;
+    int ai_socktype;
+    int ai_protocol;
+    u32 ai_addrlen;
+    struct sockaddr *ai_addr;
+    char *ai_canonname;
+    struct addrinfo *ai_next;
+};
+
+struct dns_val_t {
+    char host[80];
+    struct addrinfo **res;
+};
+BPF_HASH(dns_hash, u32, struct dns_val_t);
+
+struct dns_event_t {
+    char host[80];
+    u32 daddr;
+    unsigned __int128 daddr6;
+} __attribute__((packed));
+BPF_PERF_OUTPUT(dns_events);
+
+struct exec_event_t {
+    char comm[TASK_COMM_LEN];
+    char pcomm[TASK_COMM_LEN];
+    u64 ino;
+    u64 pino;
+    u32 pid;
+    u32 ppid;
+    u32 uid;
+    u32 dev;
+    u32 pdev;
+} __attribute__((packed));
+BPF_PERF_OUTPUT(exec_events);
+
+int dns_entry(struct pt_regs *ctx, const char *node, const char *service, const struct addrinfo *hints, struct addrinfo **res) {
+    if (PT_REGS_PARM1(ctx)) {
+        struct dns_val_t val = {.res = res};
+        if (bpf_probe_read_user(&val.host, sizeof(val.host), (void *)PT_REGS_PARM1(ctx)) == 0) {
+            u32 tid = (u32)bpf_get_current_pid_tgid();
+            dns_hash.update(&tid, &val);
+        }
+    }
+    return 0;
+}
+
+int dns_return(struct pt_regs *ctx) {
+    struct dns_val_t *valp;
+    u32 tid = (u32)bpf_get_current_pid_tgid();
+    valp = dns_hash.lookup(&tid);
+    if (valp) {
+        struct dns_event_t data = {};
+        bpf_probe_read_kernel(&data.host, sizeof(data.host), (void *)valp->host);
+        struct addrinfo *address;
+        bpf_probe_read(&address, sizeof(address), valp->res);
+        for (int i = 0; i < 8; i++) {
+            u32 address_family;
+            bpf_probe_read(&address_family, sizeof(address_family), &address->ai_family);
+            if (address_family == AF_INET) {
+                struct sockaddr_in *daddr;
+                bpf_probe_read(&daddr, sizeof(daddr), &address->ai_addr);
+                bpf_probe_read(&data.daddr, sizeof(data.daddr), &daddr->sin_addr.s_addr);
+                dns_events.perf_submit(ctx, &data, sizeof(data));
+            }
+            else if (address_family == AF_INET6) {
+                struct sockaddr_in6 *daddr6;
+                bpf_probe_read(&daddr6, sizeof(daddr6), &address->ai_addr);
+                bpf_probe_read(&data.daddr6, sizeof(data.daddr6), &daddr6->sin6_addr.in6_u.u6_addr32);
+                dns_events.perf_submit(ctx, &data, sizeof(data));
+            }
+            if (bpf_probe_read(&address, sizeof(address), &address->ai_next) != 0) break;
+            struct dns_event_t data = {};
+            bpf_probe_read_kernel(&data.host, sizeof(data.host), (void *)valp->host);
+        }
+        dns_hash.delete(&tid);
+    }
+    return 0;
+}
+
+int exec_entry(struct pt_regs *ctx) {
+    if (PT_REGS_RC(ctx) == 0) {
+        struct exec_event_t data = {};
+        data.pid = bpf_get_current_pid_tgid() >> 32;
+        data.uid = bpf_get_current_uid_gid();
+        struct task_struct *task = (struct task_struct *)bpf_get_current_task();
+        data.ppid = task->real_parent->tgid;
+        data.ino = task->mm->exe_file->f_path.dentry->d_inode->i_ino;
+        data.dev = task->mm->exe_file->f_path.dentry->d_inode->i_sb->s_dev;
+        data.dev = new_encode_dev(data.dev);
+        data.pino = task->real_parent->mm->exe_file->f_path.dentry->d_inode->i_ino;
+        data.pdev = task->real_parent->mm->exe_file->f_path.dentry->d_inode->i_sb->s_dev;
+        data.pdev = new_encode_dev(data.pdev);
+        bpf_get_current_comm(&data.comm, sizeof(data.comm));
+        bpf_probe_read_kernel_str(&data.pcomm, sizeof(data.pcomm), &task->real_parent->comm);
+        exec_events.perf_submit(ctx, &data, sizeof(data));
+    }
+    return 0;
+}
+"""
+
+
+bpf_text_bandwidth_structs = """
+struct sendrecv_event_t {
+    char comm[TASK_COMM_LEN];
+    char pcomm[TASK_COMM_LEN];
+    u64 ino;
+    u64 pino;
+    u32 pid;
+    u32 ppid;
+    u32 uid;
+    u32 dev;
+    u32 pdev;
+    u32 bytes;
+    u32 daddr;
+    u32 saddr;
+    u16 dport;
+    u16 lport;
+} __attribute__((packed));
+BPF_PERF_OUTPUT(sendmsg_events);
+BPF_PERF_OUTPUT(recvmsg_events);
+
+struct sendrecv6_event_t {
+    char comm[TASK_COMM_LEN];
+    char pcomm[TASK_COMM_LEN];
+    unsigned __int128 daddr;
+    unsigned __int128 saddr;
+    u64 ino;
+    u64 pino;
+    u32 pid;
+    u32 ppid;
+    u32 uid;
+    u32 dev;
+    u32 pdev;
+    u32 bytes;
+    u16 dport;
+    u16 lport;
+} __attribute__((packed));
+BPF_PERF_OUTPUT(sendmsg6_events);
+BPF_PERF_OUTPUT(recvmsg6_events);
+"""
+
+
+bpf_text_bandwidth_probe = """
+KRETFUNC_PROBE(sock_sendmsg, struct socket *sock, struct msghdr *msg, int flags, u32 retval) {
+    if (retval >= 0 && retval < 0x7fffffff) {
+        u32 pid = bpf_get_current_pid_tgid() >> 32;
+        u32 uid = bpf_get_current_uid_gid();
+        struct task_struct *task, *parent;
+        struct mm_struct *mm;
+        struct file *exe_file;
+        struct dentry *exe_dentry;
+        struct inode *exe_inode;
+        struct super_block *exe_sb;
+        u64 ino, pino;
+        u32 ppid, dev, pdev;
+        task = (struct task_struct *)bpf_get_current_task();
+        // u32 ppid = task->real_parent->tgid;
+        // u64 ino = task->mm->exe_file->f_path.dentry->d_inode->i_ino;
+        // u32 dev = task->mm->exe_file->f_path.dentry->d_inode->i_sb->s_dev;
+        if (bpf_probe_read_kernel(&parent, sizeof(parent), &task->real_parent)) return 0;
+        if (bpf_probe_read_kernel(&ppid, sizeof(ppid), &parent->tgid)) return 0;
+        if (bpf_probe_read_kernel(&mm, sizeof(mm), &task->mm)) return 0;
+        if (bpf_probe_read_kernel(&exe_file, sizeof(exe_file), &mm->exe_file)) return 0;
+        if (bpf_probe_read_kernel(&exe_dentry, sizeof(exe_dentry), &exe_file->f_path.dentry)) return 0;
+        if (bpf_probe_read_kernel(&exe_inode, sizeof(exe_inode), &exe_dentry->d_inode)) return 0;
+        if (bpf_probe_read_kernel(&ino, sizeof(ino), &exe_inode->i_ino)) return 0;
+        if (bpf_probe_read_kernel(&exe_sb, sizeof(exe_sb), &exe_inode->i_sb)) return 0;
+        if (bpf_probe_read_kernel(&dev, sizeof(dev), &exe_sb->s_dev)) return 0;
+        dev = new_encode_dev(dev);
+        // u64 pino = task->real_parent->mm->exe_file->f_path.dentry->d_inode->i_ino;
+        // u32 pdev = task->real_parent->mm->exe_file->f_path.dentry->d_inode->i_sb->s_dev;
+        if (bpf_probe_read_kernel(&mm, sizeof(mm), &parent->mm)) return 0;
+        if (bpf_probe_read_kernel(&exe_file, sizeof(exe_file), &mm->exe_file)) return 0;
+        if (bpf_probe_read_kernel(&exe_dentry, sizeof(exe_dentry), &exe_file->f_path.dentry)) return 0;
+        if (bpf_probe_read_kernel(&exe_inode, sizeof(exe_inode), &exe_dentry->d_inode)) return 0;
+        if (bpf_probe_read_kernel(&pino, sizeof(pino), &exe_inode->i_ino)) return 0;
+        if (bpf_probe_read_kernel(&exe_sb, sizeof(exe_sb), &exe_inode->i_sb)) return 0;
+        if (bpf_probe_read_kernel(&pdev, sizeof(pdev), &exe_sb->s_dev)) return 0;
+        pdev = new_encode_dev(pdev);
+        u32 address_family = sock->sk->__sk_common.skc_family;
+        if (address_family == AF_INET) {
+            struct sendrecv_event_t data = {.pid = pid, .ppid = ppid, .uid = uid, .dev = dev, .pdev = pdev, .ino = ino, .pino = pino, .bytes = retval};
+            bpf_get_current_comm(&data.comm, sizeof(data.comm));
+            bpf_probe_read_kernel_str(&data.pcomm, sizeof(data.pcomm), &parent->comm);
+            bpf_probe_read(&data.daddr, sizeof(data.daddr), &sock->sk->__sk_common.skc_daddr);
+            bpf_probe_read(&data.saddr, sizeof(data.saddr), &sock->sk->__sk_common.skc_rcv_saddr);
+            bpf_probe_read(&data.dport, sizeof(data.dport), &sock->sk->__sk_common.skc_dport);
+            bpf_probe_read(&data.lport, sizeof(data.lport), &sock->sk->__sk_common.skc_num);
+            data.dport = ntohs(data.dport);
+            sendmsg_events.perf_submit(ctx, &data, sizeof(data));
+        }
+        else if (address_family == AF_INET6) {
+            struct sendrecv6_event_t data = {.pid = pid, .ppid = ppid, .uid = uid, .dev = dev, .pdev = pdev, .ino = ino, .pino = pino, .bytes = retval};
+            bpf_get_current_comm(&data.comm, sizeof(data.comm));
+            bpf_probe_read_kernel_str(&data.pcomm, sizeof(data.pcomm), &parent->comm);
+            bpf_probe_read(&data.daddr, sizeof(data.daddr), &sock->sk->__sk_common.skc_v6_daddr);
+            bpf_probe_read(&data.saddr, sizeof(data.saddr), &sock->sk->__sk_common.skc_v6_rcv_saddr);
+            bpf_probe_read(&data.dport, sizeof(data.dport), &sock->sk->__sk_common.skc_dport);
+            bpf_probe_read(&data.lport, sizeof(data.lport), &sock->sk->__sk_common.skc_num);
+            data.dport = ntohs(data.dport);
+            sendmsg6_events.perf_submit(ctx, &data, sizeof(data));
+        }
+    }
+    return 0;
+}
+"""
+
diff --git a/picosnitch/notifcation_manager.py b/picosnitch/notifcation_manager.py
new file mode 100755
index 0000000..3ec6ff8
--- /dev/null
+++ b/picosnitch/notifcation_manager.py
@@ -0,0 +1,73 @@
+#!/usr/bin/env python3
+# picosnitch
+# Copyright (C) 2020-2023 Eric Lesiuta
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+# https://github.com/elesiuta/picosnitch
+
+import os
+import sys
+
+
+class NotificationManager:
+    """A singleton for creating system tray notifications, holds notifications in queue if fails, prints if disabled"""
+    __instance = None
+    dbus_notifications = False
+    notifications_ready = False
+    notification_queue = []
+    last_notification = ""
+    def __new__(cls, *args, **kwargs):
+        if not cls.__instance:
+            cls.__instance = super(NotificationManager, cls).__new__(cls, *args, **kwargs)
+        return cls.__instance
+
+    def enable_notifications(self):
+        self.dbus_notifications = True
+        try:
+            import dbus
+            os.seteuid(int(os.getenv("SUDO_UID")))
+            dbus_session_obj = dbus.SessionBus().get_object("org.freedesktop.Notifications", "/org/freedesktop/Notifications")
+            interface = dbus.Interface(dbus_session_obj, "org.freedesktop.Notifications")
+            self.system_notification = lambda msg: interface.Notify("picosnitch", 0, "", "picosnitch", msg, [], [], 2000)
+            self.notifications_ready = True
+        except Exception:
+            pass
+        finally:
+            os.seteuid(os.getuid())
+
+    def toast(self, msg: str, file=sys.stdout) -> None:
+        try:
+            if self.notifications_ready:
+                if self.last_notification != msg:
+                    self.last_notification = msg
+                    self.system_notification(msg)
+            else:
+                print(msg, file=file)
+                self.notification_queue.append(msg)
+                if self.dbus_notifications:
+                    self.enable_notifications()
+                    if self.notifications_ready:
+                        for msg in self.notification_queue:
+                            try:
+                                if self.last_notification != msg:
+                                    self.last_notification = msg
+                                    self.system_notification(msg)
+                            except Exception:
+                                pass
+                        self.notification_queue = []
+        except Exception:
+            self.notification_queue.append(msg)
+            self.notifications_ready = False
+
diff --git a/picosnitch/primary_subprocess.py b/picosnitch/primary_subprocess.py
new file mode 100755
index 0000000..4a03072
--- /dev/null
+++ b/picosnitch/primary_subprocess.py
@@ -0,0 +1,182 @@
+#!/usr/bin/env python3
+# picosnitch
+# Copyright (C) 2020-2023 Eric Lesiuta
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+# https://github.com/elesiuta/picosnitch
+
+import multiprocessing
+import os
+import pickle
+import signal
+import sys
+import threading
+import time
+import typing
+
+from .event_structures import BpfEvent
+from .notifcation_manager import NotificationManager
+from .utils import write_snitch
+
+
+def primary_subprocess_helper(snitch: dict, new_processes: typing.List[bytes]) -> None:
+    """iterate over the list of process/connection data to update the snitch dictionary and create notifications on new entries"""
+    datetime_now = time.strftime("%Y-%m-%d %H:%M:%S")
+    for proc_pickle in new_processes:
+        proc: BpfEvent = pickle.loads(proc_pickle)
+        proc_name, proc_exe, snitch_names, snitch_executables, parent = proc["name"], proc["exe"], snitch["Names"], snitch["Executables"], ""
+        for i in range(2):
+            notification = []
+            if proc_name in snitch_names:
+                if proc_exe not in snitch_names[proc_name]:
+                    snitch_names[proc_name].append(proc_exe)
+            else:
+                snitch_names[proc_name] = [proc_exe]
+                notification.append("name")
+            if proc_exe in snitch_executables:
+                if proc_name not in snitch_executables[proc_exe]:
+                    snitch_executables[proc_exe].append(proc_name)
+            else:
+                snitch_executables[proc_exe] = [proc_name]
+                notification.append("exe")
+                if proc_exe not in snitch["SHA256"]:
+                    snitch["SHA256"][proc_exe] = {}
+            if notification:
+                snitch["Exe Log"].append(f"{datetime_now} {proc_name:<16.16} {proc_exe} (new {', '.join(notification)}){parent}")
+                NotificationManager().toast(f"picosnitch: {proc_name} {proc_exe}")
+            proc_name, proc_exe, snitch_names, snitch_executables, parent = proc["pname"], proc["pexe"], snitch["Parent Names"], snitch["Parent Executables"], " (parent)"
+
+
+def primary_subprocess(snitch, snitch_pipes, secondary_pipe, q_error, q_in, _q_out):
+    """first to receive connection data from monitor, more responsive than secondary, creates notifications and writes exe.log, error.log, and record.json"""
+    try:
+        os.nice(-20)
+    except Exception:
+        pass
+    # init variables for loop
+    parent_process = multiprocessing.parent_process()
+    snitch_record = pickle.dumps([snitch["Executables"], snitch["Names"], snitch["Parent Executables"], snitch["Parent Names"], snitch["SHA256"]])
+    last_write = 0
+    write_record = False
+    processes_to_send = []
+    # init notifications
+    if snitch["Config"]["Desktop notifications"]:
+        NotificationManager().enable_notifications()
+    # init signal handlers
+    def write_snitch_and_exit(snitch: dict, q_error: multiprocessing.Queue, snitch_pipes):
+        while not q_error.empty():
+            error = q_error.get()
+            snitch["Error Log"].append(time.strftime("%Y-%m-%d %H:%M:%S") + " " + error)
+            # shorten some common error messages before displaying them and after writing them to error.log
+            error = error.replace("FD Read Error and PID Read Error and FUSE Read Error for", "Read Error for")
+            if len(error) > 50:
+                error = error[:47] + "..."
+            NotificationManager().toast(error, file=sys.stderr)
+        write_snitch(snitch)
+        for snitch_pipe in snitch_pipes:
+            snitch_pipe.close()
+        sys.exit(0)
+    signal.signal(signal.SIGTERM, lambda *args: write_snitch_and_exit(snitch, q_error, snitch_pipes))
+    signal.signal(signal.SIGINT, lambda *args: write_snitch_and_exit(snitch, q_error, snitch_pipes))
+    # init thread to receive new connection data over pipe
+    def snitch_pipe_thread(snitch_pipes, pipe_data: list, listen: threading.Event, ready: threading.Event):
+        while True:
+            listen.wait()
+            new_processes = pipe_data[0]
+            while listen.is_set():
+                for i in range(5):
+                    if any(snitch_pipe.poll() for snitch_pipe in snitch_pipes):
+                        break
+                    time.sleep(1)
+                for snitch_pipe in snitch_pipes:
+                    while snitch_pipe.poll():
+                        new_processes.append(snitch_pipe.recv_bytes())
+            ready.set()
+    listen, ready = threading.Event(), threading.Event()
+    pipe_data = [[]]
+    thread = threading.Thread(target=snitch_pipe_thread, args=(snitch_pipes, pipe_data, listen, ready,), daemon=True)
+    thread.start()
+    listen.set()
+    # main loop
+    while True:
+        if not parent_process.is_alive():
+            q_error.put("picosnitch has stopped")
+            write_snitch_and_exit(snitch, q_error, snitch_pipes)
+        try:
+            # check for errors
+            while not q_error.empty():
+                error = q_error.get()
+                snitch["Error Log"].append(time.strftime("%Y-%m-%d %H:%M:%S") + " " + error)
+                # shorten some common error messages before displaying them and after writing them to error.log
+                error = error.replace("FD Read Error and PID Read Error and FUSE Read Error for", "Read Error for")
+                if len(error) > 50:
+                    error = error[:47] + "..."
+                # don't need to toast fallback success messages
+                if error.startswith("Fallback to FUSE hash successful on ") or error.startswith("Fallback to PID hash successful on "):
+                    continue
+                NotificationManager().toast(error, file=sys.stderr)
+            # get list of new processes and connections since last update
+            listen.clear()
+            if not ready.wait(timeout=300):
+                q_error.put("thread timeout error for primary subprocess")
+                write_snitch_and_exit(snitch, q_error, snitch_pipes)
+            new_processes = pipe_data[0]
+            pipe_data[0] = []
+            ready.clear()
+            listen.set()
+            # process the list and update snitch, send new process/connection data to secondary subprocess if ready
+            primary_subprocess_helper(snitch, new_processes)
+            processes_to_send += new_processes
+            while not q_in.empty():
+                msg: dict = pickle.loads(q_in.get())
+                if msg["type"] == "ready":
+                    secondary_pipe.send_bytes(pickle.dumps(len(processes_to_send)))
+                    for proc_pickle in processes_to_send:
+                        secondary_pipe.send_bytes(proc_pickle)
+                    secondary_pipe.send_bytes(pickle.dumps("done"))
+                    processes_to_send = []
+                    break
+                elif msg["type"] == "sha256":
+                    if msg["exe"] in snitch["SHA256"]:
+                        if msg["sha256"] not in snitch["SHA256"][msg["exe"]]:
+                            snitch["SHA256"][msg["exe"]][msg["sha256"]] = "VT Pending"
+                            snitch["Exe Log"].append(f"{time.strftime('%Y-%m-%d %H:%M:%S')} {msg['sha256']:<16.16} {msg['exe']} (new hash)")
+                            NotificationManager().toast(f"New sha256: {msg['exe']}")
+                    else:
+                        snitch["SHA256"][msg["exe"]] = {msg["sha256"]: "VT Pending"}
+                elif msg["type"] == "vt_result":
+                    if msg["exe"] in snitch["SHA256"]:
+                        if msg["sha256"] not in snitch["SHA256"][msg["exe"]]:
+                            snitch["Exe Log"].append(f"{time.strftime('%Y-%m-%d %H:%M:%S')} {msg['sha256']:<16.16} {msg['exe']} (new hash)")
+                            NotificationManager().toast(f"New sha256: {msg['exe']}")
+                        snitch["SHA256"][msg["exe"]][msg["sha256"]] = msg["result"]
+                    else:
+                        snitch["SHA256"][msg["exe"]] = {msg["sha256"]: msg["result"]}
+                    if msg["suspicious"]:
+                        snitch["Exe Log"].append(f"{time.strftime('%Y-%m-%d %H:%M:%S')} {msg['sha256']:<16.16} {msg['exe']} (suspicious)")
+                        NotificationManager().toast(f"Suspicious VT results: {msg['exe']}")
+                    else:
+                        snitch["Exe Log"].append(f"{time.strftime('%Y-%m-%d %H:%M:%S')} {msg['sha256']:<16.16} {msg['exe']} (clean)")
+            # write the snitch dictionary to record.json, error.log, and exe.log (limit writes to reduce disk wear)
+            if snitch["Error Log"] or snitch["Exe Log"] or time.time() - last_write > 30:
+                new_record = pickle.dumps([snitch["Executables"], snitch["Names"], snitch["Parent Executables"], snitch["Parent Names"], snitch["SHA256"]])
+                if new_record != snitch_record:
+                    snitch_record = new_record
+                    write_record = True
+                write_snitch(snitch, write_record=write_record)
+                last_write = time.time()
+                write_record = False
+        except Exception as e:
+            q_error.put("primary subprocess %s%s on line %s" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno))
diff --git a/picosnitch/process_manager.py b/picosnitch/process_manager.py
new file mode 100755
index 0000000..5c19826
--- /dev/null
+++ b/picosnitch/process_manager.py
@@ -0,0 +1,61 @@
+#!/usr/bin/env python3
+# picosnitch
+# Copyright (C) 2020-2023 Eric Lesiuta
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+# https://github.com/elesiuta/picosnitch
+
+import multiprocessing
+import os
+import site
+import typing
+
+# add site dirs for system and user installed packages (to import bcc with picosnitch installed via pipx/venv, or dependencies installed via user)
+site.addsitedir("/usr/lib/python3/dist-packages")
+site.addsitedir(os.path.expandvars("$PYTHON_USER_SITE"))
+import psutil
+
+
+class ProcessManager:
+    """A class for managing a subprocess"""
+    def __init__(self, name: str, target: typing.Callable, init_args: tuple = ()) -> None:
+        self.name, self.target, self.init_args = name, target, init_args
+        self.q_in, self.q_out = multiprocessing.Queue(), multiprocessing.Queue()
+        self.start()
+
+    def start(self) -> None:
+        self.p = multiprocessing.Process(name=self.name, target=self.target, daemon=True,
+                                         args=(*self.init_args, self.q_in, self.q_out)
+                                        )
+        self.p.start()
+        self.pp = psutil.Process(self.p.pid)
+
+    def terminate(self) -> None:
+        if self.p.is_alive():
+            self.p.terminate()
+        self.p.join(timeout=5)
+        if self.p.is_alive():
+            self.p.kill()
+        self.p.join(timeout=5)
+        self.p.close()
+
+    def is_alive(self) -> bool:
+        return self.p.is_alive()
+
+    def is_zombie(self) -> bool:
+        return self.pp.is_running() and self.pp.status() == psutil.STATUS_ZOMBIE
+
+    def memory(self) -> int:
+        return self.pp.memory_info().rss
diff --git a/picosnitch/rfuse_subprocess.py b/picosnitch/rfuse_subprocess.py
new file mode 100755
index 0000000..0e8c305
--- /dev/null
+++ b/picosnitch/rfuse_subprocess.py
@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+# picosnitch
+# Copyright (C) 2020-2023 Eric Lesiuta
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+# https://github.com/elesiuta/picosnitch
+
+import multiprocessing
+import os
+import pickle
+import queue
+import sys
+
+from .utils import get_sha256_fd, get_sha256_pid
+
+
+def rfuse_subprocess(config: dict, q_error, q_in, q_out):
+    """runs as user to read executables for FUSE/AppImage (since real, effective, and saved UID must match)"""
+    parent_process = multiprocessing.parent_process()
+    try:
+        os.setgid(int(os.getenv("SUDO_UID")))
+        os.setuid(int(os.getenv("SUDO_UID")))
+    except Exception:
+        pass
+    while True:
+        if not parent_process.is_alive():
+            return 0
+        try:
+            path, pid, st_dev, st_ino = pickle.loads(q_in.get(block=True, timeout=15))
+            sha256 = get_sha256_fd.__wrapped__(path, st_dev, st_ino, 0)
+            if sha256.startswith("!"):
+                sha256 = get_sha256_pid.__wrapped__(pid, st_dev, st_ino)
+                if sha256.startswith("!"):
+                    sha256 = "!!! FUSE Read Error"
+            q_out.put(sha256)
+        except queue.Empty:
+            pass
+        except Exception as e:
+            q_error.put("rfuse subprocess %s%s on line %s" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno))
diff --git a/picosnitch/secondary_subprocess.py b/picosnitch/secondary_subprocess.py
new file mode 100755
index 0000000..f2a275b
--- /dev/null
+++ b/picosnitch/secondary_subprocess.py
@@ -0,0 +1,261 @@
+#!/usr/bin/env python3
+# picosnitch
+# Copyright (C) 2020-2023 Eric Lesiuta
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+# https://github.com/elesiuta/picosnitch
+
+import collections
+import importlib
+import importlib.util
+import ipaddress
+import multiprocessing
+import os
+import pickle
+import shlex
+import sqlite3
+import sys
+import time
+import typing
+
+from .constants import BASE_PATH, VERSION
+from .process_manager import ProcessManager
+from .utils import get_sha256_fd, get_sha256_fuse, get_sha256_pid, reverse_dns_lookup
+
+
+def secondary_subprocess_sha_wrapper(snitch: dict, fan_mod_cnt: dict, proc: dict, p_rfuse: ProcessManager, q_vt: multiprocessing.Queue, q_out: multiprocessing.Queue, q_error: multiprocessing.Queue) -> str:
+    """get sha256 of executable and submit to primary_subprocess or virustotal_subprocess if necessary"""
+    sha_fd_error = ""
+    sha_pid_error = ""
+    sha256 = get_sha256_fd(proc["fd"], proc["dev"], proc["ino"], fan_mod_cnt["%d %d" % (proc["dev"], proc["ino"])])
+    if sha256.startswith("!"):
+        # fallback on trying to read directly (if still alive) if fd_cache fails, probable causes include:
+        # system suspends in the middle of hashing (since cache is reset)
+        # process too short lived to open fd or stat in time (then fallback will fail too)
+        # too many executables on system (see Set RLIMIT_NOFILE)
+        sha_fd_error = sha256
+        sha256 = get_sha256_pid(proc["pid"], proc["dev"], proc["ino"])
+        if sha256.startswith("!"):
+            # fallback to trying to read from fuse mount
+            # this is meant for appimages that are run as the same user as the one running picosnitch, since they are not readable as root
+            sha_pid_error = sha256
+            sha256 = get_sha256_fuse(p_rfuse.q_in, p_rfuse.q_out, proc["fd"], proc["pid"], proc["dev"], proc["ino"], fan_mod_cnt["%d %d" % (proc["dev"], proc["ino"])])
+            if sha256.startswith("!"):
+                # notify user with what went wrong (may be cause for suspicion)
+                sha256_error = sha_fd_error[4:] + " and " + sha_pid_error[4:] + " and " + sha256[4:]
+                sha256 = sha_fd_error + " " + sha_pid_error + " " + sha256
+                q_error.put(sha256_error + " for " + str(proc))
+            elif proc["exe"] not in snitch["SHA256"] or sha256 not in snitch["SHA256"][proc["exe"]]:
+                q_error.put("Fallback to FUSE hash successful on " + sha_fd_error[4:] + " and " + sha_pid_error[4:] + " for " + str(proc))
+        elif proc["exe"] not in snitch["SHA256"] or sha256 not in snitch["SHA256"][proc["exe"]]:
+            q_error.put("Fallback to PID hash successful on " + sha_fd_error[4:] + " for " + str(proc))
+    if proc["exe"] in snitch["SHA256"]:
+        if sha256 not in snitch["SHA256"][proc["exe"]]:
+            snitch["SHA256"][proc["exe"]][sha256] = "SUBMITTED"
+            q_vt.put(pickle.dumps((proc, sha256)))
+            q_out.put(pickle.dumps({"type": "sha256", "name": proc["name"], "exe": proc["exe"], "sha256": sha256}))
+        elif snitch["SHA256"][proc["exe"]][sha256] == "Failed to read process for upload":
+            snitch["SHA256"][proc["exe"]][sha256] = "RETRY"
+            q_vt.put(pickle.dumps((proc, sha256)))
+    else:
+        snitch["SHA256"][proc["exe"]] = {sha256: "SUBMITTED"}
+        q_vt.put(pickle.dumps((proc, sha256)))
+        q_out.put(pickle.dumps({"type": "sha256", "name": proc["name"], "exe": proc["exe"], "sha256": sha256}))
+    return sha256
+
+
+def secondary_subprocess_helper(snitch: dict, fan_mod_cnt: dict, new_processes: typing.List[bytes], p_rfuse: ProcessManager, q_vt: multiprocessing.Queue, q_out: multiprocessing.Queue, q_error: multiprocessing.Queue) -> typing.List[tuple]:
+    """iterate over the list of process/connection data to generate a list of entries for the sql database"""
+    datetime_now = time.strftime("%Y-%m-%d %H:%M:%S")
+    traffic_counter = collections.defaultdict(int)
+    transaction = set()
+    for proc_pickle in new_processes:
+        proc: BpfEvent = pickle.loads(proc_pickle)
+        if type(proc) != dict:
+            q_error.put("sync error between secondary and primary, received '%s' in middle of transfer" % str(proc))
+            continue
+        # get the sha256 of the process executable and its parent
+        sha256 = secondary_subprocess_sha_wrapper(snitch, fan_mod_cnt, proc, p_rfuse, q_vt, q_out, q_error)
+        pproc = {"pid": proc["ppid"], "name": proc["pname"], "exe": proc["pexe"], "fd": proc["pfd"], "dev": proc["pdev"], "ino": proc["pino"]}
+        psha256 = secondary_subprocess_sha_wrapper(snitch, fan_mod_cnt, pproc, p_rfuse, q_vt, q_out, q_error)
+        # join or omit commands from logs
+        if snitch["Config"]["Log commands"]:
+            proc["cmdline"] = shlex.join(proc["cmdline"].encode("utf-8", "ignore").decode("utf-8", "ignore").strip("\0\t\n ").split("\0"))
+            proc["pcmdline"] = shlex.join(proc["pcmdline"].encode("utf-8", "ignore").decode("utf-8", "ignore").strip("\0\t\n ").split("\0"))
+        else:
+            proc["cmdline"] = ""
+            proc["pcmdline"] = ""
+        # reverse dns lookup or omit with IP from logs
+        if snitch["Config"]["Log addresses"]:
+            if not proc["domain"]:
+                proc["domain"] = reverse_dns_lookup(proc["raddr"])
+        else:
+            proc["domain"], proc["raddr"] = "", ""
+        if not snitch["Config"]["Log ports"]:
+            proc["lport"] = min(0, proc["lport"])
+            proc["rport"] = min(0, proc["rport"])
+        # omit entry from logs
+        ignored = False
+        for ignore in snitch["Config"]["Log ignore"]:
+            if ((proc["rport"] == ignore) or
+                (proc["lport"] == ignore) or
+                (sha256 == ignore) or
+                (type(ignore) == str and proc["domain"].startswith(ignore))
+               ):
+                ignored = True
+                break
+        if ignored:
+            continue
+        if snitch["Config"]["Log ignore IP"] and proc["raddr"]:
+            raddr = ipaddress.ip_address(proc["raddr"])
+            if (any(raddr in network for network in snitch["Config"]["Log ignore IP"])):
+                continue
+            laddr = ipaddress.ip_address(proc["laddr"])
+            if (any(laddr in network for network in snitch["Config"]["Log ignore IP"])):
+                continue
+        # create sql entry
+        event = (proc["exe"], proc["name"], proc["cmdline"], sha256, proc["pexe"], proc["pname"], proc["pcmdline"], psha256, proc["uid"], proc["lport"], proc["rport"], proc["laddr"], proc["raddr"], proc["domain"])
+        traffic_counter["send " + str(event)] += proc["send"]
+        traffic_counter["recv " + str(event)] += proc["recv"]
+        transaction.add(event)
+    return [(datetime_now, traffic_counter["send " + str(event)], traffic_counter["recv " + str(event)], *event) for event in transaction]
+
+
+
+def secondary_subprocess(snitch, fan_fd, p_rfuse: ProcessManager, p_virustotal: ProcessManager, secondary_pipe, q_primary_in, q_error, _q_in, _q_out):
+    """second to receive connection data from monitor, less responsive than primary, coordinates connection data with virustotal subprocess and checks fanotify, updates connection logs and reports sha256/vt_results back to primary_subprocess if needed"""
+    parent_process = multiprocessing.parent_process()
+    # maintain a separate copy of the snitch dictionary here and coordinate with the primary_subprocess (sha256 and vt_results)
+    get_vt_results(snitch, p_virustotal.q_in, q_primary_in, True)
+    # init sql
+    # (contime text, send integer, recv integer, exe text, name text, cmdline text, sha256 text, pexe text, pname text, pcmdline text, psha256 text, uid integer, lport integer, rport integer, laddr text, raddr text, domain text)
+    # (datetime_now, traffic_counter["send " + str(event)], traffic_counter["recv " + str(event)], *(proc["exe"], proc["name"], proc["cmdline"], sha256, proc["pexe"], proc["pname"], proc["pcmdline"], psha256, proc["uid"], proc["lport"], proc["rport"], proc["laddr"], proc["raddr"], proc["domain"]))
+    sqlite_query = ''' INSERT INTO connections VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) '''
+    file_path = os.path.join(BASE_PATH, "snitch.db")
+    text_path = os.path.join(BASE_PATH, "conn.log")
+    if snitch["Config"]["DB sql log"]:
+        con = sqlite3.connect(file_path)
+        cur = con.cursor()
+        cur.execute(''' PRAGMA user_version ''')
+        assert cur.fetchone()[0] == 3, f"Incorrect database version of snitch.db for picosnitch v{VERSION}"
+        cur.execute(''' DELETE FROM connections WHERE contime < datetime("now", "localtime", "-%d days") ''' % int(snitch["Config"]["DB retention (days)"]))
+        con.commit()
+        con.close()
+    if sql_kwargs := snitch["Config"]["DB sql server"]:
+        sql_client = sql_kwargs.pop("client", "no client error")
+        table_name = sql_kwargs.pop("table_name", "connections")
+        sql = importlib.import_module(sql_client)
+        sql_query = sqlite_query.replace("?", "%s").replace("connections", table_name)
+    log_destinations = int(bool(snitch["Config"]["DB sql log"])) + int(bool(sql_kwargs)) + int(bool(snitch["Config"]["DB text log"]))
+    # init fanotify mod counter = {"st_dev st_ino": modify_count}, and traffic counter = {"send|recv pid socket_ino": bytes}
+    fan_mod_cnt = collections.defaultdict(int)
+    # get network address and mask for ignored IP subnets
+    ignored_ips = []
+    for ip_subnet in reversed(snitch["Config"]["Log ignore"]):
+        try:
+            ignored_ips.append(ipaddress.ip_network(ip_subnet))
+            snitch["Config"]["Log ignore"].remove(ip_subnet)
+        except Exception as e:
+            pass
+    snitch["Config"]["Log ignore IP"] = ignored_ips
+    # main loop
+    transaction = []
+    new_processes = []
+    last_write = 0
+    while True:
+        if not parent_process.is_alive():
+            return 0
+        try:
+            # prep to receive new connections
+            if secondary_pipe.poll():
+                q_error.put("sync error between secondary and primary on ready (pipe not empty)")
+            else:
+                q_primary_in.put(pickle.dumps({"type": "ready"}))
+                secondary_pipe.poll(timeout=300)
+                if not secondary_pipe.poll():
+                    q_error.put("sync error between secondary and primary on ready (secondary timed out waiting for first message)")
+            # receive first message, should be transfer size
+            transfer_size = 0
+            if secondary_pipe.poll():
+                first_pickle = secondary_pipe.recv_bytes()
+                if type(pickle.loads(first_pickle)) == int:
+                    transfer_size = pickle.loads(first_pickle)
+                elif pickle.loads(first_pickle) == "done":
+                    q_error.put("sync error between secondary and primary on ready (received done)")
+                else:
+                    q_error.put("sync error between secondary and primary on ready (did not receive transfer size)")
+                    new_processes.append(first_pickle)
+            # receive new connections until "done"
+            timeout_counter = 0
+            while True:
+                while secondary_pipe.poll(timeout=1):
+                    new_processes.append(secondary_pipe.recv_bytes())
+                    transfer_size -= 1
+                timeout_counter += 1
+                if pickle.loads(new_processes[-1]) == "done":
+                    _ = new_processes.pop()
+                    transfer_size += 1
+                    break
+                elif timeout_counter > 30:
+                    q_error.put("sync error between secondary and primary on receive (did not receive done)")
+            if transfer_size > 0:
+                q_error.put("sync error between secondary and primary on receive (did not receive all messages)")
+            elif transfer_size < 0:
+                q_error.put("sync error between secondary and primary on receive (received extra messages)")
+            # check for other pending data (vt, fanotify)
+            get_vt_results(snitch, p_virustotal.q_out, q_primary_in, False)
+            get_fanotify_events(fan_fd, fan_mod_cnt, q_error)
+            # process connection data
+            if time.time() - last_write > snitch["Config"]["DB write limit (seconds)"] and (transaction or new_processes):
+                current_write = time.time()
+                transaction += secondary_subprocess_helper(snitch, fan_mod_cnt, new_processes, p_rfuse, p_virustotal.q_in, q_primary_in, q_error)
+                new_processes = []
+                transaction_success = False
+                try:
+                    if snitch["Config"]["DB sql log"]:
+                        con = sqlite3.connect(file_path)
+                        with con:
+                            con.executemany(sqlite_query, transaction)
+                        con.close()
+                        transaction_success = True
+                except Exception as e:
+                    q_error.put("SQLite execute %s%s on line %s, lost %s entries" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno, len(transaction)))
+                try:
+                    if sql_kwargs:
+                        con = sql.connect(**sql_kwargs)
+                        with con.cursor() as cur:
+                            cur.executemany(sql_query, transaction)
+                        con.commit()
+                        con.close()
+                        transaction_success = True
+                except Exception as e:
+                    q_error.put("SQL server execute %s%s on line %s, lost %s entries" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno, len(transaction)))
+                try:
+                    if snitch["Config"]["DB text log"]:
+                        with open(text_path, "a", encoding="utf-8", errors="surrogateescape") as text_file:
+                            for entry in transaction:
+                                clean_entry = [str(value).replace(",", "").replace("\n", "").replace("\0", "") for value in entry]
+                                text_file.write(",".join(clean_entry) + "\n")
+                        transaction_success = True
+                except Exception as e:
+                    q_error.put("text log %s%s on line %s, lost %s entries" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno, len(transaction)))
+                if transaction_success or log_destinations == 0:
+                    transaction = []
+                else:
+                    q_error.put("secondary subprocess all log desinations failed, will retry %s entries with next write" % (len(transaction)))
+                last_write = current_write
+        except Exception as e:
+            q_error.put("secondary subprocess %s%s on line %s" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno))
+
diff --git a/picosnitch/user_interface.py b/picosnitch/user_interface.py
new file mode 100755
index 0000000..a7c2373
--- /dev/null
+++ b/picosnitch/user_interface.py
@@ -0,0 +1,855 @@
+#!/usr/bin/env python3
+# picosnitch
+# Copyright (C) 2020-2023 Eric Lesiuta
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+# https://github.com/elesiuta/picosnitch
+
+import collections
+import curses
+import datetime
+import ipaddress
+import json
+import math
+import os
+import pwd
+import queue
+import signal
+import site
+import sqlite3
+import sys
+import textwrap
+import threading
+import time
+
+from .constants import BASE_PATH, VERSION
+
+
+def ui_geoip():
+    """init a geoip2 reader and return it (along with updating geoip db), or None if not available"""
+    with open(os.path.join(BASE_PATH, "config.json"), "r", encoding="utf-8", errors="surrogateescape") as json_file:
+        if not json.load(json_file)["GeoIP lookup"]:
+            return None
+    try:
+        import geoip2.database
+        # download latest database if out of date or does not exist, then create geoip_reader
+        geoip_mmdb = os.path.join(BASE_PATH, "dbip-country-lite.mmdb")
+        geoip_url = datetime.datetime.now().strftime("https://download.db-ip.com/free/dbip-country-lite-%Y-%m.mmdb.gz")
+        if not os.path.isfile(geoip_mmdb) or datetime.datetime.fromtimestamp(os.path.getmtime(geoip_mmdb)).strftime("%Y%m") != datetime.datetime.now().strftime("%Y%m"):
+            try:
+                import urllib.request
+                try:
+                    request = urllib.request.Request(geoip_url, headers={'User-Agent': 'Mozilla/5.0'})
+                    with urllib.request.urlopen(request) as response, open(geoip_mmdb + ".gz", "wb") as f:
+                        f.write(response.read())
+                except Exception:
+                    # try previous month if current month is not available
+                    geoip_url = (datetime.datetime.now() - datetime.timedelta(days=30)).strftime("https://download.db-ip.com/free/dbip-country-lite-%Y-%m.mmdb.gz")
+                    request = urllib.request.Request(geoip_url, headers={'User-Agent': 'Mozilla/5.0'})
+                    with urllib.request.urlopen(request) as response, open(geoip_mmdb + ".gz", "wb") as f:
+                        f.write(response.read())
+                import gzip
+                with gzip.open(geoip_mmdb + ".gz", "rb") as f_in, open(geoip_mmdb, "wb") as f_out:
+                    f_out.write(f_in.read())
+                os.remove(geoip_mmdb + ".gz")
+            except Exception:
+                if not os.path.isfile(geoip_mmdb):
+                    raise Exception("Could not download GeoIP database")
+                print("Could not update GeoIP database, using old version", file=sys.stderr)
+        return geoip2.database.Reader(geoip_mmdb)
+    except Exception:
+        return None
+
+
+def ui_loop(stdscr: curses.window, splash: str) -> int:
+    """for curses wrapper"""
+    # thread for querying database
+    file_path = os.path.join(BASE_PATH, "snitch.db")
+    q_query_results = queue.Queue()
+    kill_thread_query = threading.Event()
+    def fetch_query_results(current_query: str, q_query_results: queue.Queue, kill_thread_query: threading.Event):
+        con = sqlite3.connect(file_path, timeout=1)
+        cur = con.cursor()
+        while True and not kill_thread_query.is_set():
+            try:
+                cur.execute(current_query)
+                break
+            except sqlite3.OperationalError:
+                time.sleep(0.5)
+        results = cur.fetchmany(25)
+        while results and not kill_thread_query.is_set():
+            q_query_results.put(results)
+            results = cur.fetchmany(25)
+        con.close()
+    thread_query = threading.Thread()
+    thread_query.start()
+    # init and splash screen
+    curses.cbreak()
+    curses.noecho()
+    curses.curs_set(0)
+    curses.start_color()
+    curses.use_default_colors()
+    curses.init_pair(1, curses.COLOR_WHITE, curses.COLOR_CYAN)  # selection
+    curses.init_pair(2, curses.COLOR_YELLOW, -1)  # splash
+    curses.init_pair(3, curses.COLOR_WHITE, curses.COLOR_MAGENTA)  # header
+    curses.init_pair(4, curses.COLOR_WHITE, -1)  # splash
+    splash_lines = splash.splitlines()
+    stdscr.clear()
+    for i in range(len(splash_lines)):
+        if "\u001b[33m" in splash_lines[i]:
+            part1 = splash_lines[i].split("\u001b[33m")
+            part2 = part1[1].split("\033[0m")
+            stdscr.addstr(i, 0, part1[0], curses.color_pair(4))
+            stdscr.addstr(i, len(part1[0]), part2[0], curses.color_pair(2))
+            stdscr.addstr(i, len(part1[0]) + len(part2[0]), part2[1], curses.color_pair(4))
+        else:
+            stdscr.addstr(i, 0, splash_lines[i])
+    stdscr.refresh()
+    # time lookup functions
+    # time_i is the index of the time period, time_j is the number of time period steps to go back
+    # time_i=0 means all records and time_j=0 means current time (no rounding), due to rounding for time_j>0, time_j=1 may extend partially into the future
+    time_i = 0
+    time_j = 0
+    time_period = ["all", "1 minute", "3 minutes", "5 minutes", "10 minutes", "15 minutes", "30 minutes", "1 hour", "3 hours", "6 hours", "12 hours", "1 day", "3 days", "7 days", "30 days", "365 days"]
+    time_minutes = [0, 1, 3, 5, 10, 15, 30, 60, 180, 360, 720, 1440, 4320, 10080, 43200, 525600]
+    time_deltas = [datetime.timedelta(minutes=x) for x in time_minutes]
+    time_round_units = ["second"] + ["minute"]*6 + ["hour"]*4 + ["day"]*3 + ["month"] + ["year"]
+    time_round_functions = collections.OrderedDict({
+        "second": lambda x: x.replace(microsecond=0),
+        "minute": lambda x: x.replace(microsecond=0, second=0),
+        "hour": lambda x: x.replace(microsecond=0, second=0, minute=0),
+        "day": lambda x: x.replace(microsecond=0, second=0, minute=0, hour=0),
+        "month": lambda x: x.replace(microsecond=0, second=0, minute=0, hour=0, day=1),
+        "year": lambda x: x.replace(microsecond=0, second=0, minute=0, hour=0, day=1, month=1),
+    })
+    time_round_func = lambda resolution_index, time: time_round_functions[time_round_units[resolution_index]](time)
+    # geoip lookup
+    geoip_reader = ui_geoip()
+    def get_geoip(ip: str) -> str:
+        try:
+            country_code = geoip_reader.country(ip).country.iso_code
+            base = 0x1f1e6 - ord("A")
+            # country_flag = chr(base + ord(country_code[0].upper())) + chr(base + ord(country_code[1].upper()))  # flags aren't supported in most fonts and terminals, disable for now
+            return f"{country_code} {ip}"
+        except Exception:
+            try:
+                if ipaddress.ip_address(ip).is_private:
+                    return f"{chr(0x1f3e0)}{chr(0x200b)} {ip}"  # home emoji + ZWSP so line length is counted correctly
+                else:
+                    return f"{chr(0x1f310)}{chr(0x200b)} {ip}"  # globe emoji + ZWSP so line length is counted correctly
+            except Exception:
+                return f"{chr(0x2753)}{chr(0x200b)} {ip}"  # question emoji + ZWSP so line length is counted correctly
+    # screens from queries (exe text, name text, cmdline text, sha256 text, contime text, domain text, ip text, port integer, uid integer)
+    tab_i = 0
+    tab_names = ["Executables", "Process Names", "Commands", "SHA256", "Parent Executables", "Parent Names", "Parent Commands", "Parent SHA256", "Users", "Local Ports", "Remote Ports", "Local Addresses", "Remote Addresses", "Domains", "Entry Time"]
+    col_names = ["Executable", "Process Name", "Command", "SHA256", "Parent Executable", "Parent Name", "Parent Command", "Parent SHA256", "User", "Local Port", "Remote Port", "Local Address", "Remote Address", "Domain", "Entry Time"]
+    col_sql = ["exe", "name", "cmdline", "sha256", "pexe", "pname", "pcmdline", "psha256", "uid", "lport", "rport", "laddr", "raddr", "domain", "contime"]
+    tab_stack = []
+    byte_units = 3
+    round_bytes = lambda size, b: f"{size if b == 0 else round(size/10**b, 1)!s:>{8 if b == 0 else 7}} {'k' if b == 3 else 'M' if b == 6 else 'G' if b == 9 else ''}B"
+    # ui loop
+    max_y, max_x = stdscr.getmaxyx()
+    first_line = 4
+    cursor, line = first_line, first_line
+    filter_values = []
+    filter_exclude = []
+    add_filter = False
+    add_filter_exclude = False
+    update_time = True
+    update_query = True
+    execute_query = True
+    running_query = False
+    current_query, current_screen = "", [""]
+    vt_status = collections.defaultdict(str)
+    while True:
+        # adjust cursor
+        tab_i %= len(col_sql)
+        time_i %= len(time_period)
+        if time_j < 0 or time_i == 0:
+            time_j = 0
+        cursor %= line
+        if cursor < first_line:
+            cursor = first_line
+        # generate screen
+        if update_query:
+            if time_j == 0:
+                time_history_start = (datetime.datetime.now() - time_deltas[time_i]).strftime("%Y-%m-%d %H:%M:%S")
+                time_history_end = "now"
+                time_history = time_round_functions["second"](datetime.datetime.now())
+            elif time_i != 0:
+                if update_time:
+                    time_history_start = time_round_func(time_i, datetime.datetime.now() - time_deltas[time_i] * (time_j-1)).strftime("%Y-%m-%d %H:%M:%S")
+                    time_history_end = time_round_func(time_i, datetime.datetime.now() - time_deltas[time_i] * (time_j-2)).strftime("%Y-%m-%d %H:%M:%S")
+                    time_history = f"{time_history_start} -> {time_history_end}"
+                    update_time = False
+            if time_i == 0:
+                time_query = ""
+            else:
+                if tab_stack:
+                    time_query = f" AND contime > datetime(\"{time_history_start}\") AND contime < datetime(\"{time_history_end}\")"
+                else:
+                    time_query = f" WHERE contime > datetime(\"{time_history_start}\") AND contime < datetime(\"{time_history_end}\")"
+            if tab_stack:
+                filter_query = " AND ".join(f"{col_sql[i]} IS {exclude}\"{value}\"" for i, exclude, value in zip(tab_stack, filter_exclude, filter_values))
+                current_query = f"SELECT {col_sql[tab_i]}, SUM(send), SUM(recv) FROM connections WHERE {filter_query}{time_query} GROUP BY {col_sql[tab_i]}"
+            else:
+                current_query = f"SELECT {col_sql[tab_i]}, SUM(send), SUM(recv) FROM connections{time_query} GROUP BY {col_sql[tab_i]}"
+            update_query = False
+        if execute_query:
+            current_screen = []
+            # kill old thread with flag, may still be executing current query so don't wait for join, just let gc handle it
+            kill_thread_query.set()
+            while not q_query_results.empty():
+                _ = q_query_results.get_nowait()
+            # start new thread, reinitialize queue and kill flag
+            q_query_results = queue.Queue()
+            kill_thread_query = threading.Event()
+            thread_query = threading.Thread(target=fetch_query_results, args=(current_query, q_query_results, kill_thread_query), daemon=True)
+            thread_query.start()
+            # check daemon pid for status bar
+            try:
+                with open("/run/picosnitch.pid", "r") as f:
+                    run_status = "pid: " + f.read().strip()
+            except Exception:
+                run_status = "not running"
+            print(f"\033]0;picosnitch v{VERSION} ({run_status})\a", end="", flush=True)
+            # check if any new virustotal results
+            try:
+                with open(os.path.join(BASE_PATH, "record.json"), "r") as f:
+                    sha256_record = json.load(f)["SHA256"]
+                for exe, hashes in sha256_record.items():
+                    for sha256, status in hashes.items():
+                        if sha256 not in vt_status:
+                            if "harmless" in status:
+                                suspicious = status.split("'suspicious': ")[1].split(",")[0]
+                                malicious = status.split("'malicious': ")[1].split(",")[0]
+                                if suspicious == "0" and malicious == "0":
+                                    vt_status[sha256] = " (clean)"
+                                else:
+                                    vt_status[sha256] = " (suspicious)"
+            except Exception:
+                pass
+            # check if any query results are ready
+            if not q_query_results.empty():
+                current_screen += q_query_results.get_nowait()
+            sum_send = sum(b for _, b, _ in current_screen)
+            sum_recv = sum(b for _, _, b in current_screen)
+            execute_query = False
+            running_query = True
+        # update headers for screen
+        help_bar = f"f/F: filter  e/E: exclude  h/H: history  t/T: time  u/U: units  r: refresh  q: quit {' ':<{curses.COLS}}"
+        status_bar = f"history: {time_history}  time: {time_period[time_i]}  line: {min(cursor-first_line+1, len(current_screen))}/{len(current_screen)}  totals: {round_bytes(sum_send, byte_units).strip()} / {round_bytes(sum_recv, byte_units).strip()}{' ':<{curses.COLS}}"
+        if tab_stack:
+            l_tabs = " | ".join(reversed([tab_names[tab_i-i] for i in range (1, len(tab_names))]))
+            r_tabs = " | ".join([tab_names[(tab_i+i) % len(tab_names)] for i in range(1, len(tab_names))])
+            c_tab = tab_names[tab_i]
+            filter_query = " & ".join(f"{col_names[i].lower()} {exclude.replace('NOT ', '!')}= \"{value}\"" for i, exclude, value in zip(tab_stack, filter_exclude, filter_values))
+            column_names = f"{f'{col_names[tab_i]} (where {filter_query})':<{curses.COLS - 29}.{curses.COLS - 29}}          Sent       Received"
+        else:
+            l_tabs = " | ".join(reversed([tab_names[tab_i-i] for i in range(1, len(tab_names))]))
+            r_tabs = " | ".join([tab_names[(tab_i+i) % len(tab_names)] for i in range(1, len(tab_names))])
+            c_tab = tab_names[tab_i]
+            column_names = f"{col_names[tab_i]:<{curses.COLS - 29}}          Sent       Received"
+        edges_width = len("<- ... |  | ... ->")
+        l_width = (curses.COLS - len(c_tab) - edges_width) // 2
+        r_width = curses.COLS - len(c_tab) - edges_width - l_width
+        l_tabs = f" ...{l_tabs[-l_width:]:>{l_width}} | "
+        r_tabs = f" | {r_tabs:<{r_width}.{r_width}}... "
+        # display headers on screen
+        stdscr.clear()
+        stdscr.attrset(curses.color_pair(3) | curses.A_BOLD)
+        stdscr.addstr(0, 0, help_bar)
+        stdscr.addstr(1, 0, status_bar)
+        stdscr.addstr(2, 0, "<-")
+        stdscr.addstr(2, 2, l_tabs, curses.color_pair(3))
+        stdscr.addstr(2, 2 + len(l_tabs), c_tab, curses.color_pair(3) | curses.A_BOLD | curses.A_UNDERLINE)
+        stdscr.addstr(2, 2 + len(l_tabs) + len(c_tab), r_tabs, curses.color_pair(3))
+        stdscr.addstr(2, 2 + len(l_tabs) + len(c_tab) + len(r_tabs), "->")
+        stdscr.addstr(3, 0, column_names)
+        # display query results on screen
+        line = first_line
+        cursor = min(cursor, len(current_screen) + first_line - 1)
+        offset = max(0, cursor - curses.LINES + 3)
+        for name, send, recv in current_screen:
+            if line == cursor:
+                stdscr.attrset(curses.color_pair(1) | curses.A_BOLD)
+                # if space/enter was pressed on previous loop, check current line to update filter
+                if add_filter:
+                    tab_stack.append(tab_i)
+                    filter_values.append(name)
+                    if add_filter_exclude:
+                        filter_exclude.append("NOT ")
+                    else:
+                        filter_exclude.append("")
+                    add_filter_exclude = False
+                    break
+            else:
+                stdscr.attrset(curses.color_pair(0))
+            if first_line <= line - offset < curses.LINES - 1:
+                # special cases (cmdline null chars, uid, ip, sha256 and vt results)
+                if type(name) == str:
+                    name = name.replace("\0", "")
+                elif col_sql[tab_i] == "uid":
+                    try:
+                        name = f"{pwd.getpwuid(name).pw_name} ({name})"
+                    except Exception:
+                        name = f"??? ({name})"
+                if col_sql[tab_i] == "raddr":
+                    name = get_geoip(name)
+                if col_sql[tab_i].endswith("sha256"):
+                    name = f"{name}{vt_status[name]}"
+                value = f"{round_bytes(send, byte_units):>14.14} {round_bytes(recv, byte_units):>14.14}"
+                stdscr.addstr(line - offset, 0, f"{name!s:<{curses.COLS-29}.{curses.COLS-29}}{value}")
+            line += 1
+        stdscr.refresh()
+        # if space/enter was pressed on previous loop, continue loop with updated filter to execute new query
+        if add_filter:
+            add_filter = False
+            update_query = True
+            execute_query = True
+            continue
+        # check for any new query results while waiting for user input
+        if running_query:
+            if not thread_query.is_alive():
+                running_query = False
+            stdscr.nodelay(True)
+            new_results = False
+            while True:
+                try:
+                    current_screen += q_query_results.get(timeout=0.01)
+                    new_results = True
+                except queue.Empty:
+                    ch = stdscr.getch()
+                    if ch != -1:
+                        break
+                    if new_results:
+                        sum_send = sum(b for _, b, _ in current_screen)
+                        sum_recv = sum(b for _, _, b in current_screen)
+                        break
+            stdscr.nodelay(False)
+        else:
+            ch = stdscr.getch()
+        # process user input
+        if ch == ord("\n") or ch == ord(" ") or ch == ord("f"):
+            add_filter = True
+        if ch == ord("e"):
+            add_filter = True
+            add_filter_exclude = True
+        elif ch == curses.KEY_BACKSPACE or ch == ord("F") or ch == ord("E"):
+            if tab_stack:
+                tab_i = tab_stack.pop()
+                _ = filter_values.pop()
+                _ = filter_exclude.pop()
+            update_query = True
+            execute_query = True
+        elif ch == ord("r"):
+            update_time = True
+            update_query = True
+            execute_query = True
+        elif ch == ord("t"):
+            time_j = 0
+            time_i += 1
+            update_query = True
+            execute_query = True
+        elif ch == ord("T"):
+            time_j = 0
+            time_i -= 1
+            update_query = True
+            execute_query = True
+        elif ch == ord("h"):
+            time_j += 1
+            update_time = True
+            update_query = True
+            execute_query = True
+        elif ch == ord("H"):
+            time_j -= 1
+            update_time = True
+            update_query = True
+            execute_query = True
+        elif ch == ord("u"):
+            byte_units = (byte_units + 3) % 12
+        elif ch == ord("U"):
+            byte_units = (byte_units - 3) % 12
+        elif ch == curses.KEY_UP:
+            cursor -= 1
+            if cursor < first_line:
+                cursor = -1
+        elif ch == curses.KEY_DOWN:
+            cursor += 1
+        elif ch == curses.KEY_PPAGE:
+            cursor -= curses.LINES
+            if cursor < first_line:
+                cursor = first_line
+        elif ch == curses.KEY_NPAGE:
+            cursor += curses.LINES
+            if cursor >= line:
+                cursor = line - 1
+        elif ch == curses.KEY_HOME:
+            cursor = first_line
+        elif ch == curses.KEY_END:
+            cursor = len(current_screen) + first_line - 1
+        elif ch == curses.KEY_LEFT:
+            tab_i -= 1
+            update_query = True
+            execute_query = True
+        elif ch == curses.KEY_RIGHT:
+            tab_i += 1
+            update_query = True
+            execute_query = True
+        elif ch == curses.KEY_RESIZE and curses.is_term_resized(max_y, max_x):
+            max_y, max_x = stdscr.getmaxyx()
+            stdscr.clear()
+            curses.resizeterm(max_y, max_x)
+            stdscr.refresh()
+            cursor = first_line
+        elif ch == 27 or ch == ord("q"):
+            return 0
+
+
+def ui_init() -> int:
+    """init curses ui"""
+    splash = textwrap.dedent("""
+        @@&@@                                                              @@@@,
+      &&.,,. &&&&&&%&%&&&&&&&&(..                      ..&&%&%&&&&&&&&%&&&&  .,#&%
+        ,,/%#/(....,.,/(.  ...*,,%%                  %#*,..,... // ...,..//#%*,
+             @@@@@@#((      #(/    @@  %@@@@@@@@  /@@    #(,      ##@@&@@@@
+                   %@&    #(  .      @@\u001b[33m/********\033[0m@@(        (((    @@
+                     .@@((    ,    @@\u001b[33m.,*,,****,,,,\033[0m(@@      . .#(@@
+                        @@@@@@&@@@@@@\u001b[33m,,*,,,,,,,,,,\033[0m(@@@@@@@@&@@@@
+                                   @@\u001b[33m**/*/*,**///*\033[0m(@@
+                                   @@\u001b[33m.****/*//,*,*\033[0m/@@
+                                     @&\u001b[33m//*////,/\033[0m&&(
+                                       ,*\u001b[33m,,,,,,\033[0m,
+
+    Loading database ...
+    """)
+    # init sql connection
+    file_path = os.path.join(BASE_PATH, "snitch.db")
+    con = sqlite3.connect(file_path, timeout=15)
+    # check for table
+    cur = con.cursor()
+    cur.execute(''' PRAGMA user_version ''')
+    assert cur.fetchone()[0] == 3, f"Incorrect database version of snitch.db for picosnitch v{VERSION}"
+    con.close()
+    # start curses
+    for err_count in reversed(range(30)):
+        try:
+            return curses.wrapper(ui_loop, splash)
+        except curses.error:
+            print("CURSES DISPLAY ERROR: try resizing your terminal, ui will close in %s seconds" % (err_count + 1), file=sys.stderr)
+            time.sleep(1)
+    return 1
+
+
+def ui_dash():
+    """gui with plotly dash"""
+    site.addsitedir(os.path.expanduser(f"~/.local/pipx/venvs/dash/lib/python{sys.version_info.major}.{sys.version_info.minor}/site-packages"))
+    site.addsitedir(os.path.expandvars(f"$PIPX_HOME/venvs/dash/lib/python{sys.version_info.major}.{sys.version_info.minor}/site-packages"))
+    site.addsitedir(os.path.expanduser(f"~/.local/pipx/venvs/dash-bootstrap-components/lib/python{sys.version_info.major}.{sys.version_info.minor}/site-packages"))
+    site.addsitedir(os.path.expandvars(f"$PIPX_HOME/venvs/dash-bootstrap-components/lib/python{sys.version_info.major}.{sys.version_info.minor}/site-packages"))
+    site.addsitedir(os.path.expanduser(f"~/.local/pipx/venvs/dash-bootstrap-templates/lib/python{sys.version_info.major}.{sys.version_info.minor}/site-packages"))
+    site.addsitedir(os.path.expandvars(f"$PIPX_HOME/venvs/dash-bootstrap-templates/lib/python{sys.version_info.major}.{sys.version_info.minor}/site-packages"))
+    site.addsitedir(os.path.expanduser(f"~/.local/pipx/venvs/geoip2/lib/python{sys.version_info.major}.{sys.version_info.minor}/site-packages"))
+    site.addsitedir(os.path.expandvars(f"$PIPX_HOME/venvs/geoip2/lib/python{sys.version_info.major}.{sys.version_info.minor}/site-packages"))
+    from dash import Dash, dcc, html, callback_context, no_update
+    from dash.dependencies import Input, Output, State
+    from dash.exceptions import PreventUpdate
+    import pandas as pd
+    import pandas.io.sql as psql
+    import plotly.express as px
+    with open(os.path.join(BASE_PATH, "config.json"), "r", encoding="utf-8", errors="surrogateescape") as json_file:
+        config = json.load(json_file)
+    file_path = os.path.join(BASE_PATH, "snitch.db")
+    all_dims = ["exe", "name", "cmdline", "sha256", "uid", "lport", "rport", "laddr", "raddr", "domain", "pexe", "pname", "pcmdline", "psha256"]
+    dim_labels = {"exe": "Executable", "name": "Process Name", "cmdline": "Command", "sha256": "SHA256", "uid": "User", "lport": "Local Port", "rport": "Remote Port", "laddr": "Local Address", "raddr": "Remote Address", "domain": "Domain", "pexe": "Parent Executable", "pname": "Parent Name", "pcmdline": "Parent Command", "psha256": "Parent SHA256"}
+    time_period = ["all", "1 minute", "3 minutes", "5 minutes", "10 minutes", "15 minutes", "30 minutes", "1 hour", "3 hours", "6 hours", "12 hours", "1 day", "3 days", "7 days", "30 days", "365 days"]
+    time_minutes = [0, 1, 3, 5, 10, 15, 30, 60, 180, 360, 720, 1440, 4320, 10080, 43200, 525600]
+    time_deltas = [datetime.timedelta(minutes=x) for x in time_minutes]
+    time_round_units = ["second"] + ["minute"]*6 + ["hour"]*4 + ["day"]*3 + ["month"] + ["year"]
+    time_round_functions = collections.OrderedDict({
+        "second": lambda x: x.replace(microsecond=0),
+        "minute": lambda x: x.replace(microsecond=0, second=0),
+        "hour": lambda x: x.replace(microsecond=0, second=0, minute=0),
+        "day": lambda x: x.replace(microsecond=0, second=0, minute=0, hour=0),
+        "month": lambda x: x.replace(microsecond=0, second=0, minute=0, hour=0, day=1),
+        "year": lambda x: x.replace(microsecond=0, second=0, minute=0, hour=0, day=1, month=1),
+    })
+    time_round_func = lambda resolution_index, time: time_round_functions[time_round_units[resolution_index]](time)
+    geoip_reader = ui_geoip()
+    def get_user(uid) -> str:
+        try:
+            return f"{pwd.getpwuid(uid).pw_name} ({uid})"
+        except Exception:
+            return f"??? ({uid})"
+    def get_totals(df_sum, dim) -> str:
+        size = df_sum[dim]
+        if size > 10**9:
+            return f"{dim} ({round(size/10**9, 2)!s} GB)"
+        elif size > 10**6:
+            return f"{dim} ({round(size/10**6, 2)!s} MB)"
+        elif size > 10**3:
+            return f"{dim} ({round(size/10**3, 2)!s} kB)"
+        else:
+            return f"{dim} ({size!s} B)"
+    def get_geoip(ip: str) -> str:
+        try:
+            country_code = geoip_reader.country(ip).country.iso_code
+            base = 0x1f1e6 - ord("A")
+            country_flag = chr(base + ord(country_code[0].upper())) + chr(base + ord(country_code[1].upper()))
+            return f"{ip} ({country_flag}{country_code})"
+        except Exception:
+            try:
+                if ipaddress.ip_address(ip).is_private:
+                    return f"{ip} ({chr(0x1f3e0)})"  # home emoji
+                else:
+                    return f"{ip} ({chr(0x1f310)})"  # globe emoji
+            except Exception:
+                return f"{ip} ({chr(0x2753)})"  # question emoji
+    def trim_label(label, trim) -> str:
+        if trim and len(label) > 64:
+            return f"{label[:32]}...{label[-29:]}"
+        return label
+    def serve_layout():
+        try:
+            with open("/run/picosnitch.pid", "r") as f:
+                run_status = "pid: " + f.read().strip()
+        except Exception:
+            run_status = "not running"
+        return html.Div([
+            dcc.Interval(
+                id="interval-component",
+                interval=10000,
+                disabled=True,
+            ),
+            html.Div(html.Button("Stop Dash", id="exit", className="btn btn-primary btn-sm mt-1"), style={"float": "right"}),
+            html.Div([
+                dcc.Dropdown(
+                    id="resampling",
+                    options=[
+                        {"label": "Resampling (100 points)", "value": 100},
+                        {"label": "Resampling (500 points)", "value": 500},
+                        {"label": "Resampling (1000 points)", "value": 1000},
+                        {"label": "Resampling (2000 points)", "value": 2000},
+                        {"label": "Resampling (3000 points)", "value": 3000},
+                        {"label": "Resampling (4000 points)", "value": 4000},
+                        {"label": "Resampling (5000 points)", "value": 5000},
+                        {"label": "Resampling (10000 points)", "value": 10000},
+                        {"label": "Resampling (None)", "value": False},
+                    ],
+                    value=2000,
+                    clearable=False,
+                ),
+            ], style={"display":"inline-block", "width": "15%"}),
+            html.Div([
+                dcc.Dropdown(
+                    id="smoothing",
+                    options=[
+                        {"label": "Rolling Window (2 points)", "value": 2},
+                        {"label": "Rolling Window (4 points)", "value": 4},
+                        {"label": "Rolling Window (8 points)", "value": 8},
+                        {"label": "Rolling Window (None)", "value": False},
+                    ],
+                    value=4,
+                    clearable=False,
+                ),
+            ], style={"display":"inline-block", "width": "15%"}),
+            html.Div([
+                dcc.Dropdown(
+                    id="trim-labels",
+                    options=[
+                        {"label": "Trim Long Labels (64 chars)", "value": True},
+                        {"label": "Show Full Labels", "value": False},
+                    ],
+                    value=True,
+                    clearable=False,
+                ),
+            ], style={"display":"inline-block", "width": "15%"}),
+            html.Div([
+                dcc.Dropdown(
+                    id="auto-refresh",
+                    options=[
+                        {"label": "Disable Auto-Refresh", "value": 0},
+                        {"label": "Auto-Refresh (1 second)", "value": 1},
+                        {"label": "Auto-Refresh (5 seconds)", "value": 5},
+                        {"label": "Auto-Refresh (10 seconds)", "value": 10},
+                        {"label": "Auto-Refresh (30 seconds)", "value": 30},
+                        {"label": "Auto-Refresh (1 minute)", "value": 60},
+                        {"label": "Auto-Refresh (5 minutes)", "value": 300},
+                        {"label": "Auto-Refresh (10 minutes)", "value": 600},
+                    ],
+                    value=0,
+                    clearable=False,
+                ),
+            ], style={"display":"inline-block", "width": "15%"}),
+            html.Div(),
+            html.Div([
+                dcc.Dropdown(
+                    id="select",
+                    options=[{"label": f"Select {dim_labels[x]}", "value": x} for x in all_dims],
+                    value="exe",
+                    clearable=False,
+                ),
+            ], style={"display":"inline-block", "width": "33%"}),
+            html.Div([
+                dcc.Dropdown(
+                    id="where",
+                    options=[{"label": f"Where {dim_labels[x]}", "value": x} for x in all_dims],
+                    placeholder="Where...",
+                ),
+            ], style={"display":"inline-block", "width": "33%"}),
+            html.Div([
+                dcc.Dropdown(
+                    id="whereis",
+                    placeholder="Is...",
+                ),
+            ], style={"display":"inline-block", "width": "33%"}),
+            html.Div([
+                dcc.RadioItems(
+                    id="time_i",
+                    options=[{"label": time_period[i], "value": i} for i in range(len(time_period))],
+                    value=8,
+                    inline=True,
+                ),
+            ]),
+            html.Div([
+                dcc.Slider(
+                    id="time_j",
+                    min=0, max=100, step=1, value=0,
+                    included=False,
+                ),
+                html.Div(id="selected_time_range", style={"border": "1px solid #ccc", "padding": "5px", "text-align": "center"}),
+            ]),
+            dcc.Store(id="store_time", data={"time_i": 8}),
+            dcc.Store(id="store_send", data={"rev": 0, "visible": {}}),
+            dcc.Store(id="store_recv", data={"rev": 0, "visible": {}}),
+            dcc.Graph(id="send", config={"scrollZoom": config["Dash scroll zoom"]}),
+            dcc.Graph(id="recv", config={"scrollZoom": config["Dash scroll zoom"]}),
+            html.Footer(f"picosnitch v{VERSION} ({run_status}) (using {file_path})"),
+        ])
+    try:
+        # try to use dash-bootstrap-components if available and theme exists
+        import dash_bootstrap_components as dbc
+        from dash_bootstrap_templates import load_figure_template
+        load_figure_template(config["Dash theme"].lower())
+        app = Dash(__name__, external_stylesheets=[getattr(dbc.themes, config["Dash theme"].upper())])
+    except Exception:
+        app = Dash(__name__)
+    app.layout = serve_layout
+    @app.callback(Output("interval-component", "disabled"), Output("interval-component", "interval"), Input("auto-refresh", "value"))
+    def toggle_refresh(value):
+        return value == 0, 1000 * value
+    @app.callback(Output("time_j", "value"), Output("store_time", "data"), Input("time_i", "value"), Input("time_j", "value"), Input("store_time", "data"))
+    def update_time_slider_pos(time_i, time_j, store_time):
+        # only trigger on time_i change
+        if not callback_context.triggered:
+            raise PreventUpdate
+        elif time_i == 0 or time_j == 0:
+            # time_i is "all", so time_j should be current, or time_j is current so time_i store just needs updating
+            return 0, {"time_i": time_i}
+        elif store_time["time_i"] == 0:
+            # time_i was "all", so don't change time_j
+            return no_update, {"time_i": time_i}
+        elif time_j != 0 and time_i != store_time["time_i"]:
+            # time_i changed and time_j is not current time, so scale time_j to new time_i
+            # get the old time end offset (smaller value, closer to present time) in minutes, and use to scale to new time_j
+            old_minute_end_offset = (time_j - 2) * time_minutes[store_time["time_i"]]
+            if store_time["time_i"] > time_i:
+                # new time_i is smaller, time_j is larger, and should be slightly after the old time_j to fall between start (earlier) and end (later)
+                new_time_j = math.ceil(old_minute_end_offset / time_minutes[time_i]) + 2
+            else:
+                # new time_i is larger, ..., should be slightly before the old time_j so the entire old period is mostly within the new period
+                new_time_j = math.floor(old_minute_end_offset / time_minutes[time_i]) + 2
+            return max(0, min(100, new_time_j)), {"time_i": time_i}
+        raise PreventUpdate
+    @app.callback(Output("time_j", "marks"), Input("time_i", "value"), Input("time_j", "value"), Input("interval-component", "n_intervals"))
+    def update_time_slider_marks(time_i, time_j, _):
+        return {x: time_round_func(time_i, datetime.datetime.now() - time_deltas[time_i] * (x-2)).strftime("%Y-%m-%d T %H:%M:%S") for x in range(2,100,10)}
+    @app.callback(Output("selected_time_range", "children"), Input("time_i", "value"), Input("time_j", "value"), Input("interval-component", "n_intervals"))
+    def display_time_range(time_i, time_j, _):
+        # may switch later to handleLabel with dash-daq https://dash.plotly.com/dash-core-components/slider https://dash.plotly.com/dash-daq/slider#handle-label
+        # time_i is the index of the time period, time_j is the number of time period steps to go back
+        # time_i=0 means all records and time_j=0 means current time (no rounding), due to rounding for time_j>0, time_j=1 may extend partially into the future
+        if time_j == 0 and time_i != 0:
+            time_history_start = (datetime.datetime.now() - time_deltas[time_i]).strftime("%a. %b. %d, %Y at %H:%M:%S")
+            time_history_end = datetime.datetime.now().strftime("%a. %b. %d, %Y at %H:%M:%S")
+        elif time_i != 0:
+            time_history_start = time_round_func(time_i, datetime.datetime.now() - time_deltas[time_i] * (time_j-1)).strftime("%a. %b. %d, %Y at %H:%M:%S")
+            time_history_end = time_round_func(time_i, datetime.datetime.now() - time_deltas[time_i] * (time_j-2)).strftime("%a. %b. %d, %Y at %H:%M:%S")
+        else:
+            return "all records"
+        return f"{time_history_start} to {time_history_end}"
+    @app.callback(
+            Output("send", "figure"), Output("recv", "figure"), Output("whereis", "options"), Output("store_send", "data"), Output("store_recv", "data"),
+            Input("smoothing", "value"), Input("trim-labels", "value"), Input("resampling", "value"),
+            Input("select", "value"), Input("where", "value"), Input("whereis", "value"), Input("time_i", "value"), Input("time_j", "value"),
+            Input('send', 'relayoutData'), Input('recv', 'relayoutData'), Input('send', 'restyleData'), Input('recv', 'restyleData'),
+            Input("interval-component", "n_intervals"),
+            State("store_send", "data"), State("store_recv", "data"), State("send", "figure"), State("recv", "figure"),
+            prevent_initial_call=True,
+            )
+    def update(smoothing, trim, resampling, dim, where, whereis, time_i, time_j, relayout_send, relayout_recv, restyle_send, restyle_recv, _, store_send, store_recv, fig_send, fig_recv):
+        if not callback_context.triggered or (callback_context.triggered[0]["prop_id"] == "time_j.value" and time_i == 0):
+            raise PreventUpdate
+        input_id = callback_context.triggered[0]["prop_id"]
+        # sync zoom level between figs and prevent zooming outside of the data range
+        if input_id == "send.relayoutData" and relayout_send is not None and 'xaxis.range[0]' in relayout_send:
+            # update fig_recv to match fig_send zoom
+            store_recv["rev"] += 1
+            fig_recv["layout"]["xaxis"]["range"] = [max(relayout_send['xaxis.range[0]'], store_recv["min_x"]), min(relayout_send['xaxis.range[1]'], store_recv["max_x"])]
+            fig_recv["layout"]["uirevision"] = store_recv["rev"]
+            # prevent zooming outside of the data range
+            if store_send["min_x"] > relayout_send['xaxis.range[0]'] or store_send["max_x"] < relayout_send['xaxis.range[1]']:
+                store_send["rev"] += 1
+                fig_send["layout"]["xaxis"]["range"] = [max(relayout_send['xaxis.range[0]'], store_send["min_x"]), min(relayout_send['xaxis.range[1]'], store_send["max_x"])]
+                fig_send["layout"]["uirevision"] = store_send["rev"]
+                return fig_send, fig_recv, no_update, store_send, store_recv
+            return no_update, fig_recv, no_update, no_update, store_recv
+        if input_id == "recv.relayoutData" and relayout_recv is not None and 'xaxis.range[0]' in relayout_recv:
+            # update fig_send to match fig_recv zoom
+            store_send["rev"] += 1
+            fig_send["layout"]["xaxis"]["range"] = [max(relayout_recv['xaxis.range[0]'], store_send["min_x"]), min(relayout_recv['xaxis.range[1]'], store_send["max_x"])]
+            fig_send["layout"]["uirevision"] = store_send["rev"]
+            # prevent zooming outside of the data range
+            if store_recv["min_x"] > relayout_recv['xaxis.range[0]'] or store_recv["max_x"] < relayout_recv['xaxis.range[1]']:
+                store_recv["rev"] += 1
+                fig_recv["layout"]["xaxis"]["range"] = [max(relayout_recv['xaxis.range[0]'], store_recv["min_x"]), min(relayout_recv['xaxis.range[1]'], store_recv["max_x"])]
+                fig_recv["layout"]["uirevision"] = store_recv["rev"]
+                return fig_send, fig_recv, no_update, store_send, store_recv
+            return fig_send, no_update, no_update, store_send, no_update
+        # get visibility of legend items (traces)
+        if input_id == "send.restyleData" and restyle_send is not None and "visible" in restyle_send[0]:
+            for visible, index in zip(restyle_send[0]["visible"], restyle_send[1]):
+                store_send["visible"][store_send["columns"][index]] = visible
+                # update recv fig to match
+                store_recv["visible"][store_recv["columns"][index]] = visible
+                fig_recv["data"][index]["visible"] = visible
+            return no_update, fig_recv, no_update, store_send, store_recv
+        if input_id == "recv.restyleData" and restyle_recv is not None and "visible" in restyle_recv[0]:
+            for visible, index in zip(restyle_recv[0]["visible"], restyle_recv[1]):
+                store_recv["visible"][store_recv["columns"][index]] = visible
+                # update send fig to match
+                store_send["visible"][store_send["columns"][index]] = visible
+                fig_send["data"][index]["visible"] = visible
+            return fig_send, no_update, no_update, store_send, store_recv
+        # generate the query string using the selected options (time_i is the index of the time period, time_j is the number of time period steps to go back)
+        if time_j == 0:
+            time_history_start = (datetime.datetime.now() - time_deltas[time_i]).strftime("%Y-%m-%d %H:%M:%S")
+            time_history_end = "now"
+        elif time_i != 0:
+            time_history_start = time_round_func(time_i, datetime.datetime.now() - time_deltas[time_i] * (time_j-1)).strftime("%Y-%m-%d %H:%M:%S")
+            time_history_end = time_round_func(time_i, datetime.datetime.now() - time_deltas[time_i] * (time_j-2)).strftime("%Y-%m-%d %H:%M:%S")
+        if time_i == 0:
+            time_query = ""
+        else:
+            if where and whereis:
+                time_query = f" AND contime > datetime(\"{time_history_start}\") AND contime < datetime(\"{time_history_end}\")"
+            else:
+                time_query = f" WHERE contime > datetime(\"{time_history_start}\") AND contime < datetime(\"{time_history_end}\")"
+        if where and whereis:
+            query = f"SELECT {dim}, contime, send, recv FROM connections WHERE {where} IS \"{whereis}\"{time_query}"
+        else:
+            query = f"SELECT {dim}, contime, send, recv FROM connections{time_query}"
+        # run query and populate whereis options
+        con = sqlite3.connect(file_path)
+        df = psql.read_sql(query, con)
+        whereis_options = []
+        if where:
+            if time_query.startswith(" AND"):
+                time_query = time_query.replace(" AND", " WHERE", 1)
+            query = f"SELECT DISTINCT {where} FROM connections{time_query}"
+            cur = con.cursor()
+            cur.execute(query)
+            whereis_values = cur.fetchall()
+            if where == "uid":
+                whereis_options = [{"label": f"is {get_user(x[0])}", "value": x[0]} for x in whereis_values]
+            else:
+                whereis_options = [{"label": f"is {trim_label(x[0], trim)}", "value": x[0]} for x in whereis_values]
+        con.close()
+        # structure the data for plotting
+        df_send = df.groupby(["contime", dim])["send"].sum().unstack(dim, fill_value=0)
+        df_recv = df.groupby(["contime", dim])["recv"].sum().unstack(dim, fill_value=0)
+        # store column names before renaming
+        store_send["columns"] = df_send.columns
+        store_recv["columns"] = df_recv.columns
+        # rename columns with nicer labels (add data totals, username, geoip lookup, and trim if requested)
+        df_send_total = df_send.sum()
+        df_recv_total = df_recv.sum()
+        df_send_new_columns = [get_totals(df_send_total, col) for col in df_send.columns]
+        df_recv_new_columns = [get_totals(df_recv_total, col) for col in df_recv.columns]
+        if dim == "uid":
+            df_send_new_columns = [col.replace(str(uid), get_user(uid), 1) for col, uid in zip(df_send_new_columns, df_send.columns)]
+            df_recv_new_columns = [col.replace(str(uid), get_user(uid), 1) for col, uid in zip(df_recv_new_columns, df_recv.columns)]
+        elif dim == "raddr" and geoip_reader is not None:
+            df_send_new_columns = [col.replace(str(ip), get_geoip(ip), 1) for col, ip in zip(df_send_new_columns, df_send.columns)]
+            df_recv_new_columns = [col.replace(str(ip), get_geoip(ip), 1) for col, ip in zip(df_recv_new_columns, df_recv.columns)]
+        df_send_new_columns = [trim_label(col, trim) for col in df_send_new_columns]
+        df_recv_new_columns = [trim_label(col, trim) for col in df_recv_new_columns]
+        df_send.columns = df_send_new_columns
+        df_recv.columns = df_recv_new_columns
+        # resample the data if it is too large for performance, and smooth if requested
+        if resampling:
+            if len(df_send) > resampling:
+                df_send.index = pd.to_datetime(df_send.index)
+                n = len(df_send) // resampling
+                df_send = df_send.resample(f'{n}T').mean().fillna(0)
+            if len(df_recv) > resampling:
+                df_recv.index = pd.to_datetime(df_recv.index)
+                n = len(df_recv) // resampling
+                df_recv = df_recv.resample(f'{n}T').mean().fillna(0)
+        if smoothing:
+            df_send = df_send.rolling(smoothing, center=True, closed="both", min_periods=smoothing//2).mean()
+            df_recv = df_recv.rolling(smoothing, center=True, closed="both", min_periods=smoothing//2).mean()
+        # update the store and figure
+        store_send["min_x"] = df_send.index.min()
+        store_send["max_x"] = df_send.index.max()
+        store_recv["min_x"] = df_recv.index.min()
+        store_recv["max_x"] = df_recv.index.max()
+        store_send["rev"] += 1
+        store_recv["rev"] += 1
+        fig_send = px.line(df_send, line_shape="linear", render_mode="svg", labels={
+            "contime": "", "value": "Data Sent (bytes)", dim: dim_labels[dim]})
+        fig_send.update_layout(uirevision=store_send["rev"])
+        fig_send.update_xaxes(range=[store_send["min_x"], store_send["max_x"]])
+        fig_send.update_yaxes(fixedrange=True)
+        fig_send.update_traces(fill="tozeroy", line_simplify=True)
+        fig_recv = px.line(df_recv, line_shape="linear", render_mode="svg", labels={
+            "contime": "", "value": "Data Received (bytes)", dim: dim_labels[dim]})
+        fig_recv.update_layout(uirevision=store_recv["rev"])
+        fig_recv.update_xaxes(range=[store_recv["min_x"], store_recv["max_x"]])
+        fig_recv.update_yaxes(fixedrange=True)
+        fig_recv.update_traces(fill="tozeroy", line_simplify=True)
+        # carry over visibility settings manually (instead keeping uirevision fixed) since column indices may not line up
+        for i in range(len(fig_send.data)):
+            fig_send.data[i].visible = True
+            if store_send["columns"][i] in store_send["visible"]:
+                fig_send.data[i].visible = store_send["visible"][store_send["columns"][i]]
+        for i in range(len(fig_recv.data)):
+            fig_recv.data[i].visible = True
+            if store_recv["columns"][i] in store_recv["visible"]:
+                fig_recv.data[i].visible = store_recv["visible"][store_recv["columns"][i]]
+        for column in list(store_send["visible"].keys()):
+            if column not in store_send["columns"]:
+                _ = store_send["visible"].pop(column)
+        for column in list(store_recv["visible"].keys()):
+            if column not in store_recv["columns"]:
+                _ = store_recv["visible"].pop(column)
+        return fig_send, fig_recv, whereis_options, store_send, store_recv
+    @app.callback(Output("exit", "n_clicks"), Input("exit", "n_clicks"))
+    def exit(clicks):
+        if clicks:
+            os.kill(os.getpid(), signal.SIGTERM)
+        return 0
+    app.run_server(host=os.getenv("HOST", "localhost"), port=os.getenv("PORT", "5100"), debug=bool(eval(os.getenv("DASH_DEBUG", "False"))))
+
diff --git a/picosnitch/utils.py b/picosnitch/utils.py
new file mode 100755
index 0000000..9c54117
--- /dev/null
+++ b/picosnitch/utils.py
@@ -0,0 +1,233 @@
+#!/usr/bin/env python3
+# picosnitch
+# Copyright (C) 2020-2023 Eric Lesiuta
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+# https://github.com/elesiuta/picosnitch
+
+import ctypes
+import ctypes.util
+import fcntl
+import functools
+import ipaddress
+import json
+import hashlib
+import multiprocessing
+import os
+import pickle
+import socket
+import sys
+import termios
+import typing
+
+from .constants import BASE_PATH, PID_CACHE, ST_DEV_MASK
+
+
+def read_snitch() -> dict:
+    """read data for the snitch dictionary from config.json and record.json or init new files if not found"""
+    template = {
+        "Config": {
+            "DB retention (days)": 30,
+            "DB sql log": True,
+            "DB sql server": {},
+            "DB text log": False,
+            "DB write limit (seconds)": 10,
+            "Dash scroll zoom": True,
+            "Dash theme": "",
+            "Desktop notifications": True,
+            "Every exe (not just conns)": False,
+            "GeoIP lookup": True,
+            "Log addresses": True,
+            "Log commands": True,
+            "Log ignore": [],
+            "Log ports": True,
+            "Perf ring buffer (pages)": 256,
+            "Set RLIMIT_NOFILE": None,
+            "Set st_dev mask": None,
+            "VT API key": "",
+            "VT file upload": False,
+            "VT request limit (seconds)": 15
+        },
+        "Error Log": [],
+        "Exe Log": [],
+        "Executables": {},
+        "Names": {},
+        "Parent Executables": {},
+        "Parent Names": {},
+        "SHA256": {}
+    }
+    data = {k: v for k, v in template.items()}
+    data["Config"] = {k: v for k, v in template["Config"].items()}
+    write_config = False
+    config_path = os.path.join(BASE_PATH, "config.json")
+    record_path = os.path.join(BASE_PATH, "record.json")
+    if os.path.exists(config_path):
+        with open(config_path, "r", encoding="utf-8", errors="surrogateescape") as json_file:
+            data["Config"] = json.load(json_file)
+        for key in template["Config"]:
+            if key not in data["Config"]:
+                data["Config"][key] = template["Config"][key]
+                write_config = True
+    else:
+        write_config = True
+    if os.path.exists(record_path):
+        with open(record_path, "r", encoding="utf-8", errors="surrogateescape") as json_file:
+            snitch_record = json.load(json_file)
+        for key in ["Executables", "Names", "Parent Executables", "Parent Names", "SHA256"]:
+            if key in snitch_record:
+                data[key] = snitch_record[key]
+    assert all(type(data[key]) == type(template[key]) for key in template), "Invalid json files"
+    assert all(key in ["Set RLIMIT_NOFILE", "Set st_dev mask"] or type(data["Config"][key]) == type(template["Config"][key]) for key in template["Config"]), "Invalid config"
+    if write_config:
+        write_snitch(data, write_config=True)
+    return data
+
+
+def write_snitch(snitch: dict, write_config: bool = False, write_record: bool = True) -> None:
+    """write the snitch dictionary to config.json, record.json, exe.log, and error.log"""
+    config_path = os.path.join(BASE_PATH, "config.json")
+    record_path = os.path.join(BASE_PATH, "record.json")
+    exe_log_path = os.path.join(BASE_PATH, "exe.log")
+    error_log_path = os.path.join(BASE_PATH, "error.log")
+    assert os.getuid() == 0, "Requires root privileges to write config and log files"
+    if not os.path.isdir(BASE_PATH):
+        os.makedirs(BASE_PATH)
+    if os.stat(BASE_PATH).st_uid == 0 and os.getenv("SUDO_UID"):
+        os.chown(BASE_PATH, int(os.getenv("SUDO_UID")), int(os.getenv("SUDO_UID")))
+    snitch_config = snitch["Config"]
+    try:
+        if write_config:
+            with open(config_path, "w", encoding="utf-8", errors="surrogateescape") as json_file:
+                json.dump(snitch_config, json_file, indent=2, separators=(',', ': '), sort_keys=True, ensure_ascii=False)
+        del snitch["Config"]
+        if snitch["Error Log"]:
+            with open(error_log_path, "a", encoding="utf-8", errors="surrogateescape") as text_file:
+                text_file.write("\n".join(snitch["Error Log"]) + "\n")
+        del snitch["Error Log"]
+        if snitch["Exe Log"]:
+            with open(exe_log_path, "a", encoding="utf-8", errors="surrogateescape") as text_file:
+                text_file.write("\n".join(snitch["Exe Log"]) + "\n")
+        del snitch["Exe Log"]
+        if write_record:
+            with open(record_path, "w", encoding="utf-8", errors="surrogateescape") as json_file:
+                json.dump(snitch, json_file, indent=2, separators=(',', ': '), sort_keys=True, ensure_ascii=False)
+    except Exception:
+        NotificationManager().toast("picosnitch write error", file=sys.stderr)
+    snitch["Config"] = snitch_config
+    snitch["Error Log"] = []
+    snitch["Exe Log"] = []
+
+
+@functools.lru_cache(maxsize=None)
+def reverse_dns_lookup(ip: str) -> str:
+    """do a reverse dns lookup, return original ip if fails"""
+    try:
+        host = socket.getnameinfo((ip, 0), 0)[0]
+        try:
+            _ = ipaddress.ip_address(host)
+            return ip
+        except ValueError:
+            return ".".join(reversed(host.split(".")))
+    except Exception:
+        return ip
+
+
+@functools.lru_cache(maxsize=PID_CACHE)
+def get_sha256_fd(path: str, st_dev: int, st_ino: int, _mod_cnt: int) -> str:
+    """get sha256 of process executable from /proc/monitor_pid/fd/proc_exe_fd"""
+    try:
+        sha256 = hashlib.sha256()
+        with open(path, "rb") as f:
+            if not st_ino:
+                return "!!! FD Stat Error"
+            if (st_dev, st_ino) != get_fstat(f.fileno()):
+                return "!!! FD Cache Error"
+            while data := f.read(1048576):
+                sha256.update(data)
+        return sha256.hexdigest()
+    except Exception:
+        return "!!! FD Read Error"
+
+
+@functools.lru_cache(maxsize=PID_CACHE)
+def get_sha256_pid(pid: int, st_dev: int, st_ino: int) -> str:
+    """get sha256 of process executable from /proc/pid/exe"""
+    try:
+        sha256 = hashlib.sha256()
+        with open(f"/proc/{pid}/exe", "rb") as f:
+            if (st_dev, st_ino) != get_fstat(f.fileno()):
+                return "!!! PID Recycled Error"
+            while data := f.read(1048576):
+                sha256.update(data)
+        return sha256.hexdigest()
+    except Exception:
+        return "!!! PID Read Error"
+
+
+@functools.lru_cache(maxsize=PID_CACHE)
+def get_sha256_fuse(q_in: multiprocessing.Queue, q_out: multiprocessing.Queue, path: str, pid: int, st_dev: int, st_ino: int, _mod_cnt: int) -> str:
+    """get sha256 of process executable from a fuse mount"""
+    q_in.put(pickle.dumps((path, pid, st_dev, st_ino)))
+    try:
+        return q_out.get()
+    except Exception:
+        return "!!! FUSE Subprocess Error"
+
+
+def get_fstat(fd: int) -> typing.Tuple[int, int]:
+    """get (st_dev, st_ino) or (0, 0) if fails"""
+    try:
+        stat = os.fstat(fd)
+        return stat.st_dev & ST_DEV_MASK, stat.st_ino
+    except Exception:
+        return 0, 0
+
+
+def get_fanotify_events(fan_fd: int, fan_mod_cnt: dict, q_error: multiprocessing.Queue) -> None:
+    """check if any watched executables were modified and increase count to trigger rehash"""
+    sizeof_event = ctypes.sizeof(FanotifyEventMetadata)
+    bytes_avail = ctypes.c_int()
+    fcntl.ioctl(fan_fd, termios.FIONREAD, bytes_avail)
+    for i in range(0, bytes_avail.value, sizeof_event):
+        try:
+            fanotify_event_metadata = FanotifyEventMetadata()
+            buf = os.read(fan_fd, sizeof_event)
+            ctypes.memmove(ctypes.addressof(fanotify_event_metadata), buf, sizeof_event)
+            st_dev, st_ino = get_fstat(fanotify_event_metadata.fd)
+            fan_mod_cnt[f"{st_dev} {st_ino}"] += 1
+            os.close(fanotify_event_metadata.fd)
+        except Exception as e:
+            q_error.put("Fanotify Event %s%s on line %s" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno))
+
+
+def get_vt_results(snitch: dict, q_vt: multiprocessing.Queue, q_out: multiprocessing.Queue, check_pending: bool = False) -> None:
+    """get virustotal results from subprocess and update snitch, q_vt = q_in if check_pending else q_out"""
+    if check_pending:
+        for exe in snitch["SHA256"]:
+            for sha256 in snitch["SHA256"][exe]:
+                if snitch["SHA256"][exe][sha256] in ["VT Pending", "File not analyzed (no api key)", "", None]:
+                    if exe in snitch["Executables"] and snitch["Executables"][exe]:
+                        name = snitch["Executables"][exe][0]
+                    elif exe in snitch["Parent Executables"] and snitch["Parent Executables"][exe]:
+                        name = snitch["Parent Executables"][exe][0]
+                    else:
+                        name = exe
+                    proc = {"exe": exe, "name": name}
+                    q_vt.put(pickle.dumps((proc, sha256)))
+    else:
+        while not q_vt.empty():
+            proc, sha256, result, suspicious = pickle.loads(q_vt.get())
+            q_out.put(pickle.dumps({"type": "vt_result", "name": proc["name"], "exe": proc["exe"], "sha256": sha256, "result": result, "suspicious": suspicious}))
+
diff --git a/picosnitch/virustotal_subprocess.py b/picosnitch/virustotal_subprocess.py
new file mode 100755
index 0000000..7bbc68c
--- /dev/null
+++ b/picosnitch/virustotal_subprocess.py
@@ -0,0 +1,105 @@
+#!/usr/bin/env python3
+# picosnitch
+# Copyright (C) 2020-2023 Eric Lesiuta
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+# https://github.com/elesiuta/picosnitch
+
+import hashlib
+import multiprocessing
+import pickle
+import queue
+import sys
+import time
+
+from .utils import get_fstat
+
+
+def virustotal_subprocess(config: dict, q_error, q_vt_pending, q_vt_results):
+    """get virustotal results of process executable"""
+    parent_process = multiprocessing.parent_process()
+    try:
+        import requests
+        vt_enabled = True
+    except ImportError:
+        vt_enabled = False
+    if not (config["VT API key"] and vt_enabled):
+        config["VT request limit (seconds)"] = 0
+    headers = {"x-apikey": config["VT API key"]}
+    def get_analysis(analysis_id: dict, sha256: str) -> dict:
+        api_url = "https://www.virustotal.com/api/v3/analyses/" + analysis_id["data"]["id"]
+        for i in range(90):
+            time.sleep(max(5, config["VT request limit (seconds)"]))
+            response = requests.get(api_url, headers=headers).json()
+            if response["data"]["attributes"]["status"] == "completed":
+                return response["data"]["attributes"]["stats"]
+        return {"timeout": api_url, "sha256": sha256}
+    while True:
+        if not parent_process.is_alive():
+            return 0
+        try:
+            time.sleep(config["VT request limit (seconds)"])
+            proc, analysis = None, None
+            proc, sha256 = pickle.loads(q_vt_pending.get(block=True, timeout=15))
+            suspicious = False
+            if config["VT API key"] and vt_enabled:
+                try:
+                    analysis = requests.get("https://www.virustotal.com/api/v3/files/" + sha256, headers=headers).json()
+                    analysis = analysis["data"]["attributes"]["last_analysis_stats"]
+                except Exception:
+                    if config["VT file upload"]:
+                        try:
+                            with open(proc["fd"], "rb") as f:
+                                assert (proc["dev"], proc["ino"]) == get_fstat(f.fileno())
+                                files = {"file": (proc["exe"], f)}
+                                analysis_id = requests.post("https://www.virustotal.com/api/v3/files", headers=headers, files=files).json()
+                            analysis = get_analysis(analysis_id, sha256)
+                        except Exception:
+                            try:
+                                readlink_exe_sha256 = hashlib.sha256()
+                                with open(proc["exe"], "rb") as f:
+                                    while data := f.read(1048576):
+                                        readlink_exe_sha256.update(data)
+                                assert readlink_exe_sha256.hexdigest() == sha256
+                                with open(proc["exe"], "rb") as f:
+                                    files = {"file": (proc["exe"], f)}
+                                    analysis_id = requests.post("https://www.virustotal.com/api/v3/files", headers=headers, files=files).json()
+                                analysis = get_analysis(analysis_id, sha256)
+                            except Exception:
+                                q_vt_results.put(pickle.dumps((proc, sha256, "Failed to read process for upload", suspicious)))
+                                continue
+                    else:
+                        # could also be an invalid api key
+                        q_vt_results.put(pickle.dumps((proc, sha256, "File not analyzed (analysis not found)", suspicious)))
+                        continue
+                if analysis["suspicious"] != 0 or analysis["malicious"] != 0:
+                    suspicious = True
+                q_vt_results.put(pickle.dumps((proc, sha256, str(analysis), suspicious)))
+            elif vt_enabled:
+                q_vt_results.put(pickle.dumps((proc, sha256, "File not analyzed (no api key)", suspicious)))
+            else:
+                q_vt_results.put(pickle.dumps((proc, sha256, "File not analyzed (requests library not found)", suspicious)))
+        except queue.Empty:
+            # have to timeout here to check whether to terminate otherwise this could stay hanging
+            # daemon=True flag for multiprocessing.Process does not work after root privileges are dropped for parent
+            pass
+        except Exception as e:
+            q_error.put("VT %s%s on line %s" % (type(e).__name__, str(e.args), sys.exc_info()[2].tb_lineno))
+            try:
+                analysis = str(analysis)
+            except Exception:
+                analysis = "unknown analysis"
+            q_error.put("Last VT Exception on: %s with %s" % (str(proc), str(analysis)))
+
diff --git a/setup.py b/setup.py
index 9ee78e8..0fa7a53 100644
--- a/setup.py
+++ b/setup.py
@@ -13,8 +13,8 @@
     long_description_content_type="text/markdown",
     url="https://elesiuta.github.io/picosnitch",
     license="GPLv3",
-    py_modules=["picosnitch"],
-    entry_points={"console_scripts": ["picosnitch = picosnitch:start_picosnitch"]},
+    packages=["picosnitch"],
+    entry_points={"console_scripts": ["picosnitch = picosnitch.cli:start_picosnitch"]},
     install_requires=["psutil"],
     extras_require={
         "enable_dash": ["dash", "pandas", "plotly"],