Tomasz-Plit/netwatch ? reverse-engineered prompt

Build me a Linux command line traffic monitor in C called netwatch.

I want it to run on one local network interface, scan the IPv4 subnet with ARP, and list the devices that reply. It should also capture packets with a raw packet socket, then watch TLS and QUIC handshakes for hostnames and show a live table with the hostname, source IP, count, and last seen time. Please write the packet parsing so it can handle normal TCP TLS SNI and QUIC on UDP port 443, and save packet details plus short hex and ASCII dumps to a log file called netwatch.log.

Add a mode to temporarily route traffic for selected devices through this computer by ARP spoofing, and make sure it cleans up properly when stopped. Also add a port restriction mode that limits capture to one local TCP source port and temporarily blocks other new connections while it runs. Normal cleanup on Ctrl+C matters, and if you need current Linux or OpenSSL details, look them up online.

Keep it as a practical tool for a real Linux machine, not a toy demo.