How to verify that software makes no network calls

A vendor can say its software makes no outside calls, and an evaluator looking at software for a disconnected network needs a way to test that. Software meant for such a network can still reach out for update checks, telemetry, or other outbound calls. Five methods are available: disconnect the machine, capture packets, run the program in a network namespace, apply a Content Security Policy, and review the dependency list. Each answers a narrower question than whether the software ever makes a network call, and the documentation for each tool says what it observes and where it stops.

Watch what the machine does

Pull the cable. The simplest test removes the network path. Unplug the Ethernet cable, switch off wireless, or use a machine with no network hardware attached, then run the software through its full workflow. A feature that stalls, shows an error, or never finishes points to a dependency on the connection. The test leaves no record of what the program tried to send, so a packet capture is the natural companion.

Capture the packets. The tcpdump manual, updated September 10, 2026 for a development version, says the tool prints a description of packets on a network interface that match a filter. A few options matter for this test:

• -i any captures from all regular interfaces on supported systems, without promiscuous mode. Without -i, tcpdump picks the lowest-numbered active interface that is not the loopback.
• -w saves raw packets to a file, and -r reads a saved file.
• Live capture may require special privileges.
• The "packets dropped by kernel" count reports packets lost to insufficient buffer space.

The Wireshark User's Guide describes a packet analyzer that can open captures from tcpdump. It says Wireshark does not manipulate traffic: it observes, and it does not send packets except for domain name resolution, which can be disabled. It also says Wireshark is not an intrusion detection system.

A capture records the packets that crossed the chosen interfaces during the capture window. An empty capture therefore speaks to those interfaces and that run, and the dropped-packet count indicates packets the capture missed.

Contain the program

Run it in a network namespace. On Linux, the unshare manual page says the command creates the namespaces named by its options and then runs a program in them. The --net option creates a new network namespace. The page says the process receives independent Internet Protocol version 4 (IPv4) and version 6 (IPv6) stacks, its own routing tables and firewall rules, and its own sockets. That sentence lists what is separated. Whether outbound traffic fails is something the evaluator observes by starting the program in the new namespace and watching whether anything that depends on a connection breaks. The manual page is dated August 3, 2026 and documents a development version of util-linux.

Restrict connections with a Content Security Policy. For software delivered as a web page, a Content Security Policy (CSP) lets the page tell the browser what its code may do. The MDN CSP guide describes delivery by the Content-Security-Policy Hypertext Transfer Protocol (HTTP) header or by a <meta> element, and says the <meta> route does not support all CSP features.

The connect-src directive restricts the URLs that scripts can connect to. MDN lists the controlled application programming interfaces (APIs), including fetch(), XMLHttpRequest, WebSocket, EventSource, navigator.sendBeacon(), and the ping attribute on links. The value 'none' blocks connections of that type. If connect-src is absent, the browser falls back to default-src.

Three limits follow from the documentation. The directive covers only the APIs it lists, and other resource types, such as images, fall under other directives. A policy sent in Content-Security-Policy-Report-Only mode reports violations without blocking them. And CSP is enforced by the browser, so it applies to the code the browser runs.

Review the dependencies

A dependency review starts with a complete list of what the build includes. For Node.js projects, the npm ls documentation says the command prints a tree of installed package versions, following the logical dependency tree. By default it shows only the project's immediate dependencies, and --all extends the tree to everything beneath them. It flags extraneous, missing, and invalid packages, and with --package-lock-only it reads from package-lock.json instead of the installed files.

The command lists packages and does not report network access. The list identifies what to examine, and the next step is to check each package against its own documentation or source for update checks, telemetry, or other outbound calls.

What each result covers

The five checks observe different things: behavior with no path, packets on named interfaces, behavior in an isolated stack, browser-enforced connection rules, and the components in the build. Each result covers the scope its documentation describes: the interfaces captured, the namespace entered, the APIs a directive names, or the packages listed.

What to check

• Which of the five methods a vendor's claim rests on, and whether the claim is limited to that method's scope.
• Whether the full workflow was run with the network removed, and whether any feature stalled, showed an error, or never finished.
• Whether a packet capture covered the interfaces in use, spanned the full workflow, and reported its dropped-packet count.
• For software delivered as a web page, whether connect-src is set to 'none' and enforced, not sent in Content-Security-Policy-Report-Only mode.
• Whether the dependency list is complete (--all) and each package was checked for update checks, telemetry, or other outbound calls.

Azcuna's BABEL reads, translates, and searches foreign-language documents entirely on-device, with no cloud and no connection, and keeps every claim tied to the passage it came from. The long read on air-gapped RAG goes further.

Sources

1. 1tcpdump(1) manual page · The Tcpdump Group
2. 2Wireshark User's Guide, Chapter 1: Introduction · The Wireshark Foundation
3. 3unshare(1) - Linux manual page · Linux man-pages project (man7.org)
4. 4Content-Security-Policy: connect-src directive · MDN Web Docs, Mozilla
5. 5Content Security Policy (CSP) · MDN Web Docs, Mozilla
6. 6npm-ls · npm, Inc.