RustNet

Per-process network monitoring for your terminal: live TCP, UDP, and QUIC connections with deep packet inspection, sandboxed by default.

English | 简体中文 | 日本語

Real-time visibility into every connection your machine makes, who owns it, and what protocol it's speaking. No tcpdump, X11 forwarding, or root piping.

Features

• Per-process attribution: Every TCP, UDP, and QUIC connection mapped to its owning process, via eBPF on Linux, PKTAP on macOS, ETW with an automatic IP Helper fallback on Windows, and native APIs on FreeBSD. Wireshark and tcpdump can't do this; netstat / ss can't show live state.
• Deep packet inspection: Identify HTTP, HTTPS/TLS with SNI, DNS, SSH, FTP, QUIC, MQTT, BitTorrent, STUN, NTP, mDNS, LLMNR, DHCP, SNMP, SSDP, and NetBIOS, without external dissectors.
• Annotated PCAPNG export: --pcapng-export writes a Wireshark-ready capture with process, PID, direction, DPI/SNI, and GeoIP embedded as per-packet comments. Open it in Wireshark and every packet already names its owning process, with no post-processing. Classic --pcap-export with a JSONL sidecar for offline correlation is also available.
• Security sandboxing: Landlock (Linux 5.13+), Seatbelt (macOS), token privilege drop + job-object child-process block (Windows). Drops privileges immediately after libpcap initializes. See SECURITY.md.
• TCP network analytics: Real-time retransmissions, out-of-order packets, and fast-retransmit detection, per-connection and aggregate.
• Smart connection lifecycle: Protocol-aware timeouts with white → yellow → red staleness indicators. Toggle t to keep historic (closed) connections visible for forensics.
• Vim/fzf-style filtering: port:, src:, dst:, sni:, process:, state:, proto:, plus regex via /(?i)pattern/.
• GeoIP enrichment: Country lookups via local MaxMind GeoLite2. No network calls.
• Kubernetes attribution (optional kubernetes feature): connections mapped to their pod, namespace, and container, shown in the details pane, JSON/PCAPNG exports, and the pod:, ns:, container: filters. Enabled in the official Docker image; on a cluster, use the kubectl-rustnet plugin to run it as an ephemeral debug pod. See USAGE.md.
• Cross-platform: Linux, macOS, Windows, FreeBSD.

Why RustNet?

RustNet fills the gap between simple connection tools (netstat, ss) and packet analyzers (Wireshark, tcpdump):

• Process attribution: See which application owns each connection. Wireshark cannot provide this because it only sees packets, not sockets.
• Connection-centric view: Track states, bandwidth, and protocols per connection in real-time
• SSH-friendly: TUI works over SSH so you can quickly see what's happening on a remote server without forwarding X11 or capturing traffic

RustNet complements packet capture tools. Use RustNet to see what's making connections. For direct Wireshark inspection, --pcapng-export writes live best-effort packet comments with PID/process context. For cleanup-time correlation, use --pcap-export plus the JSONL sidecar and optional scripts/pcap_enrich.py. See PCAP Export and Comparison with Similar Tools for details.

Built on ratatui, libpcap, eBPF (libbpf-rs), DashMap, crossbeam, ring, MaxMind GeoLite2, and Landlock. See ARCHITECTURE.md for the full dependency breakdown.

cargo build --release --no-default-features

Screenshots

Overview Connections table with live stats and sparklines	Details Per-connection SNI, cipher, GeoIP, DPI
Graph Traffic chart, app distribution, top processes	Activity Process egress/ingress, 60-second coverage, attribution, and remote peers

Quick Start

Installation

Homebrew (macOS / Linux):

brew install rustnet

Ubuntu (25.10+):

sudo add-apt-repository ppa:domcyrus/rustnet
sudo apt update && sudo apt install rustnet

Fedora (42+):

sudo dnf copr enable domcyrus/rustnet
sudo dnf install rustnet

openSUSE Tumbleweed:

sudo zypper addrepo https://download.opensuse.org/repositories/home:/domcyrus:/rustnet/openSUSE_Tumbleweed/home:domcyrus:rustnet.repo
sudo zypper refresh
sudo zypper install rustnet

Arch Linux:

sudo pacman -S rustnet

Nix / NixOS:

nix-shell -p rustnet
# Then inside the shell: sudo rustnet

From crates.io:

cargo install rustnet-monitor

Windows (Chocolatey):

# Run in Administrator PowerShell
# Requires Npcap (https://npcap.com) installed with "WinPcap API-compatible Mode" enabled
choco install rustnet

Other platforms:

• FreeBSD: Download from rustnet-bsd releases
• Docker, source builds, other Linux distros: See INSTALL.md for detailed instructions

Running RustNet

Packet capture requires elevated privileges:

# Quick start (all platforms)
sudo rustnet

# Linux: Grant capabilities to run without sudo (recommended)
sudo setcap 'cap_net_raw,cap_bpf,cap_perfmon+eip' $(which rustnet)
rustnet

Common options:

rustnet -i eth0              # Specify network interface
rustnet --show-localhost     # Show localhost connections
rustnet --no-resolve-dns     # Disable reverse DNS lookups (enabled by default)
rustnet -r 500               # Set refresh interval (ms)
rustnet --theme classic      # Original full-color palette (default: muted)
rustnet --pcapng-export capture.pcapng  # Annotated PCAPNG for Wireshark

See INSTALL.md for detailed permission setup and USAGE.md for complete options.

If you set capabilities but the TUI still shows eBPF unavailable, see eBPF Unavailable Despite Capabilities Being Set in the troubleshooting section.

Keyboard Controls

See USAGE.md for detailed keyboard controls and navigation tips.

Filtering & Sorting

Quick filtering examples:

/google                        # Search for "google" anywhere
/port:443                      # Filter by port
/process:firefox               # Filter by process
/state:established             # Filter by connection state
/dport:443 sni:github.com      # Combine filters

Sorting:

• Press s to cycle through sortable columns (Process, Addresses, Service, Application, State, Bandwidth)
• Press S (Shift+s) to toggle sort direction
• Find bandwidth hogs: Press s until "Bandwidth Total ↓" appears (sorts by combined up+down speed)

See USAGE.md for complete filtering syntax and sorting guide.

Documentation

• INSTALL.md - Detailed installation instructions for all platforms, permission setup, and troubleshooting
• USAGE.md - Complete usage guide including command-line options, filtering, sorting, and logging
• SECURITY.md - Security features including Landlock sandboxing and privilege management
• ARCHITECTURE.md - Technical architecture, platform implementations, and performance details
• CONTRIBUTING.md - Contribution workflow, quality requirements, and project guidelines
• PROFILING.md - Performance profiling guide with flamegraph setup and optimization tips
• ROADMAP.md - Planned features and future improvements
• RELEASE.md - Release process for maintainers

Contributing

Contributions are welcome! Please see CONTRIBUTING.md for guidelines on how to contribute.

See CONTRIBUTORS.md for a list of people who have contributed to this project.

License

This project is licensed under the Apache License, Version 2.0 - see the LICENSE file for details.

Acknowledgments

• Built with ratatui for the terminal UI
• Packet capture powered by libpcap
• Inspired by tools like tshark/wireshark/tcpdump, sniffnet, netstat, ss, iftop, and bandwhich
• Some code is vibe coded (OMG) / may the LLM gods be with you

Documentation Moved

Some sections have been moved to dedicated files for better organization:

• Permissions Setup: Now in INSTALL.md - Permissions Setup
• Installation Instructions: Now in INSTALL.md
• Detailed Usage: Now in USAGE.md
• Architecture Details: Now in ARCHITECTURE.md