<p align="center" <h1 align="center"RustNet</h1 <p align="center" <strongPer-process network monitoring for your terminal: live TCP, UDP, and QUIC connections with deep packet inspection, sandboxed by default.</strong </p <p align="center" <a href="https://ratatui.rs/"<img src="https://ratatui.rs/built-with-ratatui/badge.svg" alt="Built With Ratatui"</a <a href="https://github.com/domcyrus/rustnet/actions"<img src="https://github.com/domcyrus/rustnet/workflows/Rust/badge.svg" alt="Build Status"</a <a href="https://crates.io/crates/rustnet-monitor"<img src="https://img.shields.io/crates/v/rustnet-monitor.svg" alt="Crates.io"</a <a href="https://github.com/domcyrus/rustnet/stargazers"<img src="https://img.shields.io/github/stars/domcyrus/rustnet?style=flat&logo=github" alt="GitHub Stars"</a <a href="LICENSE"<img src="https://img.shields.io/badge/license-Apache--2.0-blue.svg" alt="License"</a <a href="https://github.com/domcyrus/rustnet/releases"<img src="https://img.shields.io/github/v/release/domcyrus/rustnet.svg" alt="GitHub release"</a <a href="https://github.com/domcyrus/rustnet/pkgs/container/rustnet"<img src="https://img.shields.io/badge/docker-ghcr.io-blue?logo=docker" alt="Docker Image"</a </p </p
<p align="center" <strongEnglish</strong | <a href="README.zh-CN.md"简体中文</a | <a href="README.ja.md"日本語</a </p
<p align="center" <img src="./assets/rustnet.gif" alt="RustNet demo" width="800" </p
<p align="center" <emReal-time visibility into every connection your machine makes, who owns it, and what protocol it's speaking. No tcpdump, X11 forwarding, or root piping.</em </p
Features
- Per-process attribution: Every TCP, UDP, and QUIC connection mapped to its owning process, via eBPF on Linux, PKTAP on macOS, ETW with an automatic IP Helper fallback on Windows, and native APIs on FreeBSD. Wireshark and tcpdump can't do this; netstat / ss can't show live state.
- Deep packet inspection: Identify HTTP, HTTPS/TLS with SNI, DNS, SSH, FTP, QUIC, MQTT, BitTorrent, STUN, NTP, mDNS, LLMNR, DHCP, SNMP, SSDP, and NetBIOS, without external dissectors.
- Annotated PCAPNG export: --pcapng-export writes a Wireshark-ready capture with process, PID, direction, DPI/SNI, and GeoIP embedded as per-packet comments. Open it in Wireshark and every packet already names its owning process, with no post-processing. Classic --pcap-export with a JSONL sidecar for offline correlation is also available.
- Security sandboxing: Landlock (Linux 5.13+), Seatbelt (macOS), token privilege drop + job-object child-process block (Windows). Drops privileges immediately after libpcap initializes. See SECURITY.md.
- TCP network analytics: Real-time retransmissions, out-of-order packets, and fast-retransmit detection, per-connection and aggregate.
- Smart connection lifecycle: Protocol-aware timeouts with white → yellow → red staleness indicators. Toggle t to keep historic (closed) connections visible for forensics.
- Vim/fzf-style filtering: port:, src:, dst:, sni:, process:, state:, proto:, plus regex via /(?i)pattern/.
- GeoIP enrichment: Country lookups via local MaxMind GeoLite2. No network calls.
- Kubernetes attribution (optional kubernetes feature): connections mapped to their pod, namespace, and container, shown in the details pane, JSON/PCAPNG exports, and the pod:, ns:, container: filters. Enabled in the official Docker image; on a cluster, use the kubectl-rustnet plugin to run it as an ephemeral debug pod. See USAGE.md.
- Cross-platform: Linux, macOS, Windows, FreeBSD.
Why RustNet?
RustNet fills the gap between simple connection tools (netstat, ss) and packet analyzers (Wireshark, tcpdump):
- Process attribution: See which application owns each connection. Wireshark cannot provide this because it only sees packets, not sockets.
- Connection-centric view: Track states, bandwidth, and protocols per connection in real-time
- SSH-friendly: TUI works over SSH so you can quickly see what's happening on a remote server without forwarding X11 or capturing traffic
RustNet complements packet capture tools. Use RustNet to see what's making connections. For direct Wireshark inspection, --pcapng-export writes live best-effort packet comments with PID/process context. For cleanup-time correlation, use --pcap-export plus the JSONL sidecar and optional scripts/pcapenrich.py. See PCAP Export and Comparison with Similar Tools for details.
Built on ratatui, libpcap, eBPF (libbpf-rs), DashMap, crossbeam, ring, MaxMind GeoLite2, and Landlock. See ARCHITECTURE.md for the full dependency breakdown.
<details <summary<beBPF Enhanced Process Identification (Linux Default)</b</summary
RustNet uses kernel eBPF programs by default on Linux for enhanced performance and lower overhead process identification. However, this comes with important limitations:
Process Name Limitations:
- eBPF uses the kernel's comm field, which is limited to 16 characters
- Shows the task/thread command name, not the full executable path
- Multi-threaded applications often show thread names instead of the main process name
Real-world Examples:
- Firefox: May appear as "Socket Thread", "Web Content", "Isolated Web Co", or "MainThread"
- Chrome: May appear as "ThreadPoolForeg", "ChromeIOThread", "BrokerProcess", or "SandboxHelper"
- Electron apps: Often show as "electron", "node", or internal thread names
- System processes: Show truncated names like "systemd-resolve" → "systemd-resolve"