Built With Ratatui (https://ratatui.rs/built-with-ratatui/badge.svg) Build Status (https://github.com/domcyrus/rustnet/workflows/Rust/badge.svg) Crates.io (https://img.shields.io/crates/v/rustnet-monitor.svg) License (https://img.shields.io/badge/license-Apache--2.0-blue.svg) GitHub release (https://img.shields.io/github/v/release/domcyrus/rustnet.svg) Docker Image (https://img.shields.io/badge/docker-ghcr.io-blue?logo=docker)

RustNet

A cross-platform network monitoring tool built with Rust. RustNet provides real-time visibility into network connections with detailed state information, connection lifecycle management, deep packet inspection, and a terminal user interface.

!RustNet Demo

Features

• Real-time Network Monitoring: Monitor active TCP, UDP, ICMP, and ARP connections with detailed state information
• Connection States: Track TCP states (ESTABLISHED, SYN_SENT, TIME_WAIT), QUIC states (QUIC_INITIAL, QUIC_HANDSHAKE, QUIC_CONNECTED), DNS states, SSH states, and activity-based UDP states
• Interface Statistics: Real-time monitoring of network interface metrics including bytes/packets transferred, errors, drops, and collisions
• Deep Packet Inspection (DPI): Detect application protocols including HTTP, HTTPS/TLS with SNI, DNS, SSH with version detection, and QUIC with CONNECTION_CLOSE frame detection
• TCP Network Analytics: Real-time detection of TCP retransmissions, out-of-order packets, and fast retransmits with per-connection and aggregate statistics
• Smart Connection Lifecycle: Protocol-aware timeouts with visual staleness indicators (white → yellow → red) before cleanup
• Process Identification: Associate network connections with running processes
• Service Name Resolution: Identify well-known services using port numbers
• Cross-platform Support: Works on Linux, macOS, Windows, and FreeBSD
• Advanced Filtering: Real-time vim/fzf-style filtering with keyword support (port:, src:, dst:, sni:, process:, state:)
• Terminal User Interface: Beautiful TUI built with ratatui with adjustable column widths
• Multi-threaded Processing: Concurrent packet processing for high performance
• Optional Logging: Detailed logging with configurable log levels (disabled by default)
• Security Sandboxing: Landlock-based filesystem/network restrictions on Linux 5.13+ (see SECURITY.md)

eBPF Enhanced Process Identification (Linux Default)

RustNet uses kernel eBPF programs by default on Linux for enhanced performance and lower overhead process identification. However, this comes with important limitations:

Process Name Limitations:

• eBPF uses the kernel's comm field, which is limited to 16 characters
• Shows the task/thread command name, not the full executable path
• Multi-threaded applications often show thread names instead of the main process name

Real-world Examples:

• Firefox: May appear as "Socket Thread", "Web Content", "Isolated Web Co", or "MainThread"
• Chrome: May appear as "ThreadPoolForeg", "Chrome_IOThread", "BrokerProcess", or "SandboxHelper"
• Electron apps: Often show as "electron", "node", or internal thread names
• System processes: Show truncated names like "systemd-resolve" → "systemd-resolve"

Fallback Behavior:

• When eBPF fails to load or lacks sufficient permissions, RustNet automatically falls back to standard procfs-based process identification
• Standard mode provides full process names but with higher CPU overhead
• eBPF is enabled by default; no special build flags needed

To disable eBPF and use procfs-only mode, build with:

cargo build --release --no-default-features

See ARCHITECTURE.md for technical information.

Interface Statistics Monitoring

RustNet provides real-time network interface statistics across all supported platforms:

• Overview Tab: Shows active interfaces with current rates, errors, and drops
• Interfaces Tab (press i): Detailed table with comprehensive metrics for all interfaces
• Cross-Platform: Linux (sysfs), macOS/FreeBSD (getifaddrs), Windows (GetIfTable2 API)
• Smart Filtering: Windows automatically excludes virtual/filter adapters

See USAGE.md for detailed documentation on interpreting interface statistics and platform-specific behavior.

Metrics Available:

• Total bytes and packets (RX/TX)
• Error counters (receive and transmit)
• Packet drops (queue overflows)
• Collisions (legacy, rarely used on modern networks)

Stats are collected every 2 seconds in a background thread with minimal performance impact.

Quick Start

Installation

Homebrew (macOS / Linux):

brew tap domcyrus/rustnet
brew install rustnet

Ubuntu (25.10+):

sudo add-apt-repository ppa:domcyrus/rustnet
sudo apt update && sudo apt install rustnet

Fedora (42+):

sudo dnf copr enable domcyrus/rustnet
sudo dnf install rustnet

Arch Linux (AUR):

yay -S rustnet

From crates.io:

cargo install rustnet-monitor

Other platforms:

• Windows/FreeBSD: Download installers from GitHub Releases (https://github.com/domcyrus/rustnet/releases)
• Docker, source builds, other Linux distros: See INSTALL.md for detailed instructions

Running RustNet

Packet capture requires elevated privileges:

# Quick start (all platforms)
sudo rustnet

# Linux: Grant capabilities to run without sudo (recommended)
sudo setcap 'cap_net_raw,cap_bpf,cap_perfmon=eip' $(which rustnet)
rustnet

Common options:

rustnet -i eth0              # Specify network interface
rustnet --show-localhost     # Show localhost connections
rustnet -r 500               # Set refresh interval (ms)

See INSTALL.md for detailed permission setup and USAGE.md for complete options.

Keyboard Controls

See USAGE.md for detailed keyboard controls and navigation tips.