What is RustNet?
RustNet is a terminal user interface (TUI) application that provides per-process network monitoring with deep packet inspection. It maps every TCP, UDP, and QUIC connection to its owning process, showing live connection state, protocol details, and traffic analytics — all from your terminal.
Unlike packet analyzers such as Wireshark or tcpdump, RustNet attributes each connection to the process that owns it. Unlike netstat or ss, it shows live connection state, bandwidth, and protocol identification in real time.
Key Capabilities
- Per-process attribution — PID, executable, user/group, and parent-process chain for every connection, using eBPF on Linux, PKTAP on macOS, ETW on Windows, and native APIs on FreeBSD.
- Deep packet inspection — Identifies HTTP, HTTPS/TLS with SNI, DNS, SSH, FTP, QUIC, MQTT, BitTorrent, WireGuard, OpenVPN, STUN, NTP, mDNS, LLMNR, DHCP, SNMP, SSDP, and NetBIOS without external dissectors.
- Annotated PCAPNG export — Writes Wireshark-ready captures with process, PID, direction, DPI/SNI, and GeoIP embedded as per-packet comments.
- Security sandboxing — Landlock on Linux, Seatbelt on macOS, and token privilege drop with job-object child-process blocking on Windows. Privileges are dropped immediately after libpcap initializes.
- Network analytics — Real-time RTT for TCP, QUIC handshakes, DNS responses, and ICMP echo, plus retransmission and out-of-order detection.
- Smart connection lifecycle — Protocol-aware timeouts, idle-row countdowns, and a toggle to keep historic connections visible for forensics.
- Vim/fzf-style filtering — Filter by
port:,src:,dst:,sni:,process:,state:,proto:, or regex patterns. - GeoIP enrichment — Country lookups via local MaxMind GeoLite2 with no network calls.
- LAN device identification — MAC address and vendor from the embedded IEEE OUI database for on-link peers and the gateway.
- Optional Kubernetes attribution — Maps connections to pod, namespace, and container, with dedicated filters and a
kubectl-rustnetplugin. - Cross-platform — Linux, macOS, Windows, and FreeBSD.
Why It Stands Out
RustNet fills the gap between simple connection tools and full packet analyzers. It is SSH-friendly, so you can inspect a remote server without X11 forwarding or root piping. It complements packet capture tools: use RustNet to see what is making connections, then export annotated PCAPNG for deeper Wireshark inspection.
Built on ratatui, libpcap, eBPF (libbpf-rs), DashMap, crossbeam, ring, MaxMind GeoLite2, and Landlock.