rustnet

<h1 align="center">
  <picture>
    <source media="(prefers-color-scheme: dark)" srcset="./assets/rustnet-heading-dark.svg">
    <img src="https://raw.githubusercontent.com/domcyrus/rustnet/main/assets/rustnet-heading.svg" alt="RustNet" width="192" height="48">
  </picture>
</h1>

<p align="center">
  <a href="https://ratatui.rs/"><img src="https://ratatui.rs/built-with-ratatui/badge.svg" alt="Built with Ratatui"></a>
  <a href="https://github.com/domcyrus/rustnet/actions"><img src="https://github.com/domcyrus/rustnet/workflows/Rust/badge.svg" alt="Build status"></a>
  <a href="https://crates.io/crates/rustnet-monitor"><img src="https://img.shields.io/crates/v/rustnet-monitor.svg" alt="Crates.io version"></a>
  <a href="https://github.com/domcyrus/rustnet/releases"><img src="https://img.shields.io/github/v/release/domcyrus/rustnet.svg" alt="Latest release"></a>
  <a href="https://repology.org/project/rustnet/versions"><img src="https://repology.org/badge/tiny-repos/rustnet.svg" alt="Packaging status"></a>
  <a href="https://github.com/domcyrus/rustnet/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-blue.svg" alt="Apache 2.0 license"></a>
</p>

<p align="center"><strong>English</strong> | <a href="https://github.com/domcyrus/rustnet/blob/main/README.zh-CN.md">简体中文</a> | <a href="https://github.com/domcyrus/rustnet/blob/main/README.ja.md">日本語</a></p>

RustNet is a terminal network monitor that shows live TCP, UDP, and QUIC connections with process attribution when available. It runs on Linux, macOS, Windows, and FreeBSD.

## Install

On macOS or Linux with Homebrew:

```bash
brew install rustnet
```

Packet capture needs platform-specific permissions. See the [installation guide](https://github.com/domcyrus/rustnet/blob/main/INSTALL.md) for Linux capabilities, macOS PKTAP and BPF access, other package managers, and troubleshooting.

> **Release status:** The highlights, GIF, and screenshots show v1.7.0. The recordings use generated traffic in an isolated Linux environment. The guides linked from `main` may also describe [unreleased changes](https://github.com/domcyrus/rustnet/blob/main/CHANGELOG.md#unreleased). For the installed release, use the [v1.7.0 documentation](https://github.com/domcyrus/rustnet/blob/v1.7.0/README.md) and check `rustnet --version` and `rustnet --help`.

## Demo

<p align="center">
  <img src="https://assets.kitploit.com/production/public/readmes/8708/dac7699b8fd47411c7d169863fa87a61fd950657e6461a709fa3ecb79819c58c.gif" alt="RustNet demo" width="800">
</p>

## Highlights

- Shows connection state, traffic, application protocol, and available process information in a terminal UI that works over SSH.
- Identifies protocols such as HTTP, TLS/SNI, DNS, SSH, and QUIC through packet inspection.
- Filters connections by process, address, port, protocol, and more.
- Streams versioned JSON snapshots in headless mode for scripts and monitoring.
- Shows host sockets, passive DNS analytics, and connection health.
- Exports captures as PCAP or PCAPNG with best-effort annotations for analysis in Wireshark.
- Reduces privileges after startup and uses platform sandboxing where supported.

See the [usage guide](https://github.com/domcyrus/rustnet/blob/main/USAGE.md), [architecture guide](https://github.com/domcyrus/rustnet/blob/main/ARCHITECTURE.md), and [security guide](https://github.com/domcyrus/rustnet/blob/main/SECURITY.md) for feature details.

Since v1.7.0, RustNet requires trusted directories for Unix output files and creates diagnostic logs exclusively.

v1.7.0 fixes ARM DEB compatibility with older glibc and Debian 13's time64 libraries. See the [installation guide](https://github.com/domcyrus/rustnet/blob/main/INSTALL.md#debianubuntu-deb-packages) for supported distributions; v1.6.0 assets do not include these fixes.

## Screenshots

<table>
  <tr>
    <td align="center"><strong>Overview</strong><br>Live connections and traffic<br><img src="https://assets.kitploit.com/production/public/readmes/8708/63baee5bc338fc0f508708b2408a53360f2ea2602f67b32e892944fe944d133e.png" width="400" alt="RustNet Overview"></td>
    <td align="center"><strong>Details</strong><br>Process, protocol, and peer information<br><img src="https://assets.kitploit.com/production/public/readmes/8708/ae2bf2333c88d399fefab7aaab14b19a6d27b93223202c53a616febc0935521f.png" width="400" alt="RustNet Details"></td>
  </tr>
  <tr>
    <td align="center"><strong>Graph</strong><br>Traffic and application charts<br><img src="https://assets.kitploit.com/production/public/readmes/8708/5275305abc449ccacbeb5628f9ee7312bfa70539c35681f5d689041b501b14bd.png" width="400" alt="RustNet Graph"></td>
    <td align="center"><strong>Activity</strong><br>Traffic by process<br><img src="https://raw.githubusercontent.com/domcyrus/rustnet/main/assets/screenshots/activity.png" width="400" alt="RustNet Activity"></td>
  </tr>
  <tr>
    <td align="center"><strong>Host sockets</strong><br>Listening and bound endpoints<br><img src="https://raw.githubusercontent.com/domcyrus/rustnet/main/assets/screenshots/host.png" width="400" alt="RustNet Host sockets"></td>
    <td align="center"><strong>DNS</strong><br>Passive DNS queries and responses<br><img src="https://raw.githubusercontent.com/domcyrus/rustnet/main/assets/screenshots/dns.png" width="400" alt="RustNet DNS"></td>
  </tr>
</table>

## Other installation methods

| Platform | Command |
| --- | --- |
| Ubuntu 22.04+ / Linux Mint 21+ | `sudo add-apt-repository ppa:domcyrus/rustnet`<br>`sudo apt update && sudo apt install rustnet` |
| Fedora 42+ | `sudo dnf copr enable domcyrus/rustnet`<br>`sudo dnf install rustnet` |
| Arch Linux | `sudo pacman -S rustnet` |
| Alpine Linux (edge/community) | `apk add rustnet` |
| Windows | `choco install rustnet` or `scoop install rustnet` |
| Cargo | `cargo install rustnet-monitor` |
| Nix / NixOS | `nix-shell -p rustnet` |

Windows also requires [Npcap](https://npcap.com). v1.7.0 supports its default settings; v1.6.0 requires "WinPcap API compatible mode". For openSUSE, Pop!_OS, FreeBSD, Docker, and source builds, see the [installation guide](https://github.com/domcyrus/rustnet/blob/main/INSTALL.md).

## Run

On Linux, after configuring capabilities:

```bash
rustnet
```

On macOS, PKTAP requires `sudo`. With BPF access configured, RustNet can run without it but uses `lsof` for process detection.

Press `/` to filter connections, `Enter` to inspect one, and `q` to quit. See the [usage guide](https://github.com/domcyrus/rustnet/blob/main/USAGE.md) for interface selection, options, controls, filters, and exports.

## Documentation

- [QUIC inspection](https://github.com/domcyrus/rustnet/blob/main/QUIC.md): handshake storage and library compatibility (available since v1.7.0).
- [Installation](https://github.com/domcyrus/rustnet/blob/main/INSTALL.md): platforms, permissions, and troubleshooting
- [Usage](https://github.com/domcyrus/rustnet/blob/main/USAGE.md): controls, filtering, automation, and capture exports
- [Security](https://github.com/domcyrus/rustnet/blob/main/SECURITY.md): sandboxing and privilege management
- [Architecture](https://github.com/domcyrus/rustnet/blob/main/ARCHITECTURE.md): platform backends and performance
- [Kubernetes and containers](https://github.com/domcyrus/rustnet/blob/main/KUBERNETES.md): attribution and capture exports
- [Changelog](https://github.com/domcyrus/rustnet/blob/main/CHANGELOG.md): releases and upcoming changes
- [Contributing](https://github.com/domcyrus/rustnet/blob/main/CONTRIBUTING.md): how to contribute

The `rustnet` binary is the supported product. Workspace crate APIs are internal and may change without compatibility shims.

RustNet uses [ratatui](https://github.com/ratatui-org/ratatui) for its terminal UI and [libpcap](https://www.tcpdump.org/)/[Npcap](https://npcap.com/) for packet capture. See [CONTRIBUTORS.md](https://github.com/domcyrus/rustnet/blob/main/CONTRIBUTORS.md) for project contributors.

Licensed under [Apache License 2.0](https://github.com/domcyrus/rustnet/blob/main/LICENSE).