rustnet

RustNet is a cross-platform terminal application that delivers live visibility into network connections with process-level attribution and deep packet inspection (DPI). Unlike traditional tools such as netstat, ss, or tcpdump, RustNet links every connection to its owning process and executable, making it easier to identify what traffic a specific application is generating. The tool supports TCP, UDP, and QUIC protocols across Linux, macOS, Windows, and FreeBSD. It uses platform-specific capture backends: eBPF with libbpf-rs on Linux, PKTAP on macOS, ETW with IP Helper fallback on Windows, and native APIs on FreeBSD. Process attribution includes PID, executable name, user and group names, match confidence, and a capped parent-process chain. Deep packet inspection identifies common protocols such as HTTP, HTTPS/TLS with SNI, DNS, SSH, FTP, QUIC, MQTT, BitTorrent, WireGuard, OpenVPN, STUN, NTP, mDNS, LLMNR, DHCP, SNMP, SSDP, and NetBIOS without external dissectors. The tool also performs passive DNS analytics, offering response codes, timeouts, latency percentiles, and health badges. Security is addressed through sandboxing. On Linux, RustNet can use Landlock (kernel 5.13+); on macOS, Seatbelt; and on Windows, token privilege dropping and job-object child-process blocking. The application drops privileges after initialization, and failed UID/GID drops stop startup before packet-processing workers run. For integration with other tools, RustNet can export annotated PCAPNG files that include per-packet comments with process, PID, direction, DPI/SNI, and GeoIP data, ready for immediate use in Wireshark. A classic PCAP export with a JSONL sidecar is also available for offline correlation. Additionally, optional Kubernetes attribution maps connections to pods, namespaces, and containers when the kubernetes feature is enabled. The terminal UI is built with ratatui and provides real-time views of connections, traffic rates, and protocol breakdowns. Users can filter by port, source/destination addresses, process name, state, SNI, and protocol, with support for regex patterns. Sorting and grouping options allow users to focus on bandwidth hogs or specific processes. Visual indicators show connection lifecycle states, with idle connections fading and displaying countdown timers before archival. Installation is available via Homebrew, APT, DNF, Zypper, pacman, Nix, Chocolatey, Scoop, and source builds. The tool requires elevated privileges for packet capture, but Linux capabilities can be set to run without sudo. Documentation covers detailed setup, usage, architecture, security, and contributing guidelines.