rustnet
A cross-platform terminal UI network monitor providing real-time connection tracking, deep packet inspection, and process attribution.
What is rustnet?
RustNet is a real-time network monitoring tool built with Rust that provides a terminal user interface for tracking active connections, analyzing traffic, and identifying associated processes. It bridges the gap between simple connection utilities like netstat and complex packet analyzers like Wireshark by offering a connection-centric view with application context, making it ideal for quick diagnostics over SSH.
System administrators, DevOps engineers, and developers who need to monitor network activity on servers or workstations, especially over SSH sessions where a graphical interface is unavailable. It is also suitable for security professionals performing initial network diagnostics.
Developers choose RustNet because it uniquely combines real-time packet inspection with process attribution, showing which applications own each network connection—a feature missing from packet-only tools like Wireshark. Its terminal-native interface, cross-platform support, and advanced filtering with vim/fzf-style syntax provide immediate visibility with minimal overhead.
Overview
Per-process network monitoring for your terminal with deep packet inspection. Cross-platform, sandboxed.
Use Cases
Best For
- Quickly diagnosing network issues on remote servers via SSH without needing X11 forwarding or a GUI.
- Identifying which specific processes or applications are making network connections in real-time.
- Monitoring active TCP, UDP, ICMP, and ARP connections with detailed state information and protocol detection (HTTP, DNS, SSH, QUIC).
- Analyzing network interface statistics and bandwidth usage across Linux, macOS, Windows, and FreeBSD from a terminal.
- Filtering and sorting network connections by port, IP, process, state, or SNI hostname using advanced, keyboard-friendly filters.
- Performing initial security audits to detect unexpected connections or suspicious network activity with process context.
Not Ideal For
- Deep packet analysis or forensic investigations requiring full protocol dissection and detailed packet inspection
- Simple, one-off connection checks where lightweight command-line tools like netstat or ss are sufficient
- Environments where graphical user interfaces are preferred for network monitoring and visualization
Pros & Cons
Pros
Uses eBPF on Linux for low-overhead process identification, bridging the gap between packet analyzers and connection tools by showing which applications own each socket, as detailed in the eBPF limitations section.
Offers vim/fzf-style real-time filtering with keyword syntax (e.g., port:, process:, state:), allowing precise querying of connections without leaving the terminal, as demonstrated in the filtering examples.
Provides a uniform terminal interface across Linux, macOS, Windows, and FreeBSD, with adapted packet capture and interface statistics for each platform, making it SSH-friendly for remote diagnostics.
Detects application protocols like HTTP, DNS, SSH, and QUIC through deep packet inspection, and implements smart timeouts with visual staleness indicators for connection lifecycle management.
Cons
Default eBPF-based process identification uses the kernel's 16-character comm field, often showing thread names or truncated process names (e.g., 'Isolated Web Co' for Firefox), reducing clarity for multi-threaded applications.
Packet capture necessitates sudo or granted capabilities (cap_net_raw, cap_bpf), which can be a barrier in locked-down environments or for users without administrative access, as noted in the installation instructions.
On Windows, installation requires Npcap with 'WinPcap API-compatible Mode' enabled, adding extra steps and potential compatibility issues compared to native Linux tools.
Frequently Asked Questions
Related Projects
rustscan🤖 The Modern Port Scanner 🤖
sshuttleTransparent proxy server that works as a poor man's VPN. Forwards over ssh. Doesn't require admin. Works with Linux and MacOS. Supports DNS tunneling.
feroxbusterA fast, simple, recursive content discovery tool written in Rust.
rayhunterRust tool to detect cell site simulators on an orbic mobile hotspot
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.