A cross-platform terminal UI network monitor providing real-time connection tracking, deep packet inspection, and process attribution.
RustNet is a real-time network monitoring tool built with Rust that provides a terminal user interface for tracking active connections, analyzing traffic, and identifying associated processes. It bridges the gap between simple connection utilities like netstat and complex packet analyzers like Wireshark by offering a connection-centric view with application context, making it ideal for quick diagnostics over SSH.
System administrators, DevOps engineers, and developers who need to monitor network activity on servers or workstations, especially over SSH sessions where a graphical interface is unavailable. It is also suitable for security professionals performing initial network diagnostics.
Developers choose RustNet because it uniquely combines real-time packet inspection with process attribution, showing which applications own each network connection—a feature missing from packet-only tools like Wireshark. Its terminal-native interface, cross-platform support, and advanced filtering with vim/fzf-style syntax provide immediate visibility with minimal overhead.
A cross-platform network monitoring terminal UI tool built with Rust.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses eBPF on Linux for low-overhead process identification, bridging the gap between packet analyzers and connection tools by showing which applications own each socket, as detailed in the eBPF limitations section.
Offers vim/fzf-style real-time filtering with keyword syntax (e.g., port:, process:, state:), allowing precise querying of connections without leaving the terminal, as demonstrated in the filtering examples.
Provides a uniform terminal interface across Linux, macOS, Windows, and FreeBSD, with adapted packet capture and interface statistics for each platform, making it SSH-friendly for remote diagnostics.
Detects application protocols like HTTP, DNS, SSH, and QUIC through deep packet inspection, and implements smart timeouts with visual staleness indicators for connection lifecycle management.
Default eBPF-based process identification uses the kernel's 16-character comm field, often showing thread names or truncated process names (e.g., 'Isolated Web Co' for Firefox), reducing clarity for multi-threaded applications.
Packet capture necessitates sudo or granted capabilities (cap_net_raw, cap_bpf), which can be a barrier in locked-down environments or for users without administrative access, as noted in the installation instructions.
On Windows, installation requires Npcap with 'WinPcap API-compatible Mode' enabled, adding extra steps and potential compatibility issues compared to native Linux tools.