RustNet

RustNet bridges the gap between basic connection utilities (like netstat or ss) and heavy-duty packet analyzers (like Wireshark or tcpdump). Built entirely in Rust, it provides a beautiful, resource-efficient Terminal UI that monitors network connections, tracks connection states, and inspects packets in real time.

Because it operates directly in the terminal, RustNet is extremely SSH-friendly. It allows system administrators, developers, and network engineers to diagnose remote servers instantly without needing to forward X11 or capture traffic for offline analysis.

One of its standout features is process attribution (powered by eBPF on Linux). While traditional packet sniffers only see network sockets, RustNet shows you exactly which application or process is responsible for the network activity, alongside bandwidth usage, connection lifecycle states, and application-layer protocols.

Key Features:

• Process Identification: Associates active network connections with their underlying running processes so you know exactly what is generating traffic.
• Deep Packet Inspection (DPI): Detects application protocols including HTTP, HTTPS/TLS (with SNI), DNS, SSH, QUIC, NTP, and more.
• Real-Time Network Analytics: Monitors TCP, UDP, ICMP, and ARP connections while tracking specific connection states (e.g., ESTABLISHED, TIME_WAIT, QUIC_HANDSHAKE).
• Live Interface Statistics: View real-time metrics on bytes/packets transferred, errors, drops, and collisions across network interfaces.
• Advanced Filtering: Navigate traffic quickly with vim/fzf-style keyword filtering (filter by port:, src:, sni:, process:, or state:).
• Smart Connection Lifecycle: Features protocol-aware timeouts and visual staleness indicators (color-coded) before a connection is cleaned up.
• GeoIP & DNS Lookups: Automatically resolves remote IP addresses to hostnames and displays country codes using GeoLite2 databases.
• Cross-Platform Support: Works seamlessly across Linux, macOS, Windows, and FreeBSD.
• Lightweight & Secure: Built in Rust for memory safety and high performance, utilizing multi-threaded concurrent packet processing and Security Sandboxing (Landlock) on supported Linux kernels.