Rustnet — Per-Process Network Monitoring for the Terminal

Introduction

Rustnet is a terminal-based network monitoring tool that shows bandwidth usage broken down by individual process and connection. Unlike traditional tools like nethogs or iftop, Rustnet provides deep packet inspection, GeoIP lookups, and a polished ratatui-based TUI, all in a single Rust binary.

What Rustnet Does

• Displays real-time per-process network bandwidth consumption
• Performs deep packet inspection to identify application-layer protocols
• Shows connection-level detail with remote IP, port, and GeoIP location
• Supports sandboxing via Landlock (Linux) and Seatbelt (macOS) for safe operation
• Works on Linux, macOS, Windows, FreeBSD, and Android

Architecture Overview

Rustnet captures network packets using platform-specific mechanisms (eBPF on Linux, libpcap elsewhere) and correlates them with running processes through the OS process table. The DPI engine classifies traffic by protocol. All data flows into a ratatui-based TUI that renders live-updating tables and graphs in the terminal.

Self-Hosting & Configuration

• Install via cargo or download prebuilt binaries for your platform
• Requires root/sudo for packet capture on most platforms
• Configure display preferences via command-line flags or a TOML config file
• Adjust DPI sensitivity and filter rules for specific protocols
• Supports exporting connection data for integration with other tools

Key Features

• Deep packet inspection identifies protocols beyond simple port matching
• GeoIP integration shows geographic location of remote endpoints
• Sandboxed execution limits filesystem and network access of the tool itself
• Cross-platform support across five operating systems including Android
• Minimal resource usage with efficient Rust implementation

Comparison with Similar Tools

• nethogs — classic per-process bandwidth tool; Rustnet adds DPI and richer TUI
• bandwhich — Rust-based bandwidth monitor; Rustnet adds packet inspection and GeoIP
• iftop — interface-level traffic viewer; no per-process breakdown
• bmon — bandwidth monitor with graphs; lacks process correlation
• Wireshark — full packet analyzer GUI; Rustnet is lighter and terminal-native

FAQ

Q: Why does Rustnet need root access? A: Packet capture requires elevated privileges on most operating systems to read raw network frames.

Q: Does it work inside containers? A: Yes, with appropriate network namespace access and capabilities (CAP_NET_RAW, CAP_NET_ADMIN).

Q: What is the sandboxing feature? A: On Linux, Rustnet uses Landlock to restrict its own filesystem access. On macOS, it uses Seatbelt. This limits what the tool can do beyond monitoring.

Q: Can I filter traffic by specific processes? A: Yes. You can filter by process name or PID via command-line flags.

Sources

• https://github.com/domcyrus/rustnet
• https://crates.io/crates/rustnet