# Rustnet — Per-Process Network Monitoring for the Terminal

> Monitor network traffic per process with deep packet inspection in a beautiful terminal UI. Cross-platform and sandboxed, written in Rust.

## Install

Save in your project root:

# Rustnet — Per-Process Network Monitoring for the Terminal

## Quick Use
```bash
cargo install rustnet
sudo rustnet
# Or download a prebuilt binary from GitHub releases
```

## Introduction
Rustnet is a terminal-based network monitoring tool that shows bandwidth usage broken down by individual process and connection. Unlike traditional tools like nethogs or iftop, Rustnet provides deep packet inspection, GeoIP lookups, and a polished ratatui-based TUI, all in a single Rust binary.

## What Rustnet Does
- Displays real-time per-process network bandwidth consumption
- Performs deep packet inspection to identify application-layer protocols
- Shows connection-level detail with remote IP, port, and GeoIP location
- Supports sandboxing via Landlock (Linux) and Seatbelt (macOS) for safe operation
- Works on Linux, macOS, Windows, FreeBSD, and Android

## Architecture Overview
Rustnet captures network packets using platform-specific mechanisms (eBPF on Linux, libpcap elsewhere) and correlates them with running processes through the OS process table. The DPI engine classifies traffic by protocol. All data flows into a ratatui-based TUI that renders live-updating tables and graphs in the terminal.

## Self-Hosting & Configuration
- Install via cargo or download prebuilt binaries for your platform
- Requires root/sudo for packet capture on most platforms
- Configure display preferences via command-line flags or a TOML config file
- Adjust DPI sensitivity and filter rules for specific protocols
- Supports exporting connection data for integration with other tools

## Key Features
- Deep packet inspection identifies protocols beyond simple port matching
- GeoIP integration shows geographic location of remote endpoints
- Sandboxed execution limits filesystem and network access of the tool itself
- Cross-platform support across five operating systems including Android
- Minimal resource usage with efficient Rust implementation

## Comparison with Similar Tools
- **nethogs** — classic per-process bandwidth tool; Rustnet adds DPI and richer TUI
- **bandwhich** — Rust-based bandwidth monitor; Rustnet adds packet inspection and GeoIP
- **iftop** — interface-level traffic viewer; no per-process breakdown
- **bmon** — bandwidth monitor with graphs; lacks process correlation
- **Wireshark** — full packet analyzer GUI; Rustnet is lighter and terminal-native

## FAQ
**Q: Why does Rustnet need root access?**
A: Packet capture requires elevated privileges on most operating systems to read raw network frames.

**Q: Does it work inside containers?**
A: Yes, with appropriate network namespace access and capabilities (CAP_NET_RAW, CAP_NET_ADMIN).

**Q: What is the sandboxing feature?**
A: On Linux, Rustnet uses Landlock to restrict its own filesystem access. On macOS, it uses Seatbelt. This limits what the tool can do beyond monitoring.

**Q: Can I filter traffic by specific processes?**
A: Yes. You can filter by process name or PID via command-line flags.

## Sources
- https://github.com/domcyrus/rustnet
- https://crates.io/crates/rustnet

---
Source: https://tokrepo.com/en/workflows/asset-090ad075
Author: AI Open Source