Hi HN! I built RustNet, a Terminal UI based network monitor written in Rust that shows real-time connections with process identification and protocol detection.
What may make it interesting:
• Deep packet inspection for HTTP, HTTPS/TLS (with SNI), DNS, and QUIC protocol detection
• Process identification using eBPF on Linux (experimental) and PKTAP on macOS which does also catch short-lived processes that polling procfs or lsof would miss
• Multi-threaded packet processing with lock-free data structures for the UI
• Cross-platform (Linux, macOS, Windows but process identification so far only on Linux/macOS)
The eBPF implementation was a bit more tricky to implement than using PKTAP, but it was very interesting to learn about how to hook into tcp_connect, udp_sendmsg, etc. in order to catch process info before connections disappear.
I built this as a lightweight Wireshark alternative for quick TUI based network inspection with process identification.
Install: cargo build --release, run with sudo or set capabilities. Homebrew tap also available.
Would love feedback on the project and any ideas for additional protocol detection or any other suggestions. Thanks
What may make it interesting:
• Deep packet inspection for HTTP, HTTPS/TLS (with SNI), DNS, and QUIC protocol detection
• Process identification using eBPF on Linux (experimental) and PKTAP on macOS which does also catch short-lived processes that polling procfs or lsof would miss
• Multi-threaded packet processing with lock-free data structures for the UI
• Cross-platform (Linux, macOS, Windows but process identification so far only on Linux/macOS)
The eBPF implementation was a bit more tricky to implement than using PKTAP, but it was very interesting to learn about how to hook into tcp_connect, udp_sendmsg, etc. in order to catch process info before connections disappear.
I built this as a lightweight Wireshark alternative for quick TUI based network inspection with process identification.
Install: cargo build --release, run with sudo or set capabilities. Homebrew tap also available.
Would love feedback on the project and any ideas for additional protocol detection or any other suggestions. Thanks