$ show domcyrus/rustnet
RustNet is a cross-platform, real-time network monitoring terminal UI application. It captures packets via libpcap (or platform-specific backends like PKTAP on macOS, ETW on Windows), performs deep packet inspection (DPI) for protocols including HTTP, HTTPS, DNS, SSH, QUIC, BitTorrent, and many others, and attributes each connection to the owning OS process using eBPF (Linux), lsof (macOS), IP Helper (Windows), or sockstat (FreeBSD). The architecture is a multi-crate Rust workspace: `rustnet-core` provides connection tracking, DPI analyzers, GeoIP/OUI lookup, and rate/RTT tracking; `rustnet-capture` wraps libpcap; `rustnet-host` implements process lookup via a unified `ProcessLookup` trait; `rustnet-sandbox` handles privilege dropping and sandboxing (Landlock, Seatbelt, Windows job objects). The main binary (`rustnet-monitor`) orchestrates capture, enrichment, and a ratatui-based TUI with tabs for Overview, Details, Activity, Graph, and Host. It supports PCAP/PCAPNG export with process metadata, JSONL event logging, Kubernetes pod attribution, and a rich theme system with multiple presets. The codebase is well-structured, extensively tested, and actively maintained with CI/CD for multiple platforms and packaging (DEB, RPM, DMG, MSI, Homebrew, Chocolatey).
The LLM identified 4 files worth highlighting for reuse:
The `ConnectionTracker` is the central data structure for managing network connections. It ingests parsed packets, creates/updates connections with protocol-specific state machines (TCP, UDP, QUIC), handles timeouts and cleanup, and provides snapshot access for the UI and export. It is isolated in the `rustnet-core` crate with no dependency on the TUI or platform-specific code, making it reusable for headless monitoring tools, Prometheus exporters, or other network analysis applications.
The `ProcessLookup` trait defines a clean interface for OS-specific process attribution. Implementations exist for Linux (eBPF + procfs), macOS (PKTAP + libproc), Windows (ETW + IP Helper), and FreeBSD (sockstat). This abstraction allows the core monitoring pipeline to remain platform-agnostic, and new backends can be added without modifying the rest of the codebase. The trait is minimal and well-documented, suitable for extraction into a standalone crate.
The `apply_sandbox` function provides a unified API for dropping privileges and applying OS-specific sandboxing after capture initialization. It supports Linux Landlock (with fallback to capabilities), macOS Seatbelt, Windows restricted tokens + job objects, and FreeBSD uid drop. The implementation is self-contained in its own crate with no dependencies on other workspace crates, making it reusable for any application that needs to drop privileges after an initial privileged phase.
The theme module implements a flexible, token-based color system with multiple presets (Muted, Vivid, Catppuccin, Tokyo Night, Gruvbox, Nord), HSL gradient ramps for wave animations, WCAG contrast validation for user overrides, and automatic light-background detection. It respects the NO_COLOR environment variable and provides a builder pattern for theme resolution. This component is decoupled from the rest of the UI and could be reused in any ratatui application needing a sophisticated theme engine.