# domcyrus/rustnet

Per-process network monitoring for your terminal with deep packet inspection. Cross-platform, sandboxed.

Repository: https://github.com/domcyrus/rustnet
Canonical: https://ross.abutalabs.com/products/rustnet
Homepage: https://github.com/domcyrus/rustnet#quick-start
Language: Rust
License: Apache-2.0
License Family: permissive
Topics: ebpf, freebsd, geoip, landlock, linux, network-monitoring, packet-capture, rust, seatbelt, tui, windows, cli, dpi, macos, process-monitoring, ratatui, netstat-alternative
Last push: 2026-08-26T08:54:48+00:00

## Health v2 (maintenance only)
Score: 86/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 98, longevity 35
- inputs: {"age_days": 493, "days_push": 7, "days_rel": 13, "gap_med": 10.0, "n_releases_24m": 25}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 4946, forks 229 (observed 2026-08-28T04:09:03.577702+00:00)

## What it is
RustNet is a cross-platform terminal-based network monitoring tool that maps live TCP, UDP, and QUIC connections to their owning processes with deep packet inspection. It is sandboxed by default and supports annotated PCAPNG export for Wireshark.

## Use cases
- monitor per-process network connections in the terminal
- find which process is making a network connection
- inspect live TCP UDP and QUIC traffic with DPI
- export packet captures with process attribution to Wireshark
- replace netstat with a live network monitor
- identify protocols like TLS SNI DNS and QUIC on my machine

## When to choose
- you need per-process attribution for live connections that tcpdump or netstat can't provide
- you want a sandboxed, cross-platform terminal network monitor
- you want Wireshark-ready captures annotated with process and DPI metadata

## When to avoid
- you need a long-term centralized network monitoring or alerting service
- you need a GUI-based packet analyzer
- you run an OS or kernel version without eBPF/PKTAP/ETW support

## Facets
- artifact type: cli-tool
- maturity: active
- function: monitoring, networking, security
- domain: networking, security, developer-tools
- platform: windows, bsd, cli, cross-platform
- tags: ebpf, deep-packet-inspection, tui, ratatui, packet-capture, geoip, netstat-alternative, sandboxing, pcapng, command-line, linux, macos

## Member repositories
- domcyrus/rustnet (main) score 86

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:09:03.577702+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:17:53.427720+00:00, confidence not recorded.
  - readme: https://github.com/domcyrus/rustnet (fetched 2026-08-28T04:09:03.577702+00:00, sha d2ac069783e9)
  - homepage: https://github.com/domcyrus/rustnet#quick-start (fetched 2026-08-29T08:59:22.814169+00:00, sha a48820699cd9)
- Data as of 2026-08-30T08:39:29.467469+00:00.