rustnet1

Cross-platform network monitoring tool

Usage

rustnet [{-i | --interface}] [--no-localhost] [--show-localhost] [--headless] [--duration] [--output] [--filter] [{-r | --refresh-interval}] [--no-dpi] [{-l | --log-level}] [--json-log] [--pcap-export] [--pcapng-export] [{-f | --bpf-filter}] [--no-resolve-dns] [--show-ptr-lookups] [--no-color] [--theme] [--geoip-country] [--geoip-asn] [--geoip-city] [--no-geoip] [--kubernetes] [--no-sandbox] [--sandbox-strict] [--no-uid-drop] [{-h | --help}] [{-V | --version}]

Overview

Cross-platform network monitoring tool

Options

-i, --interface <INTERFACE>: Network interface to monitor (use "any" to capture all interfaces)

--no-localhost: Filter out localhost connections

--show-localhost: Show localhost connections (overrides default filtering)

--headless: Run without the interactive terminal UI

--duration <SECONDS>: Stop headless monitoring after this many seconds

--output <FORMAT>

Headless output format: jsonl (stream snapshots) or json (final snapshot)

Possible values:

•: jsonl

•: json

--filter <QUERY>: Filter headless output using the shared connection filter syntax

-r, --refresh-interval <MILLISECONDS> [default: 500]: Snapshot and UI refresh interval in milliseconds

--no-dpi: Disable deep packet inspection

-l, --log-level <LEVEL>: Set the log level (if not provided, no logging will be enabled)

--json-log <FILE>: Enable JSON logging of connection events to specified file

--pcap-export <FILE>: Export captured packets to PCAP file for Wireshark analysis

--pcapng-export <FILE>: Export captured packets to annotated PCAPNG file for Wireshark analysis

-f, --bpf-filter <FILTER>: BPF filter expression for packet capture (e.g., "tcp port 443", "dst port 80")

--no-resolve-dns: Disable reverse DNS resolution for IP addresses (enabled by default; shows hostnames instead of IPs)

--show-ptr-lookups: Show PTR lookup connections in UI (hidden by default when DNS resolution is enabled)

--no-color: Disable all colors in the UI (also respects NO_COLOR env var)

--theme <PRESET>

Color theme: muted (default), vivid, catppuccin-mocha, tokyo-night, gruvbox, nord. Overrides the theme set in the config file (~/.config/rustnet/config.toml)

Possible values:

•: muted

•: vivid

•: catppuccin-mocha

•: tokyo-night

•: gruvbox

•: nord

--geoip-country <PATH>: Path to GeoLite2-Country.mmdb database. Auto-discovered from: ./resources/geoip2, $XDG_DATA_HOME/rustnet/geoip, ~/.local/share/rustnet/geoip, /usr/share/GeoIP, /usr/local/share/GeoIP, /opt/homebrew/share/GeoIP, /var/lib/GeoIP

--geoip-asn <PATH>: Path to GeoLite2-ASN.mmdb database (same search paths as --geoip-country)

--geoip-city <PATH>: Path to GeoLite2-City.mmdb database (same search paths as --geoip-country; superset of Country: provides city name and postal code in addition to country)

--no-geoip: Disable GeoIP lookups entirely

--kubernetes <MODE> [default: auto]

Kubernetes pod/container attribution: "auto" (enable only when running inside a pod), "on" (always), or "off"

Possible values:

•: auto

•: on

•: off

--no-sandbox: Disable sandboxing (on Linux, PR_SET_NO_NEW_PRIVS is still set)

--sandbox-strict: Require full sandbox enforcement or exit

--no-uid-drop: Keep running as root instead of dropping to SUDO_UID/SUDO_GID (or nobody) after initialization. Keeping root lets the procfs fallback attribute other users' processes when eBPF is unavailable

-h, --help: Print help

-V, --version: Print version

Version

v1.7.0