NAME
rustnet - Cross-platform network monitoring tool
SYNOPSIS
rustnet [-i|--interface] [--no-localhost] [--show-localhost] [--headless] [--duration] [--output] [--filter] [-r|--refresh-interval] [--no-dpi] [-l|--log-level] [--json-log] [--pcap-export] [--pcapng-export] [-f|--bpf-filter] [--no-resolve-dns] [--show-ptr-lookups] [--no-color] [--theme] [--geoip-country] [--geoip-asn] [--geoip-city] [--no-geoip] [--kubernetes] [--no-sandbox] [--sandbox-strict] [--no-uid-drop] [-h|--help] [-V|--version]
DESCRIPTION
Cross-platform network monitoring tool
OPTIONS
- -i, --interface <INTERFACE>
-
Network interface to monitor (use "any" to capture all interfaces)
- --no-localhost
-
Filter out localhost connections
- --show-localhost
-
Show localhost connections (overrides default filtering)
- --headless
-
Run without the interactive terminal UI
- --duration <SECONDS>
-
Stop headless monitoring after this many seconds
- --output <FORMAT>
-
Headless output format: jsonl (stream snapshots) or json (final snapshot)
Possible values:
- •
-
jsonl
- •
-
json
- --filter <QUERY>
-
Filter headless output using the shared connection filter syntax
- -r, --refresh-interval <MILLISECONDS> [default: 500]
-
Snapshot and UI refresh interval in milliseconds
- --no-dpi
-
Disable deep packet inspection
- -l, --log-level <LEVEL>
-
Set the log level (if not provided, no logging will be enabled)
- --json-log <FILE>
-
Enable JSON logging of connection events to specified file
- --pcap-export <FILE>
-
Export captured packets to PCAP file for Wireshark analysis
- --pcapng-export <FILE>
-
Export captured packets to annotated PCAPNG file for Wireshark analysis
- -f, --bpf-filter <FILTER>
-
BPF filter expression for packet capture (e.g., "tcp port 443", "dst port 80")
- --no-resolve-dns
-
Disable reverse DNS resolution for IP addresses (enabled by default; shows hostnames instead of IPs)
- --show-ptr-lookups
-
Show PTR lookup connections in UI (hidden by default when DNS resolution is enabled)
- --no-color
-
Disable all colors in the UI (also respects NO_COLOR env var)
- --theme <PRESET>
-
Color theme: muted (default), vivid, catppuccin-mocha, tokyo-night, gruvbox, nord. Overrides the theme set in the config file (~/.config/rustnet/config.toml)
Possible values:
- •
-
muted
- •
-
vivid
- •
-
catppuccin-mocha
- •
-
tokyo-night
- •
-
gruvbox
- •
-
nord
- --geoip-country <PATH>
-
Path to GeoLite2-Country.mmdb database. Auto-discovered from: ./resources/geoip2, $XDG_DATA_HOME/rustnet/geoip, ~/.local/share/rustnet/geoip, /usr/share/GeoIP, /usr/local/share/GeoIP, /opt/homebrew/share/GeoIP, /var/lib/GeoIP
- --geoip-asn <PATH>
-
Path to GeoLite2-ASN.mmdb database (same search paths as --geoip-country)
- --geoip-city <PATH>
-
Path to GeoLite2-City.mmdb database (same search paths as --geoip-country; superset of Country: provides city name and postal code in addition to country)
- --no-geoip
-
Disable GeoIP lookups entirely
- --kubernetes <MODE> [default: auto]
-
Kubernetes pod/container attribution: "auto" (enable only when running inside a pod), "on" (always), or "off"
Possible values:
- •
-
auto
- •
-
on
- •
-
off
- --no-sandbox
-
Disable sandboxing (on Linux, PR_SET_NO_NEW_PRIVS is still set)
- --sandbox-strict
-
Require full sandbox enforcement or exit
- --no-uid-drop
-
Keep running as root instead of dropping to SUDO_UID/SUDO_GID (or nobody) after initialization. Keeping root lets the procfs fallback attribute other users' processes when eBPF is unavailable
- -h, --help
-
Print help
- -V, --version
-
Print version
VERSION
v1.7.0
AUTHORS
Network Monitor