---
name: "rustnet"
section: "1"
platform: "linux"
package: "rustnet"
version: "1.7.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/rustnet"
---

# rustnet(1)

Cross-platform network monitoring tool

## NAME

rustnet - Cross-platform network monitoring tool

## SYNOPSIS

**rustnet** \[**-i**\|**--interface**\] \[**--no-localhost**\] \[**--show-localhost**\] \[**--headless**\] \[**--duration**\] \[**--output**\] \[**--filter**\] \[**-r**\|**--refresh-interval**\] \[**--no-dpi**\] \[**-l**\|**--log-level**\] \[**--json-log**\] \[**--pcap-export**\] \[**--pcapng-export**\] \[**-f**\|**--bpf-filter**\] \[**--no-resolve-dns**\] \[**--show-ptr-lookups**\] \[**--no-color**\] \[**--theme**\] \[**--geoip-country**\] \[**--geoip-asn**\] \[**--geoip-city**\] \[**--no-geoip**\] \[**--kubernetes**\] \[**--no-sandbox**\] \[**--sandbox-strict**\] \[**--no-uid-drop**\] \[**-h**\|**--help**\] \[**-V**\|**--version**\]

## DESCRIPTION

Cross-platform network monitoring tool

## OPTIONS

- **-i**, **--interface** *\<INTERFACE\>*

  Network interface to monitor (use "any" to capture all interfaces)

- **--no-localhost**

  Filter out localhost connections

- **--show-localhost**

  Show localhost connections (overrides default filtering)

- **--headless**

  Run without the interactive terminal UI

- **--duration** *\<SECONDS\>*

  Stop headless monitoring after this many seconds

- **--output** *\<FORMAT\>*

  Headless output format: jsonl (stream snapshots) or json (final snapshot)\

  *Possible values:*

  - •

    jsonl

  - •

    json

- **--filter** *\<QUERY\>*

  Filter headless output using the shared connection filter syntax

- **-r**, **--refresh-interval** *\<MILLISECONDS\>* \[default: 500\]

  Snapshot and UI refresh interval in milliseconds

- **--no-dpi**

  Disable deep packet inspection

- **-l**, **--log-level** *\<LEVEL\>*

  Set the log level (if not provided, no logging will be enabled)

- **--json-log** *\<FILE\>*

  Enable JSON logging of connection events to specified file

- **--pcap-export** *\<FILE\>*

  Export captured packets to PCAP file for Wireshark analysis

- **--pcapng-export** *\<FILE\>*

  Export captured packets to annotated PCAPNG file for Wireshark analysis

- **-f**, **--bpf-filter** *\<FILTER\>*

  BPF filter expression for packet capture (e.g., "tcp port 443", "dst port 80")

- **--no-resolve-dns**

  Disable reverse DNS resolution for IP addresses (enabled by default; shows hostnames instead of IPs)

- **--show-ptr-lookups**

  Show PTR lookup connections in UI (hidden by default when DNS resolution is enabled)

- **--no-color**

  Disable all colors in the UI (also respects NO\_COLOR env var)

- **--theme** *\<PRESET\>*

  Color theme: muted (default), vivid, catppuccin-mocha, tokyo-night, gruvbox, nord. Overrides the theme set in the config file (~/.config/rustnet/config.toml)\

  *Possible values:*

  - •

    muted

  - •

    vivid

  - •

    catppuccin-mocha

  - •

    tokyo-night

  - •

    gruvbox

  - •

    nord

- **--geoip-country** *\<PATH\>*

  Path to GeoLite2-Country.mmdb database. Auto-discovered from: ./resources/geoip2, $XDG\_DATA\_HOME/rustnet/geoip, ~/.local/share/rustnet/geoip, /usr/share/GeoIP, /usr/local/share/GeoIP, /opt/homebrew/share/GeoIP, /var/lib/GeoIP

- **--geoip-asn** *\<PATH\>*

  Path to GeoLite2-ASN.mmdb database (same search paths as --geoip-country)

- **--geoip-city** *\<PATH\>*

  Path to GeoLite2-City.mmdb database (same search paths as --geoip-country; superset of Country: provides city name and postal code in addition to country)

- **--no-geoip**

  Disable GeoIP lookups entirely

- **--kubernetes** *\<MODE\>* \[default: auto\]

  Kubernetes pod/container attribution: "auto" (enable only when running inside a pod), "on" (always), or "off"\

  *Possible values:*

  - •

    auto

  - •

    on

  - •

    off

- **--no-sandbox**

  Disable sandboxing (on Linux, PR\_SET\_NO\_NEW\_PRIVS is still set)

- **--sandbox-strict**

  Require full sandbox enforcement or exit

- **--no-uid-drop**

  Keep running as root instead of dropping to SUDO\_UID/SUDO\_GID (or nobody) after initialization. Keeping root lets the procfs fallback attribute other users' processes when eBPF is unavailable

- **-h**, **--help**

  Print help

- **-V**, **--version**

  Print version

## VERSION

v1.7.0

## AUTHORS

Network Monitor