rustnet(1) General Commands Manual rustnet(1)

rustnet - Cross-platform network monitoring tool

rustnet [-i|--interface] [--no-localhost] [--show-localhost] [-r|--refresh-interval] [--no-dpi] [-l|--log-level] [--json-log] [--pcap-export] [--pcapng-export] [-f|--bpf-filter] [--no-resolve-dns] [--show-ptr-lookups] [--no-color] [--theme] [--geoip-country] [--geoip-asn] [--geoip-city] [--no-geoip] [--kubernetes] [--no-sandbox] [--sandbox-strict] [--no-uid-drop] [-h|--help] [-V|--version]

Cross-platform network monitoring tool

Network interface to monitor (use "any" to capture all interfaces)
Filter out localhost connections
Show localhost connections (overrides default filtering)
UI refresh interval in milliseconds
Disable deep packet inspection
Set the log level (if not provided, no logging will be enabled)
Enable JSON logging of connection events to specified file
Export captured packets to PCAP file for Wireshark analysis
Export captured packets to annotated PCAPNG file for Wireshark analysis
BPF filter expression for packet capture (e.g., "tcp port 443", "dst port 80")
Disable reverse DNS resolution for IP addresses (enabled by default; shows hostnames instead of IPs)
Show PTR lookup connections in UI (hidden by default when DNS resolution is enabled)
Disable all colors in the UI (also respects NO_COLOR env var)
Color theme: muted (default), vivid, catppuccin-mocha, tokyo-night, gruvbox, nord. Overrides the theme set in the config file (~/.config/rustnet/config.toml)

Possible values:

  • muted
  • vivid
  • catppuccin-mocha
  • tokyo-night
  • gruvbox
  • nord
Path to GeoLite2-Country.mmdb database. Auto-discovered from: ./resources/geoip2, $XDG_DATA_HOME/rustnet/geoip, ~/.local/share/rustnet/geoip, /usr/share/GeoIP, /usr/local/share/GeoIP, /opt/homebrew/share/GeoIP, /var/lib/GeoIP
Path to GeoLite2-ASN.mmdb database (same search paths as --geoip-country)
Path to GeoLite2-City.mmdb database (same search paths as --geoip-country; superset of Country — provides city name and postal code in addition to country)
Disable GeoIP lookups entirely
Kubernetes pod/container attribution: "auto" (enable only when running inside a pod), "on" (always), or "off"

Possible values:

  • auto
  • on
  • off
Disable sandboxing (on Linux, PR_SET_NO_NEW_PRIVS is still set)
Require full sandbox enforcement or exit
Keep running as root instead of dropping to SUDO_UID/SUDO_GID (or nobody) after initialization. Keeping root lets the procfs fallback attribute other users' processes when eBPF is unavailable
Print help
Print version

v1.6.0

Network Monitor

rustnet 1.6.0