.ie \n(.g .ds Aq \(aq
.el .ds Aq '
.TH rustnet 1  "rustnet 1.6.0" 
.SH NAME
rustnet \- Cross\-platform network monitoring tool
.SH SYNOPSIS
\fBrustnet\fR [\fB\-i\fR|\fB\-\-interface\fR] [\fB\-\-no\-localhost\fR] [\fB\-\-show\-localhost\fR] [\fB\-r\fR|\fB\-\-refresh\-interval\fR] [\fB\-\-no\-dpi\fR] [\fB\-l\fR|\fB\-\-log\-level\fR] [\fB\-\-json\-log\fR] [\fB\-\-pcap\-export\fR] [\fB\-\-pcapng\-export\fR] [\fB\-f\fR|\fB\-\-bpf\-filter\fR] [\fB\-\-no\-resolve\-dns\fR] [\fB\-\-show\-ptr\-lookups\fR] [\fB\-\-no\-color\fR] [\fB\-\-theme\fR] [\fB\-\-geoip\-country\fR] [\fB\-\-geoip\-asn\fR] [\fB\-\-geoip\-city\fR] [\fB\-\-no\-geoip\fR] [\fB\-\-kubernetes\fR] [\fB\-\-no\-sandbox\fR] [\fB\-\-sandbox\-strict\fR] [\fB\-\-no\-uid\-drop\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fB\-V\fR|\fB\-\-version\fR] 
.SH DESCRIPTION
Cross\-platform network monitoring tool
.SH OPTIONS
.TP
\fB\-i\fR, \fB\-\-interface\fR \fI<INTERFACE>\fR
Network interface to monitor (use "any" to capture all interfaces)
.TP
\fB\-\-no\-localhost\fR
Filter out localhost connections
.TP
\fB\-\-show\-localhost\fR
Show localhost connections (overrides default filtering)
.TP
\fB\-r\fR, \fB\-\-refresh\-interval\fR \fI<MILLISECONDS>\fR [default: 500]
UI refresh interval in milliseconds
.TP
\fB\-\-no\-dpi\fR
Disable deep packet inspection
.TP
\fB\-l\fR, \fB\-\-log\-level\fR \fI<LEVEL>\fR
Set the log level (if not provided, no logging will be enabled)
.TP
\fB\-\-json\-log\fR \fI<FILE>\fR
Enable JSON logging of connection events to specified file
.TP
\fB\-\-pcap\-export\fR \fI<FILE>\fR
Export captured packets to PCAP file for Wireshark analysis
.TP
\fB\-\-pcapng\-export\fR \fI<FILE>\fR
Export captured packets to annotated PCAPNG file for Wireshark analysis
.TP
\fB\-f\fR, \fB\-\-bpf\-filter\fR \fI<FILTER>\fR
BPF filter expression for packet capture (e.g., "tcp port 443", "dst port 80")
.TP
\fB\-\-no\-resolve\-dns\fR
Disable reverse DNS resolution for IP addresses (enabled by default; shows hostnames instead of IPs)
.TP
\fB\-\-show\-ptr\-lookups\fR
Show PTR lookup connections in UI (hidden by default when DNS resolution is enabled)
.TP
\fB\-\-no\-color\fR
Disable all colors in the UI (also respects NO_COLOR env var)
.TP
\fB\-\-theme\fR \fI<PRESET>\fR
Color theme: muted (default), vivid, catppuccin\-mocha, tokyo\-night, gruvbox, nord. Overrides the theme set in the config file (~/.config/rustnet/config.toml)
.br

.br
\fIPossible values:\fR
.RS 14
.IP \(bu 2
muted
.IP \(bu 2
vivid
.IP \(bu 2
catppuccin\-mocha
.IP \(bu 2
tokyo\-night
.IP \(bu 2
gruvbox
.IP \(bu 2
nord
.RE
.TP
\fB\-\-geoip\-country\fR \fI<PATH>\fR
Path to GeoLite2\-Country.mmdb database. Auto\-discovered from: ./resources/geoip2, $XDG_DATA_HOME/rustnet/geoip, ~/.local/share/rustnet/geoip, /usr/share/GeoIP, /usr/local/share/GeoIP, /opt/homebrew/share/GeoIP, /var/lib/GeoIP
.TP
\fB\-\-geoip\-asn\fR \fI<PATH>\fR
Path to GeoLite2\-ASN.mmdb database (same search paths as \-\-geoip\-country)
.TP
\fB\-\-geoip\-city\fR \fI<PATH>\fR
Path to GeoLite2\-City.mmdb database (same search paths as \-\-geoip\-country; superset of Country — provides city name and postal code in addition to country)
.TP
\fB\-\-no\-geoip\fR
Disable GeoIP lookups entirely
.TP
\fB\-\-kubernetes\fR \fI<MODE>\fR [default: auto]
Kubernetes pod/container attribution: "auto" (enable only when running inside a pod), "on" (always), or "off"
.br

.br
\fIPossible values:\fR
.RS 14
.IP \(bu 2
auto
.IP \(bu 2
on
.IP \(bu 2
off
.RE
.TP
\fB\-\-no\-sandbox\fR
Disable sandboxing (on Linux, PR_SET_NO_NEW_PRIVS is still set)
.TP
\fB\-\-sandbox\-strict\fR
Require full sandbox enforcement or exit
.TP
\fB\-\-no\-uid\-drop\fR
Keep running as root instead of dropping to SUDO_UID/SUDO_GID (or nobody) after initialization. Keeping root lets the procfs fallback attribute other users\*(Aq processes when eBPF is unavailable
.TP
\fB\-h\fR, \fB\-\-help\fR
Print help
.TP
\fB\-V\fR, \fB\-\-version\fR
Print version
.SH VERSION
v1.6.0
.SH AUTHORS
Network Monitor