rustnet(1)

NAME
rustnet - Cross-platform network monitoring tool

SYNOPSIS
rustnet [-i|--interface] [--no-localhost] [--show-localhost] [-r|--refresh-interval] [--no-dpi] [-l|--log-level] [--json-log] [--pcap-export] [--pcapng-export] [-f|--bpf-filter] [--no-resolve-dns] [--show-ptr-lookups] [--no-color] [--theme] [--geoip-country] [--geoip-asn] [--geoip-city] [--no-geoip] [--kubernetes] [--no-sandbox] [--sandbox-strict] [--no-uid-drop] [-h|--help] [-V|--version]

DESCRIPTION
Cross-platform network monitoring tool

OPTIONS

-i, --interface <INTERFACE>
    Network interface to monitor (use "any" to capture all interfaces)

--no-localhost
    Filter out localhost connections

--show-localhost
    Show localhost connections (overrides default filtering)

-r, --refresh-interval <MILLISECONDS> [default: 500]
    UI refresh interval in milliseconds

--no-dpi
    Disable deep packet inspection

-l, --log-level <LEVEL>
    Set the log level (if not provided, no logging will be enabled)

--json-log <FILE>
    Enable JSON logging of connection events to specified file

--pcap-export <FILE>
    Export captured packets to PCAP file for Wireshark analysis

--pcapng-export <FILE>
    Export captured packets to annotated PCAPNG file for Wireshark analysis

-f, --bpf-filter <FILTER>
    BPF filter expression for packet capture (e.g., "tcp port 443", "dst port 80")

--no-resolve-dns
    Disable reverse DNS resolution for IP addresses (enabled by default; shows hostnames instead of IPs)

--show-ptr-lookups
    Show PTR lookup connections in UI (hidden by default when DNS resolution is enabled)

--no-color
    Disable all colors in the UI (also respects NO_COLOR env var)

--theme <PRESET>
    Color theme: muted (default), vivid, catppuccin-mocha, tokyo-night, gruvbox, nord. Overrides the theme set in the config file (~/.config/rustnet/config.toml)
    Possible values:

    •   muted

    •   vivid

    •   catppuccin-mocha

    •   tokyo-night

    •   gruvbox

    •   nord

--geoip-country <PATH>
    Path to GeoLite2-Country.mmdb database. Auto-discovered from: ./resources/geoip2, $XDG_DATA_HOME/rustnet/geoip, ~/.local/share/rustnet/geoip, /usr/share/GeoIP, /usr/local/share/GeoIP, /opt/homebrew/share/GeoIP, /var/lib/GeoIP

--geoip-asn <PATH>
    Path to GeoLite2-ASN.mmdb database (same search paths as --geoip-country)

--geoip-city <PATH>
    Path to GeoLite2-City.mmdb database (same search paths as --geoip-country; superset of Country — provides city name and postal code in addition to country)

--no-geoip
    Disable GeoIP lookups entirely

--kubernetes <MODE> [default: auto]
    Kubernetes pod/container attribution: "auto" (enable only when running inside a pod), "on" (always), or "off"
    Possible values:

    •   auto

    •   on

    •   off

--no-sandbox
    Disable sandboxing (on Linux, PR_SET_NO_NEW_PRIVS is still set)

--sandbox-strict
    Require full sandbox enforcement or exit

--no-uid-drop
    Keep running as root instead of dropping to SUDO_UID/SUDO_GID (or nobody) after initialization. Keeping root lets the procfs fallback attribute other users' processes when eBPF is unavailable

-h, --help
    Print help

-V, --version
    Print version

VERSION
v1.6.0

AUTHORS
Network Monitor