rustnet(1)

📦 version 1.7.0, in arch rolling

💅 rustnet — like, the whole manual, bestie

okay so you opened rustnet(1) and I'm gonna walk you through it like we're texting at 2am. it's the General Commands Manual page, and honestly? it ate. let's go. 🫶

✨ NAME ✨

rustnet — a cross-platform network monitoring tool. that's it. that's the vibe. it watches your network and tells you what's up. 👑

🌸 SYNOPSIS 🌸

rustnet [-i|--interface] [--no-localhost] [--show-localhost]
[--headless] [--duration] [--output] [--filter] [-r|--refresh-interval]
[--no-dpi] [-l|--log-level] [--json-log] [--pcap-export]
[--pcapng-export] [-f|--bpf-filter] [--no-resolve-dns]
[--show-ptr-lookups] [--no-color] [--theme] [--geoip-country]
[--geoip-asn] [--geoip-city] [--no-geoip] [--kubernetes] [--no-sandbox]
[--sandbox-strict] [--no-uid-drop] [-h|--help] [-V|--version]

like yes, that's a lot of brackets. it's giving "choose your own adventure" and we love her for it. 💖

🦋 DESCRIPTION 🦋

Cross-platform network monitoring tool. literally what it says on the tin, no cap. it monitors networks, on multiple platforms, and it's written in rust (iykyk). 🌈

🎀 OPTIONS 🎀 — the main character section, lowkey my favorite

  • -i, --interface <INTERFACE> — which network interface you wanna monitor. pass "any" and it captures all the interfaces at once. main character energy, honestly. 👑
  • --no-localhost — yeets localhost connections out of the results. filter 'em, bestie.
  • --show-localhost — actually shows localhost connections (this overrides the default filtering, so it's the "wait, come back" option 💜).
  • --headless — runs without the interactive terminal UI. just the data, no glitz. very demure, very mindful.
  • --duration <SECONDS> — stops headless monitoring after this many seconds. a little timer for your little headless run. ⏰
  • --output <FORMAT> — the headless output format. options are jsonl (streams snapshots) or json (one final snapshot). pick your fighter. possible values:
    • jsonl
    • json
  • --filter <QUERY> — filters the headless output using the shared connection filter syntax. shared! with the other stuff! you know the one. 🔍
  • -r, --refresh-interval <MILLISECONDS> — snapshot + UI refresh interval, in milliseconds. default: 500. yes, half a second, she's quick. ⭐
  • --no-dpi — disables deep packet inspection. DPI said "not today". 🙈
  • -l, --log-level <LEVEL> — sets the log level. and listen: if you don't provide it, no logging will be enabled at all. so like, actually pass it if you want logs, bestie. 😭
  • --json-log <FILE> — turns on JSON logging of connection events, written to the file you specify. structured logs, so organized. 🎀
  • --pcap-export <FILE> — exports captured packets to a PCAP file for Wireshark analysis. ur packets, but make it a keepsake. 🦋
  • --pcapng-export <FILE> — exports captured packets to an annotated PCAPNG file for Wireshark analysis. annotated!! the glow-up version. ✨
  • -f, --bpf-filter <FILTER> — a BPF filter expression for packet capture. examples they literally gave: "tcp port 443" and "dst port 80". slay. 🔥
  • --no-resolve-dns — disables reverse DNS resolution for IP addresses. note it's enabled by default, and it shows hostnames instead of IPs, so this turns that whole thing off. 🧚
  • --show-ptr-lookups — shows PTR lookup connections in the UI. they're hidden by default when DNS resolution is enabled, so this is the "unhide them" button. 👀
  • --no-color — no colors in the UI at all. it also respects the NO_COLOR env var, so that's a thing. monochrome moment. 🖤
  • --theme <PRESET> — color theme: muted (default), vivid, catppuccin-mocha, tokyo-night, gruvbox, nord. this overrides the theme set in the config file at ~/.config/rustnet/config.toml. possible values:
    • muted
    • vivid
    • catppuccin-mocha
    • tokyo-night
    • gruvbox
    • nord
  • --geoip-country <PATH> — path to the GeoLite2-Country.mmdb database. it auto-discovers from: ./resources/geoip2, $XDG_DATA_HOME/rustnet/geoip, ~/.local/share/rustnet/geoip, /usr/share/GeoIP, /usr/local/share/GeoIP, /opt/homebrew/share/GeoIP, /var/lib/GeoIP. she'll find it, don't worry. 🌍
  • --geoip-asn <PATH> — path to the GeoLite2-ASN.mmdb database. same search paths as --geoip-country. twinning! 🫶
  • --geoip-city <PATH> — path to the GeoLite2-City.mmdb database. same search paths as --geoip-country, and it's a superset of Country: gives you the city name and postal code in addition to the country. more info, more fun. 🏙️
  • --no-geoip — disables GeoIP lookups entirely. goodbye geography. 💀
  • --kubernetes <MODE> — Kubernetes pod/container attribution. default: auto. the modes: "auto" (only enabled when running inside a pod), "on" (always), or "off". possible values:
    • auto
    • on
    • off
  • --no-sandbox — disables sandboxing. ⚠️ heads up though: on Linux, PR_SET_NO_NEW_PRIVS is still set. so like, not fully sandbox-free, okurrr.
  • --sandbox-strict — requires full sandbox enforcement, or it exits. strict means strict, periodt. 🚨
  • --no-uid-drop — keeps running as root instead of dropping to SUDO_UID/SUDO_GID (or nobody) after initialization. and why would you? because keeping root lets the procfs fallback attribute other users' processes when eBPF is unavailable. so it's a real tradeoff, not just chaos. 👑
  • -h, --help — prints help. ur lil map. 🗺️
  • -V, --version — prints the version. iconic. ⭐
fr fr, keep the caveats in mind: --no-sandbox on Linux still sets PR_SET_NO_NEW_PRIVS, --sandbox-strict will outright exit if it can't fully enforce, and --no-uid-drop means you stay root on purpose. read before you send it. 💅

💜 VERSION 💜

v1.7.0 — that's her. current. fresh. 🦋

🌟 AUTHORS 🌟

Network Monitor. yes that's the author line, and yes it's giving mysterious. 🕵️

and that's the whole page, bestie!! no skips, no cuts, every flag accounted for. 🫶

💖 cute lil sign-off: this was rustnet 1.7.0, from the rustnet(1) page — see u in the group chat, mwah 💅✨🎀
📦 where this page comes from