RustNet is a terminal UI that shows live per-process network activity:
which application owns each TCP, UDP, and QUIC connection, what protocol it speaks, and how the connection is behaving in real time. It runs sandboxed by default and drops privileges immediately after libpcap initializes.

Features:

- Per-process attribution for TCP, UDP, and QUIC via eBPF on Linux, PKTAP on macOS, and native APIs on Windows and FreeBSD
- Deep packet inspection for HTTP, HTTPS/TLS (with SNI), DNS, SSH, FTP, QUIC, MQTT, BitTorrent, STUN, NTP, mDNS, LLMNR, DHCP, SNMP, SSDP, and NetBIOS
- Security sandboxing: Landlock (Linux 5.13+), Seatbelt (macOS), token privilege drop and job-object child blocking (Windows)
- TCP analytics: retransmissions, out-of-order packets, and fast-retransmit detection, per-connection and aggregate
- Protocol-aware connection lifecycle with staleness indicators
- Vim/fzf-style filtering on port, src, dst, sni, process, state, proto, plus regex
- GeoIP country lookups via local MaxMind GeoLite2 (no network calls)
- Cross-platform: Linux, macOS, Windows, FreeBSD