domcyrus/rustnet v1.5.0

Release v1.5.0

on GitHub

This release makes RustNet Kubernetes-aware: connections can be attributed to their
owning pod and container, and the new native PCAPNG export writes Wireshark-ready
captures with process, DPI, GeoIP, and pod annotations. A new Activity view ranks
processes by traffic, the graphs got a gradient braille overhaul, Windows process
attribution went event-driven with ETW, and rustnet now drops root privileges after
initialization on Linux, macOS, and FreeBSD.

Added

• Kubernetes Pod/Container Attribution: New optional kubernetes feature
  (off by default, no extra dependencies) that attributes connections to their
  owning pod and container on a node, including hostNetwork pods. Pod, namespace,
  and container appear in the Details pane, JSONL/PCAPNG exports, and the new
  pod:, ns:, and container: filter keywords. The container image enables the
  feature by default (#299, #450)
• Native Annotated PCAPNG Export: New --pcapng-export FILE writes a
  Wireshark-ready PCAPNG file whose packet comments carry best-effort process, PID,
  direction, DPI/SNI, and GeoIP metadata, preserving libpcap timestamps and original
  packet lengths. The Overview panel reports export progress and annotation stats (#432)
• Process Activity View: The Interfaces tab is now a process-focused Activity
  view (key 3) ranking egress and ingress traffic with 60-second share bars,
  retained totals, connection counts, and top remote peers; d flips direction,
  s changes the sort metric, and i opens the detailed interface table (#465)
• Gradient Braille Graphs and Adaptive Rendering: Flow-inspired braille area
  graphs with gradient ramps across the Graph tab, Overview mini graphs, and
  per-connection Details waves, plus a draw-on-demand main loop with event
  coalescing that roughly halves terminal-emulator CPU (#459)
• Pane Scrolling and Filled Traffic Chart: Details, Help, and Interfaces tabs
  scroll with mouse wheel and vim keys instead of silently clipping, and the
  traffic chart renders RX/TX as filled areas (#452)
• Event-driven Windows Process Attribution: Use kernel network and process ETW
  events to retain connection ownership for short-lived processes, with IP Helper
  polling as reconciliation and fallback. IPv6 UDP ownership is now included (#474)

Security

• Drop Root Privileges After Initialization: Under sudo, rustnet now drops to
  SUDO_UID/SUDO_GID (or nobody for plain root) once capture and eBPF are
  initialized on Linux, macOS, and FreeBSD, so a DPI compromise no longer runs as
  root. Opt out with the new --no-uid-drop flag; --sandbox-strict fails hard if
  the drop fails. Trade-offs are documented in SECURITY.md (#456, #457, #458)
• No More CAP_SYS_ADMIN Auto-Grant: DEB/RPM installs no longer grant the
  broad cap_sys_admin eBPF fallback capability; on pre-5.8 kernels process
  detection degrades to procfs instead (#431)
• Hardened File Writes: Log and capture files are created atomically with
  O_NOFOLLOW and mode 0600, and lsof/sockstat are invoked by absolute path
  to prevent symlink and $PATH attacks (#430)

Fixed

• Dynamic local-address detection: Refresh endpoint-orientation addresses after
  network changes and retry ambiguous unicast packets once. On Windows, supplement
  the IPv4-only adapter data with GetAdaptersAddresses() so IPv6 traffic is not
  shown with reversed local and remote endpoints (#475)
• Transport Payload Length: Trim the transport slice to the IP datagram length,
  so Ethernet frame padding no longer produces phantom 6-byte payloads, false
  retransmission counts, resurrected closed connections, or DPI misclassification
  from trailing bytes (#479, thanks @0xghost42)
• Connection Lifecycle: Reused connection tuples no longer inherit their
  predecessor's process/DPI metadata in PCAPNG annotations or rate history in
  Details; immutable history is preserved across tuple reuse; UI-side expiry no
  longer hides tracked connections; rows stay yellow through the whole warning
  window; and the recently-closed tombstone table keeps a capacity floor for tiny
  archive configs (#469, #470, #473)
• Grouped Overview Navigation: Space collapses or expands a process group from
  a child row, and g/G jump to the first and last visible rows in grouped
  mode (#471)
• Live Graph Rendering: Graphs sample and redraw more frequently with stable
  scaling, so waves no longer wobble or flatten after spikes, and the connection
  count graph now shows opened/closed lifecycle activity (#472)
• Overview Status Polish: Clarified filtered result counts, kept Statistics
  totals unfiltered with process counts, and added an expiry color gradient with a
  matching Help legend (#466)
• Stable Details Layout: The Details tab uses fixed Connection, Network
  Context, Application, and Transport Health cards with placeholder rows, so
  sections no longer shift while navigating (#462)
• Help Scrollbar: Restored the inset Help scrollbar and the Help · ↑/↓ scroll
  title hint (#460)
• QUIC DPI: Parse Retry and Version Negotiation packets correctly, merge CRYPTO
  fragments across coalesced Initial packets (restoring SNI for large ClientHellos),
  and use the right Initial salts for draft/mvfst versions (#453)
• Protocol Detection Switches: Correct DPI misclassifications (SIP/RTSP as
  HTTP, SMTP as FTP, WireGuard as BitTorrent uTP), add MQTT QoS 2/AUTH types and
  structural SNMPv3 parsing, fix NetBIOS datagram offsets, and drop non-first IP
  fragments at the parser (#454)
• DNS Label Parsing: Reject RFC 1035 reserved label top-bits in
  parse_question, matching skip_dns_name (#434, thanks @0xghost42)
• SSH State Detection: Inspect the final 6-byte packet window, so signatures at
  the end of the payload are no longer missed (#406, thanks @0xghost42)
• TLS Cipher Names: Correct six mislabeled ARIA and Camellia cipher-suite
  names (#404, thanks @0xghost42)
• macOS PKTAP PIDs: Accept PIDs up to Darwin's 99999 ceiling instead of
  dropping attribution for PIDs at or above 65535 (#415, thanks @0xghost42)
• eBPF Map Cleanup: Compare map timestamps against CLOCK_MONOTONIC instead of
  wall-clock time, so cleanup no longer flushes the entire map and attribution no
  longer silently falls back to procfs (#451)

Performance

• Ratatui Hot Paths: Cache selected row positions, aggregate Graph tab metrics
  in one borrowed pass, and select only the top process rows instead of sorting
  every process (#461)
• HTTP Parser: Drop the per-packet Vec allocation in the HTTP start-line
  parser (#402, thanks @0xghost42)

Internal

• Library Crates 0.4.0: rustnet-core, rustnet-capture, and rustnet-host
  are released as 0.4.0 with the new Kubernetes, PCAPNG, and parser APIs
• CI Auditing: Replaced cargo-deny with RustSec cargo-audit for CI and
  scheduled supply-chain checks (#464)
• OUI Database: Monthly vendor database refresh (#439)
• Dependencies: Routine dependency and GitHub Actions updates across the cycle
  (Dependabot)

Contributors

Special thanks to the contributors in this release:

• @0xghost42: the transport payload-length fix,
  TLS cipher-suite corrections, SSH and DNS DPI fixes, the PKTAP PID ceiling fix,
  and HTTP parser performance (#402, #404, #406, #415, #434, #479)