{
  "id": "rustnet",
  "name": "RustNet",
  "homepage": "https://github.com/domcyrus/rustnet",
  "description": "Per-process network monitoring for your terminal with deep packet inspection, sandboxed by default.",
  "executables": [
    "rustnet"
  ],
  "dotfiles": {
    "paths": [
      "~/.config/rustnet/config.toml"
    ],
    "secret": [],
    "side_effect": false
  },
  "commands": {
    "format": 1,
    "label": "Monitor connections",
    "description": "Watch network connections per process in the TUI, or run headless and dump snapshots. Theme, GeoIP database paths, sandbox and logging switches are mostly left out.",
    "quality": "ai-draft",
    "parser": {
      "end_of_options": "--",
      "interleave": "permute",
      "long_equals": true,
      "short_attached": true,
      "short_bundles": false
    },
    "source": [
      {
        "id": "usage",
        "kind": "help",
        "url": "https://github.com/domcyrus/rustnet/blob/main/USAGE.md",
        "revision": "2026-10-27",
        "evidence": "  -i, --interface <INTERFACE>            Network interface to monitor\n      --show-localhost                   Show localhost connections (overrides default filtering)\n      --headless                         Run without the interactive terminal UI\n      --duration <SECONDS>               Stop headless monitoring after this many seconds\n      --output <FORMAT>                  Headless output format: jsonl (stream snapshots) or\n                                         json (final snapshot)\n      --filter <QUERY>                   Filter headless output using the shared connection filter syntax\n  -r, --refresh-interval <MILLISECONDS>  UI and headless snapshot refresh interval in milliseconds\n      --no-dpi                           Disable deep packet inspection\n      --no-resolve-dns                   Disable reverse DNS lookups (enabled by default)\n      --pcap-export <FILE>               Export captured packets to PCAP file for Wireshark analysis\n  -f, --bpf-filter <FILTER>              BPF filter expression for packet capture\n"
      }
    ],
    "field": [
      {
        "id": "interface",
        "label": "Interface",
        "type": "string",
        "option": [
          "--interface",
          "-i"
        ],
        "sources": [
          "usage"
        ]
      },
      {
        "id": "show_localhost",
        "label": "Show localhost connections",
        "type": "boolean",
        "option": [
          "--show-localhost"
        ],
        "sources": [
          "usage"
        ]
      },
      {
        "id": "bpf_filter",
        "label": "BPF filter",
        "description": "Packet-capture filter expression, for example tcp port 443.",
        "type": "string",
        "option": [
          "--bpf-filter",
          "-f"
        ],
        "sources": [
          "usage"
        ]
      },
      {
        "id": "refresh_interval",
        "label": "Refresh interval (ms)",
        "type": "integer",
        "option": [
          "--refresh-interval",
          "-r"
        ],
        "sources": [
          "usage"
        ]
      },
      {
        "id": "no_dpi",
        "label": "Disable deep packet inspection",
        "type": "boolean",
        "option": [
          "--no-dpi"
        ],
        "sources": [
          "usage"
        ]
      },
      {
        "id": "no_resolve_dns",
        "label": "Disable reverse DNS",
        "type": "boolean",
        "option": [
          "--no-resolve-dns"
        ],
        "sources": [
          "usage"
        ]
      },
      {
        "id": "headless",
        "label": "Headless",
        "description": "Run without the terminal UI and print snapshots.",
        "type": "boolean",
        "option": [
          "--headless"
        ],
        "sources": [
          "usage"
        ]
      },
      {
        "id": "duration",
        "label": "Duration (seconds)",
        "description": "Stop headless monitoring after this many seconds.",
        "type": "integer",
        "option": [
          "--duration"
        ],
        "sources": [
          "usage"
        ]
      },
      {
        "id": "output",
        "label": "Headless output format",
        "type": "enum",
        "option": [
          "--output"
        ],
        "choices": [
          {
            "value": "jsonl",
            "label": "JSON Lines (stream)"
          },
          {
            "value": "json",
            "label": "JSON (final snapshot)"
          }
        ],
        "sources": [
          "usage"
        ]
      },
      {
        "id": "filter",
        "label": "Headless filter",
        "type": "string",
        "option": [
          "--filter"
        ],
        "sources": [
          "usage"
        ]
      },
      {
        "id": "pcap_export",
        "label": "PCAP export file",
        "type": "path",
        "option": [
          "--pcap-export"
        ],
        "path": {
          "kind": "file",
          "role": "output"
        },
        "effect": "overwrite",
        "sources": [
          "usage"
        ]
      }
    ],
    "task": [
      {
        "id": "monitor",
        "label": "Monitor an interface",
        "fields": [
          "interface",
          "bpf_filter",
          "show_localhost",
          "no_dpi",
          "no_resolve_dns"
        ]
      },
      {
        "id": "snapshot",
        "label": "Headless snapshot",
        "set": {
          "headless": [
            true
          ]
        },
        "lock": [
          "headless"
        ],
        "fields": [
          "interface",
          "headless",
          "duration",
          "output",
          "filter"
        ],
        "required": [
          "duration"
        ]
      },
      {
        "id": "capture",
        "label": "Export a PCAP",
        "fields": [
          "interface",
          "bpf_filter",
          "pcap_export"
        ],
        "required": [
          "pcap_export"
        ]
      }
    ],
    "group": [
      {
        "id": "basic",
        "label": "Basic",
        "fields": [
          "interface",
          "bpf_filter",
          "show_localhost",
          "headless",
          "duration",
          "output"
        ]
      },
      {
        "id": "advanced",
        "label": "Advanced",
        "fields": [
          "filter",
          "refresh_interval",
          "no_dpi",
          "no_resolve_dns",
          "pcap_export"
        ]
      }
    ]
  }
}