mirror of
https://github.com/domcyrus/rustnet.git
synced 2026-02-12 09:18:39 -06:00
799d66cf86
* feat: Add experimental eBPF support for enhanced socket tracking - Implement eBPF-based socket tracker for Linux with CO-RE support - Add minimal vmlinux header (5.5KB) instead of full 3.4MB file - Create graceful fallback mechanism to procfs when eBPF unavailable - Add comprehensive eBPF build documentation - Integrate libbpf-rs for eBPF program loading and management - Support both IPv4 and IPv6 socket tracking - Add capability checking for required permissions The eBPF feature is optional and disabled by default. When enabled, it provides faster and more accurate process-to-socket mapping on Linux systems with appropriate permissions.
4.1 KiB
4.1 KiB
RustNet Roadmap
This document outlines the planned features and improvements for RustNet.
Platform Support
- macOS Support: Basic features need testing and fixes for macOS compatibility
- Windows Support: Basic functionality working with Npcap SDK and runtime. Process identification not yet implemented for Windows
- BSD Support: Add support for FreeBSD, OpenBSD, and NetBSD
- Linux Process Identification: Experimental eBPF Support Implemented - Basic eBPF-based process identification now available with
--features ebpf. Provides efficient kernel-level process-to-connection mapping with lower overhead than procfs. Currently has limitations (see eBPF Improvements section below).
eBPF Improvements (Linux)
The experimental eBPF support provides efficient process identification but has several areas for improvement:
Current Limitations
- Process Names Limited to 16 Characters: Uses kernel
commfield, causing truncation (e.g., "Firefox" → "Socket Thread") - Thread Names vs Process Names: Shows thread command names instead of full executable names
- Minimal vmlinux.h Maintenance: Current approach requires manual updates when adding new kernel structure access
Planned Improvements
- Hybrid eBPF + Procfs Approach: Use eBPF for connection tracking, selectively lookup full process names via procfs for better accuracy
- Full Executable Path Resolution: Investigate accessing full process executable path from eBPF programs
- Better Process-Thread Mapping: Improve mapping from thread IDs to parent process information
- vmlinux.h Strategy: Consider switching to full auto-generated vmlinux.h for easier maintenance vs current minimal approach
- Enhanced BTF Support: Better compatibility across different kernel versions and distributions
- Performance Optimizations: Reduce eBPF map lookups and improve connection-to-process matching efficiency
Future Enhancements
- Real-time Process Updates: Track process name changes and executable updates
- Container Support: Better process identification within containerized environments
- Security Context: Include process security attributes (capabilities, SELinux context, etc.)
Features
- Sorting: Sort by name, bandwidth utilization, etc.
- DPI Enhancements: Improve deep packet inspection capabilities:
- Support more protocols (e.g. FTP, SMTP, etc.)
- More accurate SNI detection for QUIC/HTTPS
- DNS Reverse Lookup: Add optional hostname resolution (toggle between IP and hostname display)
- IPv6 Support: Full IPv6 connection tracking and display, including DNS resolution, didn't test yet
- Search/Filter:
- Regular expression support (future enhancement)
- Internationalization (i18n): Support for multiple languages in the UI
- Connection History: Store and display historical connection data
- Export Functionality: Export connections to CSV/JSON formats
- Configuration File: Support for persistent configuration (filters, UI preferences)
- Connection Alerts: Notifications for new connections or suspicious activity
- GeoIP Integration: Maybe add geographical location of remote IPs
- Protocol Statistics: Summary view of protocol distribution
- Rate Limiting Detection: Identify connections with unusual traffic patterns
UI Improvements
- Resizable Columns: Dynamic column width adjustment
- Connection Grouping: Group connections by process/service
- Sortable Columns: Click to sort by any column
- Connection Details Popup: Modal dialog for detailed connection info
- ASCII Graphs: Terminal-based graphs for bandwidth/packet visualization
- Mouse Support: Click to select connections
- Split Pane View: Show multiple views simultaneously
Development
- Unit Tests: Comprehensive test coverage for all modules
- Integration Tests: End-to-end testing for different platforms
- CI/CD Pipeline: Automated builds and releases for all platforms
- Documentation: API documentation and developer guide
- Packaging/Distribution: Create packages for easy installation on Linux, macOS, and Windows