Skip to main content

Crate rustnet_host

Crate rustnet_host 

Source
Expand description

§rustnet-host

Per-connection process attribution for RustNet: given a Connection, find the owning process (pid + name). Each platform uses its best available strategy behind one ProcessLookup trait, selected by create_process_lookup:

  • Linux — eBPF socket tracking (with the ebpf feature) and a procfs fallback.
  • macOS — PKTAP packet metadata when available (capture provides it directly, so lookup is a no-op), otherwise lsof.
  • Windows — the IP Helper API (GetExtendedTcpTable/...UdpTable).
  • FreeBSD — sockstat.

When a platform can’t use its optimal method, ProcessLookup::get_degradation_reason reports why via DegradationReason (e.g. missing CAP_BPF, no root for PKTAP), which front-ends can surface to the user.

This crate depends only on rustnet-core (for Connection/Protocol). It does not depend on rustnet-capture; on macOS the application injects whether PKTAP is active (via report_pktap_degradation) rather than this crate querying capture. It has no UI or capture-loop dependency, so headless tools can attribute processes the same way the rustnet TUI does.

Structs§

ConnectionKey
Connection identifier for lookups

Enums§

DegradationReason
Reasons why process detection may be degraded from optimal

Traits§

ProcessLookup
Trait for platform-specific process lookup

Functions§

create_process_lookup
Create a Linux process lookup implementation. Tries enhanced eBPF lookup first (if the feature is enabled), falls back to procfs. The _use_pktap parameter is ignored on Linux (macOS only).