docs: make Chinese README the default

2026-07-13 10:19:04 +00:00
parent 57b9c37ba1
commit 93bc37ffd8
1 changed files with 186 additions and 183 deletions
@@ -1,7 +1,13 @@
+<!-- WEHUB_ZH_README -->
+> [!NOTE]
+> 本文档由 WeHub 基于上游 README 翻译整理，属于社区翻译，非官方中文文档。  
+> [English](./README.en.md) · [原始项目](https://github.com/domcyrus/rustnet) · [上游 README](https://github.com/domcyrus/rustnet/blob/HEAD/README.md)  
+> 原作者、版权与许可证归属以原始项目及本仓库 LICENSE 文件为准。
+
 <p align="center">
  <h1 align="center">RustNet</h1>
  <p align="center">
-    <strong>Per-process network monitoring for your terminal: live TCP, UDP, and QUIC connections with deep packet inspection, sandboxed by default.</strong>
+    <strong>面向终端的进程级网络监控工具：实时呈现 TCP、UDP、QUIC 连接，自带深度包检测，默认沙箱隔离运行。</strong>
  </p>
  <p align="center">
    <a href="https://ratatui.rs/"><img src="https://ratatui.rs/built-with-ratatui/badge.svg" alt="Built With Ratatui"></a>
@@ -15,7 +21,7 @@
 </p>

 <p align="center">
-  <strong>English</strong> | <a href="README.zh-CN.md">简体中文</a>
+  <a href="README.md">English</a> | <strong>简体中文</strong>
 </p>

 <p align="center">
@@ -23,115 +29,113 @@
 </p>

 <p align="center">
-  <em>Real-time visibility into every connection your machine makes, who owns it, and what protocol it's speaking. No tcpdump, X11 forwarding, or root piping.</em>
+  <em>实时洞察机器对外发起的每一条连接：谁在使用它、走的是什么协议。无需 tcpdump，无需 X11 转发，也不必把 root 权限传递下去。</em>
 </p>

-## Features
+## 功能特性

- **Per-process attribution**: Every TCP, UDP, and QUIC connection mapped to its owning process, via eBPF on Linux, PKTAP on macOS, native APIs on Windows and FreeBSD. Wireshark and tcpdump can't do this; `netstat` / `ss` can't show live state.
- **Deep packet inspection**: Identify HTTP, HTTPS/TLS with SNI, DNS, SSH, FTP, QUIC, MQTT, BitTorrent, STUN, NTP, mDNS, LLMNR, DHCP, SNMP, SSDP, and NetBIOS, without external dissectors.
- **Annotated PCAPNG export**: `--pcapng-export` writes a Wireshark-ready capture with process, PID, direction, DPI/SNI, and GeoIP embedded as per-packet comments. Open it in Wireshark and every packet already names its owning process, with no post-processing. Classic `--pcap-export` with a JSONL sidecar for offline correlation is also available.
- **Security sandboxing**: Landlock (Linux 5.13+), Seatbelt (macOS), token privilege drop + job-object child-process block (Windows). Drops privileges immediately after libpcap initializes. See [SECURITY.md](SECURITY.md).
- **TCP network analytics**: Real-time retransmissions, out-of-order packets, and fast-retransmit detection, per-connection and aggregate.
- **Smart connection lifecycle**: Protocol-aware timeouts with white → yellow → red staleness indicators. Toggle `t` to keep historic (closed) connections visible for forensics.
- **Vim/fzf-style filtering**: `port:`, `src:`, `dst:`, `sni:`, `process:`, `state:`, `proto:`, plus regex via `/(?i)pattern/`.
- **GeoIP enrichment**: Country lookups via local MaxMind GeoLite2. No network calls.
- **Kubernetes attribution** (optional `kubernetes` feature): connections mapped to their pod, namespace, and container, shown in the details pane, JSON/PCAPNG exports, and the `pod:`, `ns:`, `container:` filters. Enabled in the official Docker image; on a cluster, use the [kubectl-rustnet](https://github.com/domcyrus/kubectl-rustnet) plugin to run it as an ephemeral debug pod. See [USAGE.md](USAGE.md#--kubernetes-mode-optional-feature).
- **Cross-platform**: Linux, macOS, Windows, FreeBSD.
+- **进程级归属识别**：每一条 TCP、UDP、QUIC 连接都能追溯到所属进程。Linux 使用 eBPF，macOS 使用 PKTAP，Windows 与 FreeBSD 则走原生 API。Wireshark 与 tcpdump 做不到这一点；`netstat` / `ss` 也无法展示实时状态。
+- **深度包检测**：无需外部解析器即可识别 HTTP、带 SNI 的 HTTPS/TLS、DNS、SSH、FTP、QUIC、MQTT、BitTorrent、STUN、NTP、mDNS、LLMNR、DHCP、SNMP、SSDP 及 NetBIOS。
+- **安全沙箱**：Linux 5.13+ 使用 Landlock，macOS 使用 Seatbelt，Windows 通过 token 降权 + job-object 阻止子进程创建。libpcap 初始化完成后立即丢弃特权。详见 [SECURITY.zh-CN.md](SECURITY.zh-CN.md)。
+- **TCP 网络分析**：实时统计重传、乱序包、快重传，既有逐连接视图也有汇总视图。
+- **智能连接生命周期**：按协议设置超时，以白 → 黄 → 红的颜色指示过期程度。按 `t` 可保留历史（已关闭）连接以便事后追溯。
+- **Vim / fzf 风格过滤**：支持 `port:`、`src:`、`dst:`、`sni:`、`process:`、`state:`、`proto:`，以及 `/(?i)pattern/` 形式的正则。
+- **GeoIP 增强**：基于本地 MaxMind GeoLite2 数据库查询国家信息，不发起任何网络请求。
+- **跨平台**：Linux、macOS、Windows、FreeBSD。

-## Why RustNet?
+## 为什么选 RustNet？

-RustNet fills the gap between simple connection tools (`netstat`, `ss`) and packet analyzers (`Wireshark`, `tcpdump`):
+RustNet 填补了简单连接工具(`netstat`、`ss`)与数据包分析器(`Wireshark`、`tcpdump`)之间的空白：

- **Process attribution**: See which application owns each connection. Wireshark cannot provide this because it only sees packets, not sockets.
- **Connection-centric view**: Track states, bandwidth, and protocols per connection in real-time
- **SSH-friendly**: TUI works over SSH so you can quickly see what's happening on a remote server without forwarding X11 or capturing traffic
+- **进程归属**：看清每条连接归哪个应用所有。Wireshark 看不到这一层，因为它只看包，不看 socket。
+- **以连接为中心的视图**：逐连接实时追踪状态、带宽与协议。
+- **SSH 友好**：TUI 可直接在 SSH 会话中运行，远端服务器上发生了什么一眼可见，不必转发 X11 或抓包再回传。

-RustNet complements packet capture tools. Use RustNet to see *what's making connections*. For direct Wireshark inspection, `--pcapng-export` writes live best-effort packet comments with PID/process context. For cleanup-time correlation, use `--pcap-export` plus the JSONL sidecar and optional `scripts/pcap_enrich.py`. See [PCAP Export](USAGE.md#pcap-export) and [Comparison with Similar Tools](ARCHITECTURE.md#comparison-with-similar-tools) for details.
+RustNet 与抓包工具是互补关系。用 RustNet 看清*谁在发起连接*；若要直接在 Wireshark 中查看，可用 `--pcapng-export` 写出带 RustNet 数据包注释的 PCAPNG；若更重视清理阶段的元数据完整性，可用 `--pcap-export` 加 JSONL sidecar，再借 `scripts/pcap_enrich.py` 富化。参见 [USAGE.zh-CN.md 的 PCAP 导出章节](USAGE.zh-CN.md#pcap-export) 与 [ARCHITECTURE.zh-CN.md 的同类工具对比章节](ARCHITECTURE.zh-CN.md#comparison-with-similar-tools)。

-Built on ratatui, libpcap, eBPF (libbpf-rs), DashMap, crossbeam, ring, MaxMind GeoLite2, and Landlock. See [ARCHITECTURE.md](ARCHITECTURE.md#dependencies) for the full dependency breakdown.
+基于 ratatui、libpcap、eBPF(libbpf-rs)、DashMap、crossbeam、ring、MaxMind GeoLite2 与 Landlock 构建。完整依赖清单见 [ARCHITECTURE.zh-CN.md](ARCHITECTURE.zh-CN.md#dependencies)。

 <details>
-<summary><b>eBPF Enhanced Process Identification (Linux Default)</b></summary>
+<summary><b>基于 eBPF 的增强型进程识别(Linux 默认)</b></summary>

-RustNet uses kernel eBPF programs by default on Linux for enhanced performance and lower overhead process identification. However, this comes with important limitations:
+RustNet 在 Linux 上默认使用内核 eBPF 程序进行进程识别，从而获得更高的性能与更低的开销。但这种方式也有一些重要的限制需要了解：

-**Process Name Limitations:**
- eBPF uses the kernel's `comm` field, which is limited to 16 characters
- Shows the task/thread command name, not the full executable path
- Multi-threaded applications often show thread names instead of the main process name
+**进程名长度限制：**
+- eBPF 使用内核的 `comm` 字段，该字段最多只有 16 个字符
+- 显示的是任务 / 线程的命令名，而非完整的可执行路径
+- 多线程应用往往展示线程名而非主进程名

-**Real-world Examples:**
- **Firefox**: May appear as "Socket Thread", "Web Content", "Isolated Web Co", or "MainThread"
- **Chrome**: May appear as "ThreadPoolForeg", "Chrome_IOThread", "BrokerProcess", or "SandboxHelper"
- **Electron apps**: Often show as "electron", "node", or internal thread names
- **System processes**: Show truncated names like "systemd-resolve" → "systemd-resolve"
+**真实场景示例：**
+- **Firefox**：可能显示为 "Socket Thread"、"Web Content"、"Isolated Web Co" 或 "MainThread"
+- **Chrome**：可能显示为 "ThreadPoolForeg"、"Chrome_IOThread"、"BrokerProcess" 或 "SandboxHelper"
+- **Electron 应用**：经常显示为 "electron"、"node" 或内部线程名
+- **系统进程**：展示截断后的名字，如 "systemd-resolve" → "systemd-resolve"

-**Fallback Behavior:**
- When eBPF fails to load or lacks sufficient permissions, RustNet automatically falls back to standard procfs-based process identification
- Standard mode provides full process names but with higher CPU overhead
- eBPF is enabled by default; no special build flags needed
+**回退行为：**
+- 当 eBPF 加载失败或权限不足时，RustNet 会自动回退到基于 procfs 的标准进程识别方式
+- 标准模式可以拿到完整进程名，但 CPU 开销更高
+- eBPF 默认启用，无需任何特殊编译参数

-To disable eBPF and use procfs-only mode, build with:
+如需关闭 eBPF、仅使用 procfs 模式，请这样构建：
 ```bash
 cargo build --release --no-default-features
 ```

-See [ARCHITECTURE.md](ARCHITECTURE.md) for technical information.
+技术细节见 [ARCHITECTURE.zh-CN.md](ARCHITECTURE.zh-CN.md)。

 </details>

 <details>
-<summary><b>Interface Statistics Monitoring</b></summary>
+<summary><b>网络接口统计监控</b></summary>

-RustNet provides real-time network interface statistics across all supported platforms:
+RustNet 在所有支持的平台上提供实时的网络接口统计：

- **Overview Tab**: Shows active interfaces with current rates, errors, and drops
- **Interfaces Tab** (press `3`): Detailed table with comprehensive metrics for all interfaces
- **Cross-Platform**: Linux (sysfs), macOS/FreeBSD (getifaddrs), Windows (GetIfTable2 API)
- **Smart Filtering**: Windows automatically excludes virtual/filter adapters
+- **概览标签页**：展示当前活跃的接口，包含速率、错误数与丢包数
+- **接口标签页**(按 `3`)：以详细表格呈现各接口的完整指标
+- **跨平台**：Linux(sysfs)、macOS / FreeBSD(getifaddrs)、Windows(GetIfTable2 API)
+- **智能过滤**：Windows 上自动剔除虚拟 / 过滤类适配器

-See [USAGE.md](USAGE.md#interface-statistics) for detailed documentation on interpreting interface statistics and platform-specific behavior.
+如何解读接口统计以及各平台的差异，详见 [USAGE.zh-CN.md](USAGE.zh-CN.md#interface-statistics)。

-**Metrics Available:**
- Total bytes and packets (RX/TX)
- Error counters (receive and transmit)
- Packet drops (queue overflows)
- Collisions (legacy, rarely used on modern networks)
+**可用指标：**
+- 总字节数与包数(RX / TX)
+- 错误计数(收 / 发)
+- 丢包数(队列溢出)
+- 冲突数(传统指标，现代网络中很少出现)

-Stats are collected every 2 seconds in a background thread with minimal performance impact.
+数据由后台线程每 2 秒采集一次，对性能影响极小。

 </details>

-## Screenshots
+## 截图

 <table>
  <tr>
-    <td align="center"><strong>Overview</strong><br>Connections table with live stats and sparklines<br><img src="./assets/screenshots/overview.png" width="400"></td>
-    <td align="center"><strong>Details</strong><br>Per-connection SNI, cipher, GeoIP, DPI<br><img src="./assets/screenshots/details.png" width="400"></td>
+    <td align="center"><strong>概览</strong><br>连接列表与实时统计、迷你折线图<br><img src="./assets/screenshots/overview.png" width="400"></td>
+    <td align="center"><strong>详情</strong><br>逐连接展示 SNI、加密套件、GeoIP、DPI<br><img src="./assets/screenshots/details.png" width="400"></td>
  </tr>
  <tr>
-    <td align="center"><strong>Graph</strong><br>Traffic chart, app distribution, top processes<br><img src="./assets/screenshots/graph.png" width="400"></td>
-    <td align="center"><strong>Interfaces</strong><br>Per-interface RX/TX history with errors and drops<br><img src="./assets/screenshots/interfaces.png" width="400"></td>
+    <td align="center"><strong>图表</strong><br>流量曲线、应用分布、Top 进程<br><img src="./assets/screenshots/graph.png" width="400"></td>
+    <td align="center"><strong>接口</strong><br>各接口 RX / TX 历史曲线、错误与丢包<br><img src="./assets/screenshots/interfaces.png" width="400"></td>
  </tr>
 </table>

-## Quick Start
+## 快速上手

-### Installation
+### 安装

-**Homebrew (macOS / Linux):**
+**Homebrew(macOS / Linux):**
 ```bash
 brew install rustnet
 ```

-**Ubuntu (25.10+):**
+**Ubuntu(25.10+):**
 ```bash
 sudo add-apt-repository ppa:domcyrus/rustnet
 sudo apt update && sudo apt install rustnet
 ```

-**Fedora (42+):**
+**Fedora(42+):**
 ```bash
 sudo dnf copr enable domcyrus/rustnet
 sudo dnf install rustnet
@@ -152,189 +156,188 @@ sudo pacman -S rustnet
 **Nix / NixOS:**
 ```bash
 nix-shell -p rustnet
-# Then inside the shell: sudo rustnet
+# 然后在 shell 中执行: sudo rustnet
 ```

-**From crates.io:**
+**通过 crates.io:**
 ```bash
 cargo install rustnet-monitor
 ```

-**Windows (Chocolatey):**
+**Windows(Chocolatey):**
 ```powershell
-# Run in Administrator PowerShell
-# Requires Npcap (https://npcap.com) installed with "WinPcap API-compatible Mode" enabled
+# 需在管理员权限的 PowerShell 中执行
+# 需要先安装 Npcap(https://npcap.com)，并启用 "WinPcap API-compatible Mode"
 choco install rustnet
 ```

-**Other platforms:**
- **FreeBSD**: Download from [rustnet-bsd releases](https://github.com/domcyrus/rustnet-bsd/releases)
- **Docker, source builds, other Linux distros**: See [INSTALL.md](INSTALL.md) for detailed instructions
+**其他平台：**
+- **FreeBSD**：从 [rustnet-bsd releases](https://github.com/domcyrus/rustnet-bsd/releases) 下载
+- **Docker、源码构建、其他 Linux 发行版**：详见 [INSTALL.zh-CN.md](INSTALL.zh-CN.md)

-### Running RustNet
+### 运行 RustNet

-Packet capture requires elevated privileges:
+抓包需要更高的权限：

 ```bash
-# Quick start (all platforms)
+# 快速启动(所有平台)
 sudo rustnet

-# Linux: Grant capabilities to run without sudo (recommended)
+# Linux：为可执行文件赋予 Linux capabilities，即可免 sudo 运行(推荐)
 sudo setcap 'cap_net_raw,cap_bpf,cap_perfmon+eip' $(which rustnet)
 rustnet
 ```

-**Common options:**
+**常用参数：**
 ```bash
-rustnet -i eth0              # Specify network interface
-rustnet --show-localhost     # Show localhost connections
-rustnet --no-resolve-dns     # Disable reverse DNS lookups (enabled by default)
-rustnet -r 500               # Set refresh interval (ms)
-rustnet --theme classic      # Original full-color palette (default: muted)
-rustnet --pcapng-export capture.pcapng  # Annotated PCAPNG for Wireshark
+rustnet -i eth0              # 指定网络接口
+rustnet --show-localhost     # 显示 localhost 上的连接
+rustnet --no-resolve-dns     # 关闭反向 DNS 解析(默认开启)
+rustnet -r 500               # 设置刷新间隔(毫秒)
+rustnet --theme classic      # 原始全彩调色板(默认：muted)
+rustnet --pcapng-export capture.pcapng  # 导出带注释的 PCAPNG
 ```

-See [INSTALL.md](INSTALL.md) for detailed permission setup and [USAGE.md](USAGE.md) for complete options.
+权限配置详情见 [INSTALL.zh-CN.md](INSTALL.zh-CN.md)，完整参数说明见 [USAGE.zh-CN.md](USAGE.zh-CN.md)。

-> If you set capabilities but the TUI still shows `eBPF unavailable`, see
-> [eBPF Unavailable Despite Capabilities Being Set](INSTALL.md#ebpf-unavailable-despite-capabilities-being-set)
-> in the troubleshooting section.
+> 如果已经设置了 Linux capabilities，但 TUI 仍然提示 `eBPF unavailable`，请参阅 [INSTALL.zh-CN.md 的排障章节](INSTALL.zh-CN.md#ebpf-unavailable-despite-capabilities-being-set)。

-## Keyboard Controls
+## 键盘控制

-| Key | Action |
+| 按键 | 作用 |
 |-----|--------|
-| `q` | Quit (press twice to confirm) |
-| `Ctrl+C` | Quit immediately |
-| `x` | Clear all connections (press twice to confirm) |
-| `Tab` or `]` | Next tab |
-| `Shift+Tab` or `[` | Previous tab |
-| `1`–`5` | Jump to Overview / Details / Interfaces / Graph / Help |
-| `↑/k` `↓/j` | Navigate up/down |
-| `g` `G` | Jump to first/last connection |
-| `Enter` | View connection details |
-| `Esc` | Go back or clear filter |
-| `c` | Copy remote address |
-| `p` | Toggle service names/ports |
-| `d` | Toggle hostnames/IPs |
-| `s` `S` | Cycle sort columns / toggle direction |
-| `a` | Toggle process grouping |
-| `Space` | Expand/collapse process group |
-| `←/→` or `h/l` | Collapse/expand group |
-| `PageUp/PageDown` or `Ctrl+B/F` | Page navigation |
-| `t` | Toggle historic (closed) connections |
-| `i` | Toggle the System info sidebar |
-| `r` | Reset view (grouping, sort, filter) |
-| `/` | Enter filter mode |
-| `h` | Toggle help |
+| `q` | 退出(连按两次确认) |
+| `Ctrl+C` | 立即退出 |
+| `x` | 清空所有连接(连按两次确认) |
+| `Tab` 或 `]` | 下一个标签页 |
+| `Shift+Tab` 或 `[` | 上一个标签页 |
+| `1`–`5` | 直接跳转到 Overview / Details / Interfaces / Graph / Help |
+| `↑/k` `↓/j` | 上下移动 |
+| `g` `G` | 跳到第一条 / 最后一条连接 |
+| `Enter` | 查看连接详情 |
+| `Esc` | 返回或清除过滤器 |
+| `c` | 复制远端地址 |
+| `p` | 在服务名与端口之间切换 |
+| `d` | 在主机名与 IP 之间切换 |
+| `s` `S` | 切换排序列 / 切换排序方向 |
+| `a` | 切换按进程分组 |
+| `Space` | 展开 / 折叠进程分组 |
+| `←/→` 或 `h/l` | 折叠 / 展开当前分组 |
+| `PageUp/PageDown` 或 `Ctrl+B/F` | 翻页 |
+| `t` | 切换是否显示历史（已关闭）连接 |
+| `i` | 切换 System 信息侧边栏 |
+| `r` | 重置视图(分组、排序、过滤) |
+| `/` | 进入过滤模式 |
+| `h` | 切换帮助 |

-See [USAGE.md](USAGE.md) for detailed keyboard controls and navigation tips.
+完整键位说明与导航技巧见 [USAGE.zh-CN.md](USAGE.zh-CN.md)。

-## Filtering & Sorting
+## 过滤与排序

-**Quick filtering examples:**
+**快速过滤示例：**
 ```
-/google                        # Search for "google" anywhere
-/port:443                      # Filter by port
-/process:firefox               # Filter by process
-/state:established             # Filter by connection state
-/dport:443 sni:github.com      # Combine filters
+/google                        # 全局搜索 "google"
+/port:443                      # 按端口过滤
+/process:firefox               # 按进程过滤
+/state:established             # 按连接状态过滤
+/dport:443 sni:github.com      # 组合多个过滤条件
 ```

-**Sorting:**
- Press `s` to cycle through sortable columns (Process, Addresses, Service, Application, State, Bandwidth)
- Press `S` (Shift+s) to toggle sort direction
- Find bandwidth hogs: Press `s` until "Bandwidth Total ↓" appears (sorts by combined up+down speed)
+**排序：**
+- 按 `s` 在可排序的列之间循环切换(进程、地址、服务、应用、状态、带宽)
+- 按 `S`(Shift+s)切换升序 / 降序
+- 想抓出带宽大户：连续按 `s` 直到显示 "Bandwidth Total ↓"(按上下行合计速度排序)

-See [USAGE.md](USAGE.md) for complete filtering syntax and sorting guide.
+完整的过滤语法与排序说明见 [USAGE.zh-CN.md](USAGE.zh-CN.md)。

 <details>
-<summary><b>Advanced Filtering Examples</b></summary>
+<summary><b>高级过滤示例</b></summary>

-**Keyword filters:**
- `port:44` - Ports containing "44" (443, 8080, 4433)
- `sport:80` - Source ports containing "80"
- `dport:443` - Destination ports containing "443"
- `src:192.168` - Source IPs containing "192.168"
- `dst:github.com` - Destinations containing "github.com"
- `process:ssh` - Process names containing "ssh"
- `sni:api` - SNI hostnames containing "api"
- `app:openssh` - SSH connections using OpenSSH
- `state:established` - Filter by protocol state
- `proto:tcp` - Filter by protocol type
+**关键字过滤：**
+- `port:44` —— 端口号包含 "44" 的连接(443、8080、4433)
+- `sport:80` —— 源端口包含 "80"
+- `dport:443` —— 目的端口包含 "443"
+- `src:192.168` —— 源 IP 包含 "192.168"
+- `dst:github.com` —— 目的地址包含 "github.com"
+- `process:ssh` —— 进程名包含 "ssh"
+- `sni:api` —— SNI 主机名包含 "api"
+- `app:openssh` —— 使用 OpenSSH 的 SSH 连接
+- `state:established` —— 按协议状态过滤
+- `proto:tcp` —— 按协议类型过滤

-**State filtering:**
- `state:syn_recv` - Half-open connections (SYN flood detection)
- `state:established` - Established connections only
- `state:quic_connected` - Active QUIC connections
- `state:dns_query` - DNS query connections
+**状态过滤：**
+- `state:syn_recv` —— 半开连接(可用于发现 SYN flood)
+- `state:established` —— 仅显示已建立的连接
+- `state:quic_connected` —— 活跃的 QUIC 连接
+- `state:dns_query` —— DNS 查询连接

-**Combined examples:**
- `sport:80 process:nginx` - Nginx connections from port 80
- `dport:443 sni:google.com` - HTTPS to Google
- `process:firefox state:quic_connected` - Firefox QUIC connections
- `dport:22 app:openssh state:established` - Established OpenSSH connections
+**组合示例：**
+- `sport:80 process:nginx` —— Nginx 从 80 端口发出的连接
+- `dport:443 sni:google.com` —— 到 Google 的 HTTPS
+- `process:firefox state:quic_connected` —— Firefox 的 QUIC 连接
+- `dport:22 app:openssh state:established` —— 已建立的 OpenSSH 连接

 </details>

 <details>
-<summary><b>Connection Lifecycle & Visual Indicators</b></summary>
+<summary><b>连接生命周期与可视化指示</b></summary>

-RustNet uses smart timeouts and visual warnings before removing connections:
+RustNet 在移除连接前会先用智能超时机制与颜色给出预警：

-**Visual staleness indicators:**
- **White**: Active (< 75% of timeout)
- **Yellow**: Stale (75-90% of timeout)
- **Red**: Critical (> 90% of timeout)
+**过期程度的颜色指示：**
+- **白色**：活跃(< 75% 的超时时间)
+- **黄色**：开始过期(75% – 90% 的超时时间)
+- **红色**：即将过期(> 90% 的超时时间)

-**Protocol-aware timeouts:**
- **HTTP/HTTPS**: 10 minutes (supports keep-alive)
- **SSH**: 30 minutes (long sessions)
- **TCP active**: 10 minutes, idle: 5 minutes
- **QUIC connected**: 3 minutes (or peer's transport-param idle timeout, when present); `Initial`/`Handshaking`: 60 seconds
- **DNS**: 30 seconds
- **TCP CLOSED**: 5 seconds
+**按协议设定的超时：**
+- **HTTP / HTTPS**：10 分钟(支持 keep-alive)
+- **SSH**：30 分钟(适配长会话)
+- **TCP 活跃**：10 分钟；**TCP 空闲**：5 分钟
+- **QUIC 已连接**：3 分钟(若对端通过 transport 参数声明了 idle timeout，则以对端为准);`Initial` / `Handshaking` 阶段：60 秒
+- **DNS**：30 秒
+- **TCP CLOSED**：5 秒

-Example: An HTTP connection turns yellow at 7.5 min, red at 9 min, and is removed at 10 min.
+举例：一条 HTTP 连接会在第 7.5 分钟变黄，第 9 分钟变红，第 10 分钟被移除。

-See [USAGE.md](USAGE.md) for complete timeout details.
+完整超时说明见 [USAGE.zh-CN.md](USAGE.zh-CN.md)。

 </details>

-## Documentation
+## 文档

- **[INSTALL.md](INSTALL.md)** - Detailed installation instructions for all platforms, permission setup, and troubleshooting
- **[USAGE.md](USAGE.md)** - Complete usage guide including command-line options, filtering, sorting, and logging
- **[SECURITY.md](SECURITY.md)** - Security features including Landlock sandboxing and privilege management
- **[ARCHITECTURE.md](ARCHITECTURE.md)** - Technical architecture, platform implementations, and performance details
- **[PROFILING.md](PROFILING.md)** - Performance profiling guide with flamegraph setup and optimization tips
- **[ROADMAP.md](ROADMAP.md)** - Planned features and future improvements
- **[RELEASE.md](RELEASE.md)** - Release process for maintainers
+- **[INSTALL.zh-CN.md](INSTALL.zh-CN.md)** —— 各平台的详细安装说明、权限配置与排障
+- **[USAGE.zh-CN.md](USAGE.zh-CN.md)** —— 完整使用手册，涵盖命令行参数、过滤、排序与日志
+- **[SECURITY.zh-CN.md](SECURITY.zh-CN.md)** —— 安全特性，包括 Landlock 沙箱与权限管理
+- **[ARCHITECTURE.zh-CN.md](ARCHITECTURE.zh-CN.md)** —— 技术架构、各平台实现与性能细节
+- **[CONTRIBUTING.zh-CN.md](CONTRIBUTING.zh-CN.md)** —— 贡献指南，包括工作流、质量要求与 AI 辅助贡献规范
+- **[PROFILING.zh-CN.md](PROFILING.zh-CN.md)** —— 性能分析指南，含 flamegraph 配置与优化建议
+- **[ROADMAP.md](ROADMAP.md)** —— 已规划的功能与后续改进
+- **[RELEASE.md](RELEASE.md)** —— 维护者发布流程

-## Contributing
+## 参与贡献

-Contributions are welcome! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines on how to contribute.
+欢迎贡献！请阅读 [CONTRIBUTING.zh-CN.md](CONTRIBUTING.zh-CN.md) 了解贡献流程。

-See [CONTRIBUTORS.md](CONTRIBUTORS.md) for a list of people who have contributed to this project.
+历来的贡献者名单见 [CONTRIBUTORS.md](CONTRIBUTORS.md)。

-## License
+## 许可证

-This project is licensed under the Apache License, Version 2.0 - see the [LICENSE](LICENSE) file for details.
+本项目采用 Apache License 2.0 许可证，详见 [LICENSE](LICENSE) 文件。

-## Acknowledgments
+## 致谢

- Built with [ratatui](https://github.com/ratatui-org/ratatui) for the terminal UI
- Packet capture powered by [libpcap](https://www.tcpdump.org/)
- Inspired by tools like `tshark/wireshark/tcpdump`, `sniffnet`, `netstat`, `ss`, `iftop`, and [bandwhich](https://github.com/imsnif/bandwhich)
- Some code is vibe coded (OMG) / may the LLM gods be with you
+- 终端 UI 基于 [ratatui](https://github.com/ratatui-org/ratatui) 构建
+- 抓包能力由 [libpcap](https://www.tcpdump.org/) 提供
+- 灵感来自 `tshark/wireshark/tcpdump`、`sniffnet`、`netstat`、`ss`、`iftop`，以及 [bandwhich](https://github.com/imsnif/bandwhich)
+- 部分代码靠手感写出(OMG)/ 愿 LLM 之神与你同在

 ---

-## Documentation Moved
+## 已迁移的文档

-Some sections have been moved to dedicated files for better organization:
+部分章节已迁移到独立文件，以便更好地组织内容：

- **Permissions Setup**: Now in [INSTALL.md - Permissions Setup](INSTALL.md#permissions-setup)
- **Installation Instructions**: Now in [INSTALL.md](INSTALL.md)
- **Detailed Usage**: Now in [USAGE.md](USAGE.md)
- **Architecture Details**: Now in [ARCHITECTURE.md](ARCHITECTURE.md)
+- **权限配置**：迁移至 [INSTALL.zh-CN.md 的权限配置章节](INSTALL.zh-CN.md#permissions-setup)
+- **安装说明**：迁移至 [INSTALL.zh-CN.md](INSTALL.zh-CN.md)
+- **详细用法**：迁移至 [USAGE.zh-CN.md](USAGE.zh-CN.md)
+- **架构细节**：迁移至 [ARCHITECTURE.zh-CN.md](ARCHITECTURE.zh-CN.md)