diff --git a/README.md b/README.md index ddeb371..6d0f8f6 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,13 @@ + +> [!NOTE] +> 本文档由 WeHub 基于上游 README 翻译整理，属于社区翻译，非官方中文文档。 +> [English](./README.en.md) · [原始项目](https://github.com/domcyrus/rustnet) · [上游 README](https://github.com/domcyrus/rustnet/blob/HEAD/README.md) +> 原作者、版权与许可证归属以原始项目及本仓库 LICENSE 文件为准。 +

RustNet

- Per-process network monitoring for your terminal: live TCP, UDP, and QUIC connections with deep packet inspection, sandboxed by default. + 面向终端的进程级网络监控工具：实时呈现 TCP、UDP、QUIC 连接，自带深度包检测，默认沙箱隔离运行。

Built With Ratatui @@ -15,7 +21,7 @@

- English | 简体中文 + English | 简体中文

@@ -23,115 +29,113 @@

- Real-time visibility into every connection your machine makes, who owns it, and what protocol it's speaking. No tcpdump, X11 forwarding, or root piping. + 实时洞察机器对外发起的每一条连接：谁在使用它、走的是什么协议。无需 tcpdump，无需 X11 转发，也不必把 root 权限传递下去。

-## Features +## 功能特性 -- **Per-process attribution**: Every TCP, UDP, and QUIC connection mapped to its owning process, via eBPF on Linux, PKTAP on macOS, native APIs on Windows and FreeBSD. Wireshark and tcpdump can't do this; `netstat` / `ss` can't show live state. -- **Deep packet inspection**: Identify HTTP, HTTPS/TLS with SNI, DNS, SSH, FTP, QUIC, MQTT, BitTorrent, STUN, NTP, mDNS, LLMNR, DHCP, SNMP, SSDP, and NetBIOS, without external dissectors. -- **Annotated PCAPNG export**: `--pcapng-export` writes a Wireshark-ready capture with process, PID, direction, DPI/SNI, and GeoIP embedded as per-packet comments. Open it in Wireshark and every packet already names its owning process, with no post-processing. Classic `--pcap-export` with a JSONL sidecar for offline correlation is also available. -- **Security sandboxing**: Landlock (Linux 5.13+), Seatbelt (macOS), token privilege drop + job-object child-process block (Windows). Drops privileges immediately after libpcap initializes. See [SECURITY.md](SECURITY.md). -- **TCP network analytics**: Real-time retransmissions, out-of-order packets, and fast-retransmit detection, per-connection and aggregate. -- **Smart connection lifecycle**: Protocol-aware timeouts with white → yellow → red staleness indicators. Toggle `t` to keep historic (closed) connections visible for forensics. -- **Vim/fzf-style filtering**: `port:`, `src:`, `dst:`, `sni:`, `process:`, `state:`, `proto:`, plus regex via `/(?i)pattern/`. -- **GeoIP enrichment**: Country lookups via local MaxMind GeoLite2. No network calls. -- **Kubernetes attribution** (optional `kubernetes` feature): connections mapped to their pod, namespace, and container, shown in the details pane, JSON/PCAPNG exports, and the `pod:`, `ns:`, `container:` filters. Enabled in the official Docker image; on a cluster, use the [kubectl-rustnet](https://github.com/domcyrus/kubectl-rustnet) plugin to run it as an ephemeral debug pod. See [USAGE.md](USAGE.md#--kubernetes-mode-optional-feature). -- **Cross-platform**: Linux, macOS, Windows, FreeBSD. +- **进程级归属识别**：每一条 TCP、UDP、QUIC 连接都能追溯到所属进程。Linux 使用 eBPF，macOS 使用 PKTAP，Windows 与 FreeBSD 则走原生 API。Wireshark 与 tcpdump 做不到这一点；`netstat` / `ss` 也无法展示实时状态。 +- **深度包检测**：无需外部解析器即可识别 HTTP、带 SNI 的 HTTPS/TLS、DNS、SSH、FTP、QUIC、MQTT、BitTorrent、STUN、NTP、mDNS、LLMNR、DHCP、SNMP、SSDP 及 NetBIOS。 +- **安全沙箱**：Linux 5.13+ 使用 Landlock，macOS 使用 Seatbelt，Windows 通过 token 降权 + job-object 阻止子进程创建。libpcap 初始化完成后立即丢弃特权。详见 [SECURITY.zh-CN.md](SECURITY.zh-CN.md)。 +- **TCP 网络分析**：实时统计重传、乱序包、快重传，既有逐连接视图也有汇总视图。 +- **智能连接生命周期**：按协议设置超时，以白 → 黄 → 红的颜色指示过期程度。按 `t` 可保留历史（已关闭）连接以便事后追溯。 +- **Vim / fzf 风格过滤**：支持 `port:`、`src:`、`dst:`、`sni:`、`process:`、`state:`、`proto:`，以及 `/(?i)pattern/` 形式的正则。 +- **GeoIP 增强**：基于本地 MaxMind GeoLite2 数据库查询国家信息，不发起任何网络请求。 +- **跨平台**：Linux、macOS、Windows、FreeBSD。 -## Why RustNet? +## 为什么选 RustNet？ -RustNet fills the gap between simple connection tools (`netstat`, `ss`) and packet analyzers (`Wireshark`, `tcpdump`): +RustNet 填补了简单连接工具(`netstat`、`ss`)与数据包分析器(`Wireshark`、`tcpdump`)之间的空白： -- **Process attribution**: See which application owns each connection. Wireshark cannot provide this because it only sees packets, not sockets. -- **Connection-centric view**: Track states, bandwidth, and protocols per connection in real-time -- **SSH-friendly**: TUI works over SSH so you can quickly see what's happening on a remote server without forwarding X11 or capturing traffic +- **进程归属**：看清每条连接归哪个应用所有。Wireshark 看不到这一层，因为它只看包，不看 socket。 +- **以连接为中心的视图**：逐连接实时追踪状态、带宽与协议。 +- **SSH 友好**：TUI 可直接在 SSH 会话中运行，远端服务器上发生了什么一眼可见，不必转发 X11 或抓包再回传。 -RustNet complements packet capture tools. Use RustNet to see *what's making connections*. For direct Wireshark inspection, `--pcapng-export` writes live best-effort packet comments with PID/process context. For cleanup-time correlation, use `--pcap-export` plus the JSONL sidecar and optional `scripts/pcap_enrich.py`. See [PCAP Export](USAGE.md#pcap-export) and [Comparison with Similar Tools](ARCHITECTURE.md#comparison-with-similar-tools) for details. +RustNet 与抓包工具是互补关系。用 RustNet 看清*谁在发起连接*；若要直接在 Wireshark 中查看，可用 `--pcapng-export` 写出带 RustNet 数据包注释的 PCAPNG；若更重视清理阶段的元数据完整性，可用 `--pcap-export` 加 JSONL sidecar，再借 `scripts/pcap_enrich.py` 富化。参见 [USAGE.zh-CN.md 的 PCAP 导出章节](USAGE.zh-CN.md#pcap-export) 与 [ARCHITECTURE.zh-CN.md 的同类工具对比章节](ARCHITECTURE.zh-CN.md#comparison-with-similar-tools)。 -Built on ratatui, libpcap, eBPF (libbpf-rs), DashMap, crossbeam, ring, MaxMind GeoLite2, and Landlock. See [ARCHITECTURE.md](ARCHITECTURE.md#dependencies) for the full dependency breakdown. +基于 ratatui、libpcap、eBPF(libbpf-rs)、DashMap、crossbeam、ring、MaxMind GeoLite2 与 Landlock 构建。完整依赖清单见 [ARCHITECTURE.zh-CN.md](ARCHITECTURE.zh-CN.md#dependencies)。
-eBPF Enhanced Process Identification (Linux Default) +基于 eBPF 的增强型进程识别(Linux 默认) -RustNet uses kernel eBPF programs by default on Linux for enhanced performance and lower overhead process identification. However, this comes with important limitations: +RustNet 在 Linux 上默认使用内核 eBPF 程序进行进程识别，从而获得更高的性能与更低的开销。但这种方式也有一些重要的限制需要了解： -**Process Name Limitations:** -- eBPF uses the kernel's `comm` field, which is limited to 16 characters -- Shows the task/thread command name, not the full executable path -- Multi-threaded applications often show thread names instead of the main process name +**进程名长度限制：** +- eBPF 使用内核的 `comm` 字段，该字段最多只有 16 个字符 +- 显示的是任务 / 线程的命令名，而非完整的可执行路径 +- 多线程应用往往展示线程名而非主进程名 -**Real-world Examples:** -- **Firefox**: May appear as "Socket Thread", "Web Content", "Isolated Web Co", or "MainThread" -- **Chrome**: May appear as "ThreadPoolForeg", "Chrome_IOThread", "BrokerProcess", or "SandboxHelper" -- **Electron apps**: Often show as "electron", "node", or internal thread names -- **System processes**: Show truncated names like "systemd-resolve" → "systemd-resolve" +**真实场景示例：** +- **Firefox**：可能显示为 "Socket Thread"、"Web Content"、"Isolated Web Co" 或 "MainThread" +- **Chrome**：可能显示为 "ThreadPoolForeg"、"Chrome_IOThread"、"BrokerProcess" 或 "SandboxHelper" +- **Electron 应用**：经常显示为 "electron"、"node" 或内部线程名 +- **系统进程**：展示截断后的名字，如 "systemd-resolve" → "systemd-resolve" -**Fallback Behavior:** -- When eBPF fails to load or lacks sufficient permissions, RustNet automatically falls back to standard procfs-based process identification -- Standard mode provides full process names but with higher CPU overhead -- eBPF is enabled by default; no special build flags needed +**回退行为：** +- 当 eBPF 加载失败或权限不足时，RustNet 会自动回退到基于 procfs 的标准进程识别方式 +- 标准模式可以拿到完整进程名，但 CPU 开销更高 +- eBPF 默认启用，无需任何特殊编译参数 -To disable eBPF and use procfs-only mode, build with: +如需关闭 eBPF、仅使用 procfs 模式，请这样构建： ```bash cargo build --release --no-default-features ``` -See [ARCHITECTURE.md](ARCHITECTURE.md) for technical information. +技术细节见 [ARCHITECTURE.zh-CN.md](ARCHITECTURE.zh-CN.md)。
-Interface Statistics Monitoring +网络接口统计监控 -RustNet provides real-time network interface statistics across all supported platforms: +RustNet 在所有支持的平台上提供实时的网络接口统计： -- **Overview Tab**: Shows active interfaces with current rates, errors, and drops -- **Interfaces Tab** (press `3`): Detailed table with comprehensive metrics for all interfaces -- **Cross-Platform**: Linux (sysfs), macOS/FreeBSD (getifaddrs), Windows (GetIfTable2 API) -- **Smart Filtering**: Windows automatically excludes virtual/filter adapters +- **概览标签页**：展示当前活跃的接口，包含速率、错误数与丢包数 +- **接口标签页**(按 `3`)：以详细表格呈现各接口的完整指标 +- **跨平台**：Linux(sysfs)、macOS / FreeBSD(getifaddrs)、Windows(GetIfTable2 API) +- **智能过滤**：Windows 上自动剔除虚拟 / 过滤类适配器 -See [USAGE.md](USAGE.md#interface-statistics) for detailed documentation on interpreting interface statistics and platform-specific behavior. +如何解读接口统计以及各平台的差异，详见 [USAGE.zh-CN.md](USAGE.zh-CN.md#interface-statistics)。 -**Metrics Available:** -- Total bytes and packets (RX/TX) -- Error counters (receive and transmit) -- Packet drops (queue overflows) -- Collisions (legacy, rarely used on modern networks) +**可用指标：** +- 总字节数与包数(RX / TX) +- 错误计数(收 / 发) +- 丢包数(队列溢出) +- 冲突数(传统指标，现代网络中很少出现) -Stats are collected every 2 seconds in a background thread with minimal performance impact. +数据由后台线程每 2 秒采集一次，对性能影响极小。
-## Screenshots +## 截图 - - + + - - + +
Overview
Connections table with live stats and sparklines
Details
Per-connection SNI, cipher, GeoIP, DPI
概览
连接列表与实时统计、迷你折线图
详情
逐连接展示 SNI、加密套件、GeoIP、DPI
Graph
Traffic chart, app distribution, top processes
Interfaces
Per-interface RX/TX history with errors and drops
图表
流量曲线、应用分布、Top 进程
接口
各接口 RX / TX 历史曲线、错误与丢包
-## Quick Start +## 快速上手 -### Installation +### 安装 -**Homebrew (macOS / Linux):** +**Homebrew(macOS / Linux):** ```bash brew install rustnet ``` -**Ubuntu (25.10+):** +**Ubuntu(25.10+):** ```bash sudo add-apt-repository ppa:domcyrus/rustnet sudo apt update && sudo apt install rustnet ``` -**Fedora (42+):** +**Fedora(42+):** ```bash sudo dnf copr enable domcyrus/rustnet sudo dnf install rustnet @@ -152,189 +156,188 @@ sudo pacman -S rustnet **Nix / NixOS:** ```bash nix-shell -p rustnet -# Then inside the shell: sudo rustnet +# 然后在 shell 中执行: sudo rustnet ``` -**From crates.io:** +**通过 crates.io:** ```bash cargo install rustnet-monitor ``` -**Windows (Chocolatey):** +**Windows(Chocolatey):** ```powershell -# Run in Administrator PowerShell -# Requires Npcap (https://npcap.com) installed with "WinPcap API-compatible Mode" enabled +# 需在管理员权限的 PowerShell 中执行 +# 需要先安装 Npcap(https://npcap.com)，并启用 "WinPcap API-compatible Mode" choco install rustnet ``` -**Other platforms:** -- **FreeBSD**: Download from [rustnet-bsd releases](https://github.com/domcyrus/rustnet-bsd/releases) -- **Docker, source builds, other Linux distros**: See [INSTALL.md](INSTALL.md) for detailed instructions +**其他平台：** +- **FreeBSD**：从 [rustnet-bsd releases](https://github.com/domcyrus/rustnet-bsd/releases) 下载 +- **Docker、源码构建、其他 Linux 发行版**：详见 [INSTALL.zh-CN.md](INSTALL.zh-CN.md) -### Running RustNet +### 运行 RustNet -Packet capture requires elevated privileges: +抓包需要更高的权限： ```bash -# Quick start (all platforms) +# 快速启动(所有平台) sudo rustnet -# Linux: Grant capabilities to run without sudo (recommended) +# Linux：为可执行文件赋予 Linux capabilities，即可免 sudo 运行(推荐) sudo setcap 'cap_net_raw,cap_bpf,cap_perfmon+eip' $(which rustnet) rustnet ``` -**Common options:** +**常用参数：** ```bash -rustnet -i eth0 # Specify network interface -rustnet --show-localhost # Show localhost connections -rustnet --no-resolve-dns # Disable reverse DNS lookups (enabled by default) -rustnet -r 500 # Set refresh interval (ms) -rustnet --theme classic # Original full-color palette (default: muted) -rustnet --pcapng-export capture.pcapng # Annotated PCAPNG for Wireshark +rustnet -i eth0 # 指定网络接口 +rustnet --show-localhost # 显示 localhost 上的连接 +rustnet --no-resolve-dns # 关闭反向 DNS 解析(默认开启) +rustnet -r 500 # 设置刷新间隔(毫秒) +rustnet --theme classic # 原始全彩调色板(默认：muted) +rustnet --pcapng-export capture.pcapng # 导出带注释的 PCAPNG ``` -See [INSTALL.md](INSTALL.md) for detailed permission setup and [USAGE.md](USAGE.md) for complete options. +权限配置详情见 [INSTALL.zh-CN.md](INSTALL.zh-CN.md)，完整参数说明见 [USAGE.zh-CN.md](USAGE.zh-CN.md)。 -> If you set capabilities but the TUI still shows `eBPF unavailable`, see -> [eBPF Unavailable Despite Capabilities Being Set](INSTALL.md#ebpf-unavailable-despite-capabilities-being-set) -> in the troubleshooting section. +> 如果已经设置了 Linux capabilities，但 TUI 仍然提示 `eBPF unavailable`，请参阅 [INSTALL.zh-CN.md 的排障章节](INSTALL.zh-CN.md#ebpf-unavailable-despite-capabilities-being-set)。 -## Keyboard Controls +## 键盘控制 -| Key | Action | +| 按键 | 作用 | |-----|--------| -| `q` | Quit (press twice to confirm) | -| `Ctrl+C` | Quit immediately | -| `x` | Clear all connections (press twice to confirm) | -| `Tab` or `]` | Next tab | -| `Shift+Tab` or `[` | Previous tab | -| `1`–`5` | Jump to Overview / Details / Interfaces / Graph / Help | -| `↑/k` `↓/j` | Navigate up/down | -| `g` `G` | Jump to first/last connection | -| `Enter` | View connection details | -| `Esc` | Go back or clear filter | -| `c` | Copy remote address | -| `p` | Toggle service names/ports | -| `d` | Toggle hostnames/IPs | -| `s` `S` | Cycle sort columns / toggle direction | -| `a` | Toggle process grouping | -| `Space` | Expand/collapse process group | -| `←/→` or `h/l` | Collapse/expand group | -| `PageUp/PageDown` or `Ctrl+B/F` | Page navigation | -| `t` | Toggle historic (closed) connections | -| `i` | Toggle the System info sidebar | -| `r` | Reset view (grouping, sort, filter) | -| `/` | Enter filter mode | -| `h` | Toggle help | +| `q` | 退出(连按两次确认) | +| `Ctrl+C` | 立即退出 | +| `x` | 清空所有连接(连按两次确认) | +| `Tab` 或 `]` | 下一个标签页 | +| `Shift+Tab` 或 `[` | 上一个标签页 | +| `1`–`5` | 直接跳转到 Overview / Details / Interfaces / Graph / Help | +| `↑/k` `↓/j` | 上下移动 | +| `g` `G` | 跳到第一条 / 最后一条连接 | +| `Enter` | 查看连接详情 | +| `Esc` | 返回或清除过滤器 | +| `c` | 复制远端地址 | +| `p` | 在服务名与端口之间切换 | +| `d` | 在主机名与 IP 之间切换 | +| `s` `S` | 切换排序列 / 切换排序方向 | +| `a` | 切换按进程分组 | +| `Space` | 展开 / 折叠进程分组 | +| `←/→` 或 `h/l` | 折叠 / 展开当前分组 | +| `PageUp/PageDown` 或 `Ctrl+B/F` | 翻页 | +| `t` | 切换是否显示历史（已关闭）连接 | +| `i` | 切换 System 信息侧边栏 | +| `r` | 重置视图(分组、排序、过滤) | +| `/` | 进入过滤模式 | +| `h` | 切换帮助 | -See [USAGE.md](USAGE.md) for detailed keyboard controls and navigation tips. +完整键位说明与导航技巧见 [USAGE.zh-CN.md](USAGE.zh-CN.md)。 -## Filtering & Sorting +## 过滤与排序 -**Quick filtering examples:** +**快速过滤示例：** ``` -/google # Search for "google" anywhere -/port:443 # Filter by port -/process:firefox # Filter by process -/state:established # Filter by connection state -/dport:443 sni:github.com # Combine filters +/google # 全局搜索 "google" +/port:443 # 按端口过滤 +/process:firefox # 按进程过滤 +/state:established # 按连接状态过滤 +/dport:443 sni:github.com # 组合多个过滤条件 ``` -**Sorting:** -- Press `s` to cycle through sortable columns (Process, Addresses, Service, Application, State, Bandwidth) -- Press `S` (Shift+s) to toggle sort direction -- Find bandwidth hogs: Press `s` until "Bandwidth Total ↓" appears (sorts by combined up+down speed) +**排序：** +- 按 `s` 在可排序的列之间循环切换(进程、地址、服务、应用、状态、带宽) +- 按 `S`(Shift+s)切换升序 / 降序 +- 想抓出带宽大户：连续按 `s` 直到显示 "Bandwidth Total ↓"(按上下行合计速度排序) -See [USAGE.md](USAGE.md) for complete filtering syntax and sorting guide. +完整的过滤语法与排序说明见 [USAGE.zh-CN.md](USAGE.zh-CN.md)。
-Advanced Filtering Examples +高级过滤示例 -**Keyword filters:** -- `port:44` - Ports containing "44" (443, 8080, 4433) -- `sport:80` - Source ports containing "80" -- `dport:443` - Destination ports containing "443" -- `src:192.168` - Source IPs containing "192.168" -- `dst:github.com` - Destinations containing "github.com" -- `process:ssh` - Process names containing "ssh" -- `sni:api` - SNI hostnames containing "api" -- `app:openssh` - SSH connections using OpenSSH -- `state:established` - Filter by protocol state -- `proto:tcp` - Filter by protocol type +**关键字过滤：** +- `port:44` —— 端口号包含 "44" 的连接(443、8080、4433) +- `sport:80` —— 源端口包含 "80" +- `dport:443` —— 目的端口包含 "443" +- `src:192.168` —— 源 IP 包含 "192.168" +- `dst:github.com` —— 目的地址包含 "github.com" +- `process:ssh` —— 进程名包含 "ssh" +- `sni:api` —— SNI 主机名包含 "api" +- `app:openssh` —— 使用 OpenSSH 的 SSH 连接 +- `state:established` —— 按协议状态过滤 +- `proto:tcp` —— 按协议类型过滤 -**State filtering:** -- `state:syn_recv` - Half-open connections (SYN flood detection) -- `state:established` - Established connections only -- `state:quic_connected` - Active QUIC connections -- `state:dns_query` - DNS query connections +**状态过滤：** +- `state:syn_recv` —— 半开连接(可用于发现 SYN flood) +- `state:established` —— 仅显示已建立的连接 +- `state:quic_connected` —— 活跃的 QUIC 连接 +- `state:dns_query` —— DNS 查询连接 -**Combined examples:** -- `sport:80 process:nginx` - Nginx connections from port 80 -- `dport:443 sni:google.com` - HTTPS to Google -- `process:firefox state:quic_connected` - Firefox QUIC connections -- `dport:22 app:openssh state:established` - Established OpenSSH connections +**组合示例：** +- `sport:80 process:nginx` —— Nginx 从 80 端口发出的连接 +- `dport:443 sni:google.com` —— 到 Google 的 HTTPS +- `process:firefox state:quic_connected` —— Firefox 的 QUIC 连接 +- `dport:22 app:openssh state:established` —— 已建立的 OpenSSH 连接
-Connection Lifecycle & Visual Indicators +连接生命周期与可视化指示 -RustNet uses smart timeouts and visual warnings before removing connections: +RustNet 在移除连接前会先用智能超时机制与颜色给出预警： -**Visual staleness indicators:** -- **White**: Active (< 75% of timeout) -- **Yellow**: Stale (75-90% of timeout) -- **Red**: Critical (> 90% of timeout) +**过期程度的颜色指示：** +- **白色**：活跃(< 75% 的超时时间) +- **黄色**：开始过期(75% – 90% 的超时时间) +- **红色**：即将过期(> 90% 的超时时间) -**Protocol-aware timeouts:** -- **HTTP/HTTPS**: 10 minutes (supports keep-alive) -- **SSH**: 30 minutes (long sessions) -- **TCP active**: 10 minutes, idle: 5 minutes -- **QUIC connected**: 3 minutes (or peer's transport-param idle timeout, when present); `Initial`/`Handshaking`: 60 seconds -- **DNS**: 30 seconds -- **TCP CLOSED**: 5 seconds +**按协议设定的超时：** +- **HTTP / HTTPS**：10 分钟(支持 keep-alive) +- **SSH**：30 分钟(适配长会话) +- **TCP 活跃**：10 分钟；**TCP 空闲**：5 分钟 +- **QUIC 已连接**：3 分钟(若对端通过 transport 参数声明了 idle timeout，则以对端为准);`Initial` / `Handshaking` 阶段：60 秒 +- **DNS**：30 秒 +- **TCP CLOSED**：5 秒 -Example: An HTTP connection turns yellow at 7.5 min, red at 9 min, and is removed at 10 min. +举例：一条 HTTP 连接会在第 7.5 分钟变黄，第 9 分钟变红，第 10 分钟被移除。 -See [USAGE.md](USAGE.md) for complete timeout details. +完整超时说明见 [USAGE.zh-CN.md](USAGE.zh-CN.md)。
-## Documentation +## 文档 -- **[INSTALL.md](INSTALL.md)** - Detailed installation instructions for all platforms, permission setup, and troubleshooting -- **[USAGE.md](USAGE.md)** - Complete usage guide including command-line options, filtering, sorting, and logging -- **[SECURITY.md](SECURITY.md)** - Security features including Landlock sandboxing and privilege management -- **[ARCHITECTURE.md](ARCHITECTURE.md)** - Technical architecture, platform implementations, and performance details -- **[PROFILING.md](PROFILING.md)** - Performance profiling guide with flamegraph setup and optimization tips -- **[ROADMAP.md](ROADMAP.md)** - Planned features and future improvements -- **[RELEASE.md](RELEASE.md)** - Release process for maintainers +- **[INSTALL.zh-CN.md](INSTALL.zh-CN.md)** —— 各平台的详细安装说明、权限配置与排障 +- **[USAGE.zh-CN.md](USAGE.zh-CN.md)** —— 完整使用手册，涵盖命令行参数、过滤、排序与日志 +- **[SECURITY.zh-CN.md](SECURITY.zh-CN.md)** —— 安全特性，包括 Landlock 沙箱与权限管理 +- **[ARCHITECTURE.zh-CN.md](ARCHITECTURE.zh-CN.md)** —— 技术架构、各平台实现与性能细节 +- **[CONTRIBUTING.zh-CN.md](CONTRIBUTING.zh-CN.md)** —— 贡献指南，包括工作流、质量要求与 AI 辅助贡献规范 +- **[PROFILING.zh-CN.md](PROFILING.zh-CN.md)** —— 性能分析指南，含 flamegraph 配置与优化建议 +- **[ROADMAP.md](ROADMAP.md)** —— 已规划的功能与后续改进 +- **[RELEASE.md](RELEASE.md)** —— 维护者发布流程 -## Contributing +## 参与贡献 -Contributions are welcome! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines on how to contribute. +欢迎贡献！请阅读 [CONTRIBUTING.zh-CN.md](CONTRIBUTING.zh-CN.md) 了解贡献流程。 -See [CONTRIBUTORS.md](CONTRIBUTORS.md) for a list of people who have contributed to this project. +历来的贡献者名单见 [CONTRIBUTORS.md](CONTRIBUTORS.md)。 -## License +## 许可证 -This project is licensed under the Apache License, Version 2.0 - see the [LICENSE](LICENSE) file for details. +本项目采用 Apache License 2.0 许可证，详见 [LICENSE](LICENSE) 文件。 -## Acknowledgments +## 致谢 -- Built with [ratatui](https://github.com/ratatui-org/ratatui) for the terminal UI -- Packet capture powered by [libpcap](https://www.tcpdump.org/) -- Inspired by tools like `tshark/wireshark/tcpdump`, `sniffnet`, `netstat`, `ss`, `iftop`, and [bandwhich](https://github.com/imsnif/bandwhich) -- Some code is vibe coded (OMG) / may the LLM gods be with you +- 终端 UI 基于 [ratatui](https://github.com/ratatui-org/ratatui) 构建 +- 抓包能力由 [libpcap](https://www.tcpdump.org/) 提供 +- 灵感来自 `tshark/wireshark/tcpdump`、`sniffnet`、`netstat`、`ss`、`iftop`，以及 [bandwhich](https://github.com/imsnif/bandwhich) +- 部分代码靠手感写出(OMG)/ 愿 LLM 之神与你同在 --- -## Documentation Moved +## 已迁移的文档 -Some sections have been moved to dedicated files for better organization: +部分章节已迁移到独立文件，以便更好地组织内容： -- **Permissions Setup**: Now in [INSTALL.md - Permissions Setup](INSTALL.md#permissions-setup) -- **Installation Instructions**: Now in [INSTALL.md](INSTALL.md) -- **Detailed Usage**: Now in [USAGE.md](USAGE.md) -- **Architecture Details**: Now in [ARCHITECTURE.md](ARCHITECTURE.md) +- **权限配置**：迁移至 [INSTALL.zh-CN.md 的权限配置章节](INSTALL.zh-CN.md#permissions-setup) +- **安装说明**：迁移至 [INSTALL.zh-CN.md](INSTALL.zh-CN.md) +- **详细用法**：迁移至 [USAGE.zh-CN.md](USAGE.zh-CN.md) +- **架构细节**：迁移至 [ARCHITECTURE.zh-CN.md](ARCHITECTURE.zh-CN.md)