wehub/domcyrus--rustnet
1
0
Fork 0
Code Issues Pull Requests Actions 1 Deployments Models Agent Notes Packages Projects Releases Wiki Activity
Files
main
domcyrus--rustnet/CHANGELOG.md
T
wehub-resource-sync 19dc5d82a0
Rust / build (push) Failing after 1s
Details
Rust / docker (push) Failing after 0s
Details
chore: import upstream snapshot with attribution
2026-07-13 12:29:44 +08:00

601 lines
35 KiB
Markdown
Raw Permalink Blame History

# Changelog
All notable changes to RustNet will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
## [Unreleased]
## [1.4.0] - 2026-06-16
This release redesigns the TUI around a calmer visual hierarchy and, under the hood,
splits RustNet into a Cargo workspace of reusable library crates. Many of the TUI ideas
came from a detailed UI review by [@joshka](https://github.com/joshka) (Ratatui
maintainer) on our showcase submission
([ratatui/ratatui-website#1118](https://github.com/ratatui/ratatui-website/pull/1118)) —
thanks for the thoughtful feedback!
### Added
- **Theme Presets**: New `--theme` flag. The default `muted` preset keeps a single
cyan accent and reserves color for signals (state changes, staleness, live
bandwidth) and addresses; `--theme classic` restores the previous full-color palette (#377)
- **System Sidebar Toggle**: The System panel now has a fixed width and can be
hidden with the `i` key (auto-hidden on narrow terminals) (#377)
- **Details Continuity Strip**: The Details tab opens with a mini connection table
of the selected row and its neighbors; `j`/`k` flips through them without leaving
the tab, following the grouped order when process grouping is enabled (#377)
- **Direct-Jump Tab Shortcuts**: Jump straight to a tab with keys `1`-`5`, with
bracket cycle aliases (#318, thanks @obchain)
- **Connection List Scrollbar**: A scrollbar appears on the connection list when it
overflows the viewport (#365)
- **FTP Deep Packet Inspection**: Detect the FTP control channel and extract command
and response metadata (#266, thanks @0xghost42)
- **DNS / mDNS / LLMNR Response IPs**: Populate `response_ips` from A/AAAA answer
records and extend the extraction to mDNS and LLMNR responses (#319, #333, #341, thanks @0xghost42)
- **Log Identity Banner**: Emit a program identity banner and the module target on
every log line for easier diagnostics (#320, thanks @0xghost42)
- **Landlock v6 IPC Scoping** (Linux): Best-effort Landlock that scopes abstract-socket
and signal IPC on kernels that support it, falling back gracefully on older ABIs (#363)
- **`no_new_privs` Always Set + cargo-deny**: Always set `no_new_privs` at startup, and
adopt `cargo-deny` for supply-chain and license auditing in CI (#382)
- **openSUSE OBS Release Pipeline**: Automated openSUSE Build Service releases (#356)
### Changed
- **Stable Column Layout**: Column widths depend only on the terminal width — they
no longer shift while scrolling. Narrow terminals hide low-priority columns
instead of truncating cells; wide terminals distribute the spare width so the
table spans the full screen with the bandwidth column flush right (#377)
- **Merged Proto/App Column**: The Protocol column is merged into Application
("TCP·HTTPS"), and the status-dot column is gone — staleness now lives entirely
in the row styling (#377)
- **Custom Tab Bar and Borderless Sections**: Numbered tab bar with an accent
underline, a single-line filter prompt, and section headers in place of the
border-box-around-everything look (#377)
- **Dependencies**: Routine dependency and GitHub Actions updates across the cycle
(Dependabot, ~18 PRs)
### Fixed
- **Process attribution for short-lived and multithreaded processes** (Linux):
eBPF socket tracking now records the process name (thread-group leader)
instead of the calling thread's name, so connections from e.g. firefox or dig
no longer show up as "Socket Thread" or "isc-net-0000"; PID-to-name
resolution reads `/proc/<pid>/comm` on demand instead of waiting for the
periodic scan; and new connections are enriched on a fast 250ms tick, so
process names appear almost immediately instead of after up to 2 seconds (#376)
- **DLT_NULL Link Layer**: Strip the 4-byte address-family header before parsing
DLT_NULL/loopback captures (#394, thanks @0xghost42)
- **Terminal Restore on Panic**: Restore the terminal via a chained panic hook so a
panic no longer leaves the terminal in raw mode (#364)
- **Scrollbar Thumb**: The scrollbar thumb now reaches the bottom at max scroll (#366)
- **Landlock `/sys` Access**: Allow read access to `/sys` so interface statistics work
under the Landlock sandbox (#370)
- **Filter Mode Backspace**: Handle raw backspace characters in filter mode (#335, thanks @iccccccccccccc)
- **eBPF Error Surfacing**: Classify libbpf errors and surface them in the TUI (#255, #258)
- **Native Builds**: Skip cross-compile library paths on native builds (#259)
- **RPM Packaging**: Own the directories and hicolor icon dirs the package creates, and
require `libcap-progs` on openSUSE so the `%post` `setcap` runs (#357, #358, #359, #360)
### Performance
- **Per-Packet Allocations**: Cut per-packet allocations and snapshot copy-on-write
copies on the hot path (#380)
- **Core Types**: Add `Protocol::as_str()` and drop per-row/per-filter `to_string`
allocations (#392, thanks @obchain)
- **Connection Table**: Borrow the process name in `process_text` instead of cloning (#390, thanks @obchain)
- **Sparklines / Parsers**: Single-allocation sparkline getters, fewer redundant
collects in the HTTP and SSH parsers, and removed redundant clones in the render path
and sandbox init (#339, #345, #355, thanks @obchain)
### Internal
- **Cargo Workspace Split**: RustNet is now a four-crate workspace — `rustnet-core`
(packet parsing, protocol/DPI types, link-layer, connection merging, DNS/GeoIP/OUI
lookups), `rustnet-capture` (libpcap/Npcap capture backend), `rustnet-host`
(per-connection process attribution), and the `rustnet-monitor` binary. The three
libraries are now published to crates.io alongside the binary (#367)
### Documentation
- **Simplified Chinese**: Added a Simplified Chinese README translation and translated
the rest of the docs, plus zh-CN openSUSE Tumbleweed install instructions
(#263 thanks @whtis, #277 thanks @luojiyin1987, #361)
- **Install / Packaging Docs**: Nix and NixOS instructions and nixpkgs/NixOS-module
notes, Homebrew core formula pointer, Repology packaging overview, a Mermaid
architecture diagram, and a PR template with tightened contributor guidelines
(#264, #270, #281, #285, #286, #311, #332, #369)
- **Ubuntu 26.04 (Resolute) PPA**: Added the Resolute PPA build (#254, #256)
### Contributors
Special thanks to the contributors in this release:
- [@0xghost42](https://github.com/0xghost42) — FTP DPI, DNS/mDNS/LLMNR response-IP
extraction, the log identity banner, the DLT_NULL fix, and many DPI/eBPF refactors
(#266, #278, #279, #289, #290, #307, #309, #319, #320, #333, #341, #394)
- [@obchain](https://github.com/obchain) — performance and allocation cleanups across
the DPI parsers, render path, and core types, plus direct-jump tab shortcuts
(#292, #294, #296, #301, #303, #317, #318, #327, #339, #345, #355, #390, #392)
- [@iccccccccccccc](https://github.com/iccccccccccccc) — raw backspace handling in filter mode (#335)
- [@whtis](https://github.com/whtis) (HaiTao Wu) — Simplified Chinese README translation (#263)
- [@luojiyin1987](https://github.com/luojiyin1987) (luo jiyin) — Simplified Chinese documentation translation (#277)
## [1.3.0] - 2026-05-05
The headline of this release is a major TUI refresh. The tabs, stats panel, and details view have all been redesigned, with new per-field colors, a status dot, and address scope labels making it easier to read connections at a glance.
### Added
- **TUI Revamp**: Redesigned tabs, stats panel, and details view (#239)
- **Per-field Colors and Status Dot**: New per-field colors, status dot, and magenta panel borders for at-a-glance readability (#241)
- **Address Scope Labels**: Remote addresses are tagged PUBLIC, PRIVATE, etc. in the connection list (#251)
- **Reverse DNS Resolution by Default**: Reverse DNS resolution is now enabled by default. Use the new `--no-resolve-dns` flag to opt out (#245)
### Fixed
- **Sandbox Info on Overview**: Show the full sandbox details on the overview tab (#250)
- **Search Scope and Status Bars**: Scope the `/` search to Overview and tidy the status bars (#229, #230)
- **QUIC Initial Packet Parser**: Bounds-check `token_len` in the Initial packet parser (#244)
- **QUIC Varint Parser**: Bounds-check varint lengths and isolate parser panics (#232)
- **Release Pipeline**: Fix the downstream trigger race and AUR token permissions (#223)
### Changed
- **Demo Recording Automation**: Automate VHS recording for the demo GIF and README screenshots (#247)
- **OUI Vendor Database**: Refreshed IEEE OUI vendor database (#242)
- **Dependencies**: Bumped `rand` (0.8.5 to 0.8.6), `openssl` (0.10.75 to 0.10.78), `zip`, `libbpf-cargo`, and other rust-dependencies and actions group updates (#224, #225, #226, #227, #231, #233, #234, #238, #240, #243)
### Documentation
- **Windows Sandbox Terminology**: Accurate Windows sandbox terminology and roadmap entry (#237)
- **README Polish**: README hero polish, metadata tune-up, and accuracy fixes (#236)
- **Crate and Module Docs**: Expanded crate and module docs and tuned metadata for discoverability (#235)
## [1.2.0] - 2026-04-09
### Added
- **Windows Restricted Token Sandbox**: Drop privileges at startup on Windows using a restricted process token (#206)
- **macOS Seatbelt Sandboxing**: Apply a Seatbelt sandbox profile at startup on macOS, later tightened to restrict filesystem and IPC access (#196, #203)
- **Linux Sandbox Hardening**: Drop Linux capabilities and clear the ambient capability set after startup (#208)
- **Process Privilege in UI**: Show whether a process is privileged in the security section of the TUI (#197)
- **Filter: Exact Port Matching and Regex Support**: Filter syntax supports exact port matches and regex patterns (#195)
- **VLAN Support in PKTAP and SLL/SLL2**: Parse VLAN tags in PKTAP and SLL/SLL2 capture formats (#202)
- **VLAN Header in Layer 3 Extraction**: Account for VLAN headers when extracting layer 3 data (#199, thanks @deepakpjose)
- **IGMP Protocol Parsing**: Recognize and parse IGMP traffic (#209, thanks @deepakpjose)
- **Process Name for Wildcard /proc/net/ Entries**: Resolve process names for wildcard (`0.0.0.0`/`::`) entries in `/proc/net/` (#218, thanks @deepakpjose)
- **CI Supply-Chain Hardening**: Pin GitHub Actions to commit SHAs and verify Npcap installer checksums (#210)
- **Architecture Roadmap**: Added workspace split and macOS privilege separation roadmap docs (#211)
### Fixed
- **Default Interface Selection**: Use the active routing table to pick the default interface (#194, thanks @l1a)
- **Root Detection on Unix**: Use `geteuid()` instead of `getuid()` to detect root (#192, thanks @DeepChirp)
- **Release Pipeline Reliability**: Improved release workflow reliability, gated downstream jobs on `publish-release`, added checksum verification to AUR updates, and documented the no-retag policy (2a38f2d, 795f7a1, 002eb55, 8403a0f)
- **FreeBSD CI Dispatch**: Restrict FreeBSD dispatch to manual triggers only (#201)
### Changed
- **CPU Efficiency Improvements**: Substantial reductions in CPU usage across hot paths — rate calculation moved from per-update to per-refresh (#220), timeouts avoided to improve CPU performance (#213), threads given meaningful names to aid profiling (#212), and allocations reduced in sorting and snapshot paths (#222). Big thanks to [@deepakpjose](https://github.com/deepakpjose) for driving the CPU-efficiency work (#213, #220, #212) — these changes make RustNet noticeably lighter on the CPU.
- **FreeBSD Platform Cleanup**: Refactored FreeBSD platform support code (#205)
- **Dependencies**: Bumped `zip` (8.2.0 → 8.3.0 → 8.5.0), `clap_mangen`, `docker/login-action`, and other rust-dependencies group updates (#198, #200, #214, #216, #219, #221)
- **OUI Vendor Database**: Refreshed IEEE OUI vendor database (#215)
### Contributors
Special thanks to the external contributors in this release:
- [@deepakpjose](https://github.com/deepakpjose) — CPU-efficiency improvements and additional features (#199, #209, #212, #213, #218, #220)
- [@l1a](https://github.com/l1a) — default interface selection via active routing table (#194)
- [@DeepChirp](https://github.com/DeepChirp) — Unix root detection via `geteuid()` (#192)
## [1.1.0] - 2026-03-16
### Added
- **OUI Vendor Lookup for ARP**: Display MAC vendor names for ARP connections using IEEE OUI database (#183)
- **Historic Connections Toggle**: Toggle to show/hide historic (closed) connections (#184)
- **Mouse Support**: Mouse interaction support for TUI navigation (#170)
- **Security Hardening & Packet Stats**: Enhanced security hardening and packet statistics display in TUI (#169)
- **GeoIP City Lookup**: Show city-level geolocation for remote IPs using GeoLite2 City database (#168)
- **Android Build Support**: Native Android builds with static musl linking (#167)
- **Multi-Arch Android Builds**: Added armv7, x86_64, and x86 Android static build targets
- **MQTT Protocol Detection**: Deep packet inspection for MQTT protocol traffic (#161)
- **STUN Traffic Detection**: Detect STUN protocol traffic per RFC 5389/8489 (#160)
- **BitTorrent Traffic Detection**: Detect BitTorrent protocol traffic (#159)
- **ARP Performance Benchmarks**: Added criterion benchmarks for ARP-related operations (#188)
### Fixed
- **Undefined Behavior Fix**: Fix UB issues, remove clippy suppressions, add safety documentation (#187)
- **Light Terminal Readability**: Fix selection highlight unreadable on light terminal themes (#182)
- **Clipboard Warning**: Fix unused variable warning in copy_to_clipboard across platforms (#178)
- **Android Cross-Compilation**: Fix cross-compilation and release upload issues for Android targets (#174)
- **MQTT Detection Accuracy**: Restrict MQTT signature detection to CONNECT packets only (#164)
### Changed
- **Documentation**: Synced docs with implementation, added missing keyboard shortcuts (#190, #157)
- **CI/CD**: Staged release pipeline so downstream jobs wait for builds (#154), added FreeBSD coverage to PR builds (#158)
- **Dependencies**: Bumped chrono, http_req, zip, and various rust-dependencies groups
## [1.0.0] - 2026-02-09
### Added
- **GeoIP Location Support**: Show country codes for remote IPs using GeoLite2 databases with auto-discovery (#151)
- **PCAP Export with Process Attribution**: Export captured packets to PCAP files with a process attribution JSONL sidecar for Wireshark enrichment (#137)
- **eBPF-based ICMP PID Tracking**: Track process IDs for ICMP connections using eBPF on Linux (#136)
- **Process Detection Degradation Warnings**: Show warnings in the UI when process detection falls back to a less accurate method (#128)
- **ARM64 Musl Static Builds**: CI now produces arm64 musl static Linux builds with eBPF support
### Fixed
- **Service Name Precedence**: Corrected ordering when multiple service name sources conflict (#150)
- **Pointer Dereference Safety**: Use `as_ref()` for safer pointer dereference in macOS/FreeBSD interface stats (#147)
- **Clippy Warnings**: Resolve `unnecessary_unwrap` errors flagged by clippy (#144)
- **ICMP Dead Code**: Remove dead code warning in ICMP handling (#138)
- **GitHub Actions Permissions**: Add explicit permissions to all GitHub Actions workflows (#131)
- **Logging Initialization**: Set up logging level before privileges check for earlier diagnostic output (#143)
### Changed
- **SSH Heuristic Tightened**: Tighten SSH packet structure heuristic to reduce false positives (#135)
- **CI Reusable Workflows**: Share build logic via reusable workflow, remove redundant test-static-builds workflow
- **Chocolatey Automation**: Trigger Chocolatey package publish on release automatically
- **Code Alignment**: Refactoring and code alignment improvements (#149)
- **Dependencies**: Updated libbpf-rs to 0.26, bumped clap, time, zip, lru, and libc
- **Documentation**: Clarified RustNet vs Wireshark positioning, added PowerShell font troubleshooting, added JSON logging to feature comparison, added bandwhich to acknowledgments (#129, #130, #132, #133)
## [0.18.0] - 2026-01-07
### Added
- **Process Grouping**: Expandable tree view to group connections by process (`a` to toggle grouping, `Space` to expand/collapse)
- **Traffic Visualization Graph Tab**: New Graph tab with real-time network traffic graphs and bandwidth visualization (press `Tab` to cycle through tabs)
- **Network Health Visualization**: Health indicators in Graph tab showing connection quality metrics
- **Reverse DNS Hostnames**: Display reverse DNS names in Details tab and filter PTR traffic (`--resolve-dns` to enable, `d` to toggle display)
- **BPF Filter Support**: New `--bpf-filter` option for custom packet capture filtering (e.g., `--bpf-filter "port 443"`)
- **Clear All Connections**: New hotkey (`x`) to clear all tracked connections
- **Enhanced JSON Logging**: Added pid, process_name, service_name fields to JSON log output
- **New DPI Protocols**: NTP, mDNS, LLMNR, DHCP, SNMP, SSDP, NetBIOS protocol detection with enhanced ARP display
- **Static Musl Builds**: Linux static binary builds using musl for better portability
- **Platform-Specific Help**: CLI help now shows platform-specific options
### Fixed
- **macOS BPF Filter**: Skip PKTAP when BPF filter is specified to avoid conflicts
- **Linux Clipboard**: Handle clipboard access blocked by Landlock sandbox gracefully
- **Interface Stats**: Use safer pointer dereference in interface statistics
### Changed
- **FreeBSD Builds**: Moved to separate rustnet-bsd repository for native builds
- **CI Improvements**: Homebrew formula auto-update on release, AUR workflow on publish
- **Dependencies**: Updated ratatui to 0.30.0, various dependency updates
- **Documentation**: Added contribution guidelines, Chocolatey and Arch Linux installation instructions
## [0.17.0] - 2025-12-07
### Added
- **Landlock Sandbox for Linux**: Filesystem and network sandboxing for enhanced security
- Restricts filesystem access to `/proc` only after initialization
- Network sandbox blocks TCP bind/connect on kernel 6.4+
- Drops `CAP_NET_RAW` capability after pcap handle is opened
- New CLI options: `--no-sandbox` and `--sandbox-strict`
- Comprehensive security documentation in SECURITY.md
- **eBPF Thread Name Resolution**: Resolve eBPF thread names (e.g., 'Socket Thread') to main process names (e.g., 'firefox')
- Uses periodic procfs PID cache for resolution
- Falls back to eBPF name for short-lived processes
- **AUR Package Automation**: Automated Arch Linux AUR package publishing workflow
### Changed
- **Platform Code Reorganization**: Restructured platform-specific code into cleaner module hierarchy
- `src/network/platform/linux/` - Linux-specific code with eBPF and sandbox subdirectories
- `src/network/platform/macos/` - macOS-specific code
- `src/network/platform/freebsd/` - FreeBSD-specific code
- `src/network/platform/windows/` - Windows-specific code
- **QUIC DPI Simplification**: Unified SNI extraction helpers and simplified QUIC protocol handling
### Fixed
- **Test Determinism**: Made RateTracker tests deterministic with injectable timestamps
## [0.16.1] - 2025-11-22
### Fixed
- **Cross-Compilation**: Fixed eBPF build issues when cross-compiling to non-Linux platforms
- Made `libbpf-cargo` an optional build dependency
- Fixed `build.rs` to check TARGET environment variable instead of host platform
- Prevents Linux-specific dependencies from being built for FreeBSD, macOS, and Windows
- **FreeBSD Build**: Switched from cross-compilation to native FreeBSD VM builds
- Uses `vmactions/freebsd-vm` for native FreeBSD compilation
- Eliminates cross-compilation sysroot and library linking issues
- Ensures FreeBSD builds work reliably with native package manager
## [0.16.0] - 2025-11-22
### Added
- **Network Interface Statistics**: Real-time monitoring of network interface statistics across all platforms
- Cross-platform support for Linux, macOS, Windows, and FreeBSD
- Display of interface-level metrics including packets sent/received, bytes transferred, and errors
- Platform-specific implementations optimized for each operating system
- New interface statistics module with dedicated platform handlers
### Changed
- **Link Layer Parsing**: Refactored link layer parsing into modular components
- Separated link layer types (Ethernet, Linux SLL, Raw IP, TUN/TAP, PKTAP)
- Improved packet parsing architecture for better maintainability
- Enhanced support for various network interface types
### Fixed
- **Windows Interface Stats**: Fixed interface statistics collection on Windows platforms
- Improved reliability of Windows network adapter statistics
- Better handling of Windows-specific network interfaces
- **macOS Interface Stats**: Platform-specific improvements for macOS interface statistics
- Enhanced accuracy of macOS network interface metrics
- Better integration with macOS network stack
## [0.15.0] - 2025-10-25
### Added
- **Ubuntu PPA Packaging**: Official Ubuntu PPA repository for easy installation on Ubuntu/Debian-based distributions
- Automated GitHub Actions workflow for PPA releases
- Support for multiple Ubuntu versions
### Changed
- **Bandwidth Sorting**: Changed bandwidth sorting to use combined up+down total instead of separate up/down sorting
- Simpler sorting behavior: press `s` once to sort by total bandwidth
- Display still shows "Down/Up" with individual values
- Arrow indicator shows when sorting by combined bandwidth total
- **Packet Capture Permissions**: Removed CAP_NET_ADMIN and CAP_SYS_ADMIN requirements
- Uses read-only packet capture (non-promiscuous mode)
- Reduced security footprint with minimal required capabilities
### Fixed
- **Bandwidth Rate Tracking**: Improved accuracy and stability of bandwidth rate calculations
- More consistent rate measurements
- Better handling of network traffic bursts
## [0.14.0] - 2025-10-12
### Added
- **eBPF Enabled by Default on Linux**: eBPF support is now enabled by default on Linux builds for enhanced performance
- Provides faster socket tracking with reduced overhead
- Includes CO-RE (Compile Once - Run Everywhere) support
- Graceful fallback to procfs when eBPF is unavailable
- **JSON Logging for SIEM Integration**: New JSON-structured logging output for security information and event management systems
- Enables integration with enterprise monitoring and security platforms
- Structured log format for easier parsing and analysis
- **TUN/TAP Interface Support**: Added support for TUN/TAP virtual network interfaces
- Enables monitoring of VPN connections and virtual network devices
- Expands interface compatibility for complex network setups
- **Fedora COPR RPM Packaging**: Official Fedora COPR repository for easy installation on Fedora/RHEL-based distributions
### Fixed
- **High CPU Usage on Linux**: Eliminated excessive procfs scanning causing high CPU utilization
- Optimized process lookup frequency and caching strategy
- Significantly reduced system resource consumption during monitoring
### Changed
- **Build Dependencies**: Bundled vmlinux.h files to eliminate network dependency during builds
- Improves build reliability and offline build capability
- Reduces external dependencies for compilation
- **Documentation**: Restructured documentation into focused files with improved musl static build documentation
## [0.13.0] - 2025-10-04
### Added
- **Windows Process Identification**: Implemented full process lookup using Windows IP Helper API
- Uses GetExtendedTcpTable and GetExtendedUdpTable for connection-to-process mapping
- Resolves process names via OpenProcess and QueryFullProcessImageNameW
- Supports both TCP/UDP and IPv4/IPv6 connections
- Implements time-based caching with 2-second TTL for performance
- Migrated from winapi to windows crate (v0.59) for better maintainability
- **Privilege Detection**: Pre-flight privilege checking before network interface access
- Detects insufficient privileges on Linux, macOS, and Windows
- Provides platform-specific instructions (sudo, setcap, Docker flags)
- Shows errors before TUI initialization for better visibility
- Detects container environments with Docker-specific guidance
### Fixed
- **Packet Length Calculation**: Use actual packet length from IP headers instead of captured length
- Extracts Total Length field from IP headers for accurate byte counting
- Fixes severe undercounting for large packets (NFS, jumbo frames)
- Resolves issues with snaplen-limited capture buffers
### Changed
- **Documentation**: Updated ROADMAP.md and README.md with Windows process identification status and Arch Linux installation instructions
## [0.12.1] - 2025-10-02
### Changed
- **Build Configuration**: Improved crate metadata for crates.io publishing
- No functional changes to the binary or runtime behavior
- Enhanced package configuration for better crate ecosystem integration
## [0.12.0] - 2025-10-01
### Added
- **Vim-style Navigation**: Jump to beginning of connection list with `g` and end with `G` (Shift+g)
- **Table Sorting**: Comprehensive sorting functionality for all connection table columns
- Press `s` to cycle through sortable columns (Protocol, Local Address, Remote Address, State, Service, Application, Bandwidth ↓, Bandwidth ↑, Process)
- Press `S` (Shift+s) to toggle sort direction (ascending/descending)
- Visual indicators with arrows and cyan highlighting on active sort column
- Sort by download/upload bandwidth to find bandwidth hogs
- Alphabetical sorting for text columns
- **Port Display Toggle**: Press `p` to switch between service names and port numbers display
- **Connection Navigation Improvements**: Enhanced navigation with better visual cleanup indication
- **Localhost Filtering Control**: New `--show-localhost` command-line flag to override default localhost filtering
### Fixed
- **Windows Double Key Issue**: Fixed duplicate key event handling on Windows platforms
- **Windows MSI Runtime Dependencies**: Added startup check for missing Npcap/WinPcap DLLs
- Displays helpful error message with installation instructions when DLLs are missing
- Added winapi dependency for Windows DLL detection
- Updated README with runtime dependency information
- **Linux Interface Selection**: Fixed "any" interface selection on Linux
- Improved interface detection and validation
- Better error handling for interface configuration
- **Package Dependencies**: Removed unnecessary runtime dependencies (clang, llvm) from RPM and DEB packages
- Reduces installation footprint and dependency conflicts
- **Docker Build**: Removed armv7 architecture from Docker builds for improved stability
### Changed
- **Documentation**: Updated roadmap and README with new features and keyboard shortcuts
## [0.11.0] - 2025-09-30
### Added
- **Docker Support with eBPF**: Docker images now include eBPF support for enhanced performance
- Multi-architecture Docker builds (amd64, arm64)
- eBPF-enabled images for advanced socket tracking on Linux
- Optimized container builds with proper dependency management
- **Cross-Platform Packaging and Release Automation**: Comprehensive automated release workflow
- Automated DEB, RPM, DMG, and MSI package generation
- Cross-platform CI/CD improvements
### Fixed
- **RPM Package Dependencies**: Corrected libelf dependency specification in RPM packages
- **Windows MSI Packaging**: Fixed MSI installer generation issues
- **Release Workflow**: Resolved various release automation issues
## [0.10.0] - 2025-09-28
### Added
- **Rust Version Requirements**: Added minimum Rust version requirement (1.88.0+) for let-chains support
### Changed
- **Build Requirements**: Now requires Rust 1.88.0 or later for advanced language features
## [0.9.0] - 2025-09-18
### Added
- **Experimental eBPF Support for Linux**: Enhanced socket tracking with optional eBPF backend
- eBPF-based socket tracker with CO-RE (Compile Once - Run Everywhere) support
- Minimal vmlinux header (5.5KB instead of full 3.4MB file)
- Graceful fallback mechanism to procfs when eBPF unavailable
- Support for both IPv4 and IPv6 socket tracking
- Optional feature disabled by default (enable with `--features=ebpf`)
- Comprehensive capability checking for required permissions
- **Windows Platform Support**: Network monitoring capability on Windows (without process identification)
## [0.8.0] - 2025-09-11
### Added
- **SSH Deep Packet Inspection (DPI)**: Comprehensive SSH protocol analysis including:
- SSH version detection (SSH-1.x, SSH-2.0)
- Client and server software identification (OpenSSH, PuTTY, libssh, etc.)
- Connection state tracking: Banner, KeyExchange, Authentication, Established
- Algorithm detection and negotiation monitoring
- SSH-specific filtering with `ssh:` prefix in connection filters
- **Enhanced Filtering**: SSH connections now support detailed filtering by software name and connection state
### Improved
- **CI/CD**: Enhanced GitHub Actions with path-based triggers for more efficient workflows
- **Documentation**: Updated README with SSH DPI examples and state descriptions
## [0.7.0] - 2025-09-11
### Fixed
- SecureCRT backspace handling issue
## [0.6.0] - 2025-09-10
### Added
- Connection state filtering (ESTABLISHED, TIME_WAIT, etc.)
## [0.5.0] - 2025-01-09
### Added
- **Connection Filtering System**: New comprehensive filtering capability allowing users to filter connections by:
- Protocol type (TCP, UDP, ICMP)
- Local and remote IP addresses
- Local and remote ports
- Process names
- Service names
- Customizable filter expressions with intuitive UI
- **Enhanced Documentation**: Added asciinema demo recording for better user onboarding
- **Visual Demonstrations**: Added animated GIF showcasing RustNet functionality
### Fixed
- **README Improvements**: Fixed image syntax and formatting issues for better GitHub display
### Changed
- **User Interface**: Enhanced TUI to support dynamic filtering with keyboard shortcuts
- **Documentation**: Improved project presentation with visual aids and demonstrations
## [0.4.0] - 2025-01-29
### Improved
- Enhanced traffic monitoring with better rate tracking and byte counters
- Fixed Linux platform build warnings for improved compilation stability
- Corrected version display to use dynamic version from Cargo.toml instead of hardcoded value
## [0.3.0] - 2024-12-28
### Added
- Created `RELEASE.md` and `ROADMAP.md` for better project organization
- Enhanced memory efficiency through enum variant boxing
### Fixed
- Major clippy warning cleanup (97% reduction from 38 to 1 warnings)
- Refactored functions using `TransportParams` struct to reduce complexity
- Fixed collapsible if patterns and improved code readability
- Eliminated needless borrows and manual implementations
### Changed
- Moved release documentation to dedicated files
- Streamlined README to focus on user information
- Improved code organization and Rust best practices
## [0.2.0] - 2024-12-19
### Added
- **Enhanced PKTAP Support on macOS**: Comprehensive process identification using macOS PKTAP (Packet Tap) headers
- Direct extraction of process names and PIDs from kernel packet metadata
- Robust handling of 20-byte PKTAP process name fields with proper normalization
- Support for both `pth_comm` and `pth_e_comm` (effective command name) fields
- Fallback to `lsof` system commands when PKTAP data is unavailable
- **Process Data Immutability System**: Once process information is set from any source, it becomes immutable to prevent display inconsistencies
- **Advanced Process Name Normalization**: Handles all types of whitespace, control characters, and padding in process names
- **Comprehensive Debug Logging**: Extensive logging for PKTAP header processing, process name extraction, and data flow tracking
### Fixed
- **Process Display Stability on macOS**: Fixed issue where process names would change format during UI scrolling (e.g., "firefox (123)" → "firefox (123)")
- **PKTAP Header Processing**: Improved parsing of raw PKTAP packet headers with better error handling and validation
- **Process Name Consistency**: Eliminated race conditions and data inconsistencies in process name display
- **Whitespace Normalization**: Fixed handling of tabs, multiple spaces, unicode whitespace, and control characters in process names
### Changed
- **Process Enrichment Logic**: Modified to respect existing PKTAP data and only fill in missing information from `lsof`
- **UI Rendering Optimization**: Simplified process name rendering to use pre-normalized data from sources
- **Error Handling**: Enhanced error reporting for PKTAP processing and process lookup failures
### Technical Details
- Implemented `extract_process_name_from_bytes()` function for robust PKTAP process name extraction
- Added immutability enforcement in connection merge logic with violation detection
- Enhanced macOS process lookup with `normalize_process_name_robust()` function
- Improved byte-level debugging and logging for process identification troubleshooting
### Platform-Specific Improvements
- **macOS**: PKTAP now provides primary process identification with significant performance and accuracy improvements over `lsof`-only approach
- **Linux**: Process enrichment logic updated to work consistently with new immutability system
## [0.1.0] - 2024-XX-XX
### Added
- Initial release of RustNet
- Real-time network connection monitoring
- Deep packet inspection (DPI) for HTTP, HTTPS, DNS, SSH, and QUIC
- Cross-platform support (Linux, macOS, Windows)
- Terminal user interface with ratatui
- Multi-threaded packet processing
- Process identification using platform-specific APIs
- Service name resolution
- Configurable refresh intervals and filtering options
- Optional logging with multiple log levels
[Unreleased]: https://github.com/domcyrus/rustnet/compare/v1.4.0...HEAD
[1.4.0]: https://github.com/domcyrus/rustnet/compare/v1.3.0...v1.4.0
[1.3.0]: https://github.com/domcyrus/rustnet/compare/v1.2.0...v1.3.0
[1.2.0]: https://github.com/domcyrus/rustnet/compare/v1.1.0...v1.2.0
[1.1.0]: https://github.com/domcyrus/rustnet/compare/v1.0.0...v1.1.0
[1.0.0]: https://github.com/domcyrus/rustnet/compare/v0.18.0...v1.0.0
[0.18.0]: https://github.com/domcyrus/rustnet/compare/v0.17.0...v0.18.0
[0.17.0]: https://github.com/domcyrus/rustnet/compare/v0.16.1...v0.17.0
[0.16.1]: https://github.com/domcyrus/rustnet/compare/v0.15.0...v0.16.1
[0.15.0]: https://github.com/domcyrus/rustnet/compare/v0.14.0...v0.15.0
[0.14.0]: https://github.com/domcyrus/rustnet/compare/v0.13.0...v0.14.0
[0.13.0]: https://github.com/domcyrus/rustnet/compare/v0.12.1...v0.13.0
[0.12.1]: https://github.com/domcyrus/rustnet/compare/v0.12.0...v0.12.1
[0.12.0]: https://github.com/domcyrus/rustnet/compare/v0.11.0...v0.12.0
[0.11.0]: https://github.com/domcyrus/rustnet/compare/v0.10.0...v0.11.0
[0.10.0]: https://github.com/domcyrus/rustnet/compare/v0.9.0...v0.10.0
[0.9.0]: https://github.com/domcyrus/rustnet/compare/v0.8.0...v0.9.0
[0.8.0]: https://github.com/domcyrus/rustnet/compare/v0.7.0...v0.8.0
[0.7.0]: https://github.com/domcyrus/rustnet/compare/v0.6.0...v0.7.0
[0.6.0]: https://github.com/domcyrus/rustnet/compare/v0.5.0...v0.6.0
[0.5.0]: https://github.com/domcyrus/rustnet/compare/v0.4.0...v0.5.0
[0.4.0]: https://github.com/domcyrus/rustnet/compare/v0.3.0...v0.4.0
[0.3.0]: https://github.com/domcyrus/rustnet/compare/v0.2.0...v0.3.0
[0.2.0]: https://github.com/domcyrus/rustnet/compare/v0.1.0...v0.2.0
[0.1.0]: https://github.com/domcyrus/rustnet/releases/tag/v0.1.0
Reference in New Issue View Git Blame Copy Permalink