domcyrus--rustnet/CHANGELOG.md

Changelog

All notable changes to RustNet will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

1.4.0 - 2026-06-16

This release redesigns the TUI around a calmer visual hierarchy and, under the hood, splits RustNet into a Cargo workspace of reusable library crates. Many of the TUI ideas came from a detailed UI review by @joshka (Ratatui maintainer) on our showcase submission (ratatui/ratatui-website#1118) — thanks for the thoughtful feedback!

Added

• Theme Presets: New --theme flag. The default muted preset keeps a single cyan accent and reserves color for signals (state changes, staleness, live bandwidth) and addresses; --theme classic restores the previous full-color palette (#377)
• System Sidebar Toggle: The System panel now has a fixed width and can be hidden with the i key (auto-hidden on narrow terminals) (#377)
• Details Continuity Strip: The Details tab opens with a mini connection table of the selected row and its neighbors; j/k flips through them without leaving the tab, following the grouped order when process grouping is enabled (#377)
• Direct-Jump Tab Shortcuts: Jump straight to a tab with keys 1-5, with bracket cycle aliases (#318, thanks @obchain)
• Connection List Scrollbar: A scrollbar appears on the connection list when it overflows the viewport (#365)
• FTP Deep Packet Inspection: Detect the FTP control channel and extract command and response metadata (#266, thanks @0xghost42)
• DNS / mDNS / LLMNR Response IPs: Populate response_ips from A/AAAA answer records and extend the extraction to mDNS and LLMNR responses (#319, #333, #341, thanks @0xghost42)
• Log Identity Banner: Emit a program identity banner and the module target on every log line for easier diagnostics (#320, thanks @0xghost42)
• Landlock v6 IPC Scoping (Linux): Best-effort Landlock that scopes abstract-socket and signal IPC on kernels that support it, falling back gracefully on older ABIs (#363)
• no_new_privs Always Set + cargo-deny: Always set no_new_privs at startup, and adopt cargo-deny for supply-chain and license auditing in CI (#382)
• openSUSE OBS Release Pipeline: Automated openSUSE Build Service releases (#356)

Changed

• Stable Column Layout: Column widths depend only on the terminal width — they no longer shift while scrolling. Narrow terminals hide low-priority columns instead of truncating cells; wide terminals distribute the spare width so the table spans the full screen with the bandwidth column flush right (#377)
• Merged Proto/App Column: The Protocol column is merged into Application ("TCP·HTTPS"), and the status-dot column is gone — staleness now lives entirely in the row styling (#377)
• Custom Tab Bar and Borderless Sections: Numbered tab bar with an accent underline, a single-line filter prompt, and section headers in place of the border-box-around-everything look (#377)
• Dependencies: Routine dependency and GitHub Actions updates across the cycle (Dependabot, ~18 PRs)

Fixed

• Process attribution for short-lived and multithreaded processes (Linux): eBPF socket tracking now records the process name (thread-group leader) instead of the calling thread's name, so connections from e.g. firefox or dig no longer show up as "Socket Thread" or "isc-net-0000"; PID-to-name resolution reads /proc/<pid>/comm on demand instead of waiting for the periodic scan; and new connections are enriched on a fast 250ms tick, so process names appear almost immediately instead of after up to 2 seconds (#376)
• DLT_NULL Link Layer: Strip the 4-byte address-family header before parsing DLT_NULL/loopback captures (#394, thanks @0xghost42)
• Terminal Restore on Panic: Restore the terminal via a chained panic hook so a panic no longer leaves the terminal in raw mode (#364)
• Scrollbar Thumb: The scrollbar thumb now reaches the bottom at max scroll (#366)
• Landlock /sys Access: Allow read access to /sys so interface statistics work under the Landlock sandbox (#370)
• Filter Mode Backspace: Handle raw backspace characters in filter mode (#335, thanks @iccccccccccccc)
• eBPF Error Surfacing: Classify libbpf errors and surface them in the TUI (#255, #258)
• Native Builds: Skip cross-compile library paths on native builds (#259)
• RPM Packaging: Own the directories and hicolor icon dirs the package creates, and require libcap-progs on openSUSE so the %post setcap runs (#357, #358, #359, #360)

Performance

• Per-Packet Allocations: Cut per-packet allocations and snapshot copy-on-write copies on the hot path (#380)
• Core Types: Add Protocol::as_str() and drop per-row/per-filter to_string allocations (#392, thanks @obchain)
• Connection Table: Borrow the process name in process_text instead of cloning (#390, thanks @obchain)
• Sparklines / Parsers: Single-allocation sparkline getters, fewer redundant collects in the HTTP and SSH parsers, and removed redundant clones in the render path and sandbox init (#339, #345, #355, thanks @obchain)

Internal

• Cargo Workspace Split: RustNet is now a four-crate workspace — rustnet-core (packet parsing, protocol/DPI types, link-layer, connection merging, DNS/GeoIP/OUI lookups), rustnet-capture (libpcap/Npcap capture backend), rustnet-host (per-connection process attribution), and the rustnet-monitor binary. The three libraries are now published to crates.io alongside the binary (#367)

Documentation

• Simplified Chinese: Added a Simplified Chinese README translation and translated the rest of the docs, plus zh-CN openSUSE Tumbleweed install instructions (#263 thanks @whtis, #277 thanks @luojiyin1987, #361)
• Install / Packaging Docs: Nix and NixOS instructions and nixpkgs/NixOS-module notes, Homebrew core formula pointer, Repology packaging overview, a Mermaid architecture diagram, and a PR template with tightened contributor guidelines (#264, #270, #281, #285, #286, #311, #332, #369)
• Ubuntu 26.04 (Resolute) PPA: Added the Resolute PPA build (#254, #256)

Contributors

Special thanks to the contributors in this release:

• @0xghost42 — FTP DPI, DNS/mDNS/LLMNR response-IP extraction, the log identity banner, the DLT_NULL fix, and many DPI/eBPF refactors (#266, #278, #279, #289, #290, #307, #309, #319, #320, #333, #341, #394)
• @obchain — performance and allocation cleanups across the DPI parsers, render path, and core types, plus direct-jump tab shortcuts (#292, #294, #296, #301, #303, #317, #318, #327, #339, #345, #355, #390, #392)
• @iccccccccccccc — raw backspace handling in filter mode (#335)
• @whtis (HaiTao Wu) — Simplified Chinese README translation (#263)
• @luojiyin1987 (luo jiyin) — Simplified Chinese documentation translation (#277)

1.3.0 - 2026-05-05

The headline of this release is a major TUI refresh. The tabs, stats panel, and details view have all been redesigned, with new per-field colors, a status dot, and address scope labels making it easier to read connections at a glance.

Added

• TUI Revamp: Redesigned tabs, stats panel, and details view (#239)
• Per-field Colors and Status Dot: New per-field colors, status dot, and magenta panel borders for at-a-glance readability (#241)
• Address Scope Labels: Remote addresses are tagged PUBLIC, PRIVATE, etc. in the connection list (#251)
• Reverse DNS Resolution by Default: Reverse DNS resolution is now enabled by default. Use the new --no-resolve-dns flag to opt out (#245)

Fixed

• Sandbox Info on Overview: Show the full sandbox details on the overview tab (#250)
• Search Scope and Status Bars: Scope the / search to Overview and tidy the status bars (#229, #230)
• QUIC Initial Packet Parser: Bounds-check token_len in the Initial packet parser (#244)
• QUIC Varint Parser: Bounds-check varint lengths and isolate parser panics (#232)
• Release Pipeline: Fix the downstream trigger race and AUR token permissions (#223)

Changed

• Demo Recording Automation: Automate VHS recording for the demo GIF and README screenshots (#247)
• OUI Vendor Database: Refreshed IEEE OUI vendor database (#242)
• Dependencies: Bumped rand (0.8.5 to 0.8.6), openssl (0.10.75 to 0.10.78), zip, libbpf-cargo, and other rust-dependencies and actions group updates (#224, #225, #226, #227, #231, #233, #234, #238, #240, #243)

Documentation

• Windows Sandbox Terminology: Accurate Windows sandbox terminology and roadmap entry (#237)
• README Polish: README hero polish, metadata tune-up, and accuracy fixes (#236)
• Crate and Module Docs: Expanded crate and module docs and tuned metadata for discoverability (#235)

1.2.0 - 2026-04-09

Added

• Windows Restricted Token Sandbox: Drop privileges at startup on Windows using a restricted process token (#206)
• macOS Seatbelt Sandboxing: Apply a Seatbelt sandbox profile at startup on macOS, later tightened to restrict filesystem and IPC access (#196, #203)
• Linux Sandbox Hardening: Drop Linux capabilities and clear the ambient capability set after startup (#208)
• Process Privilege in UI: Show whether a process is privileged in the security section of the TUI (#197)
• Filter: Exact Port Matching and Regex Support: Filter syntax supports exact port matches and regex patterns (#195)
• VLAN Support in PKTAP and SLL/SLL2: Parse VLAN tags in PKTAP and SLL/SLL2 capture formats (#202)
• VLAN Header in Layer 3 Extraction: Account for VLAN headers when extracting layer 3 data (#199, thanks @deepakpjose)
• IGMP Protocol Parsing: Recognize and parse IGMP traffic (#209, thanks @deepakpjose)
• Process Name for Wildcard /proc/net/ Entries: Resolve process names for wildcard (0.0.0.0/::) entries in /proc/net/ (#218, thanks @deepakpjose)
• CI Supply-Chain Hardening: Pin GitHub Actions to commit SHAs and verify Npcap installer checksums (#210)
• Architecture Roadmap: Added workspace split and macOS privilege separation roadmap docs (#211)

Fixed

• Default Interface Selection: Use the active routing table to pick the default interface (#194, thanks @l1a)
• Root Detection on Unix: Use geteuid() instead of getuid() to detect root (#192, thanks @DeepChirp)
• Release Pipeline Reliability: Improved release workflow reliability, gated downstream jobs on publish-release, added checksum verification to AUR updates, and documented the no-retag policy (2a38f2d, 795f7a1, 002eb55, 8403a0f)
• FreeBSD CI Dispatch: Restrict FreeBSD dispatch to manual triggers only (#201)

Changed

• CPU Efficiency Improvements: Substantial reductions in CPU usage across hot paths — rate calculation moved from per-update to per-refresh (#220), timeouts avoided to improve CPU performance (#213), threads given meaningful names to aid profiling (#212), and allocations reduced in sorting and snapshot paths (#222). Big thanks to @deepakpjose for driving the CPU-efficiency work (#213, #220, #212) — these changes make RustNet noticeably lighter on the CPU.
• FreeBSD Platform Cleanup: Refactored FreeBSD platform support code (#205)
• Dependencies: Bumped zip (8.2.0 → 8.3.0 → 8.5.0), clap_mangen, docker/login-action, and other rust-dependencies group updates (#198, #200, #214, #216, #219, #221)
• OUI Vendor Database: Refreshed IEEE OUI vendor database (#215)

Contributors

Special thanks to the external contributors in this release:

• @deepakpjose — CPU-efficiency improvements and additional features (#199, #209, #212, #213, #218, #220)
• @l1a — default interface selection via active routing table (#194)
• @DeepChirp — Unix root detection via geteuid() (#192)

1.1.0 - 2026-03-16

Added

• OUI Vendor Lookup for ARP: Display MAC vendor names for ARP connections using IEEE OUI database (#183)
• Historic Connections Toggle: Toggle to show/hide historic (closed) connections (#184)
• Mouse Support: Mouse interaction support for TUI navigation (#170)
• Security Hardening & Packet Stats: Enhanced security hardening and packet statistics display in TUI (#169)
• GeoIP City Lookup: Show city-level geolocation for remote IPs using GeoLite2 City database (#168)
• Android Build Support: Native Android builds with static musl linking (#167)
• Multi-Arch Android Builds: Added armv7, x86_64, and x86 Android static build targets
• MQTT Protocol Detection: Deep packet inspection for MQTT protocol traffic (#161)
• STUN Traffic Detection: Detect STUN protocol traffic per RFC 5389/8489 (#160)
• BitTorrent Traffic Detection: Detect BitTorrent protocol traffic (#159)
• ARP Performance Benchmarks: Added criterion benchmarks for ARP-related operations (#188)

Fixed

• Undefined Behavior Fix: Fix UB issues, remove clippy suppressions, add safety documentation (#187)
• Light Terminal Readability: Fix selection highlight unreadable on light terminal themes (#182)
• Clipboard Warning: Fix unused variable warning in copy_to_clipboard across platforms (#178)
• Android Cross-Compilation: Fix cross-compilation and release upload issues for Android targets (#174)
• MQTT Detection Accuracy: Restrict MQTT signature detection to CONNECT packets only (#164)

Changed

• Documentation: Synced docs with implementation, added missing keyboard shortcuts (#190, #157)
• CI/CD: Staged release pipeline so downstream jobs wait for builds (#154), added FreeBSD coverage to PR builds (#158)
• Dependencies: Bumped chrono, http_req, zip, and various rust-dependencies groups

1.0.0 - 2026-02-09

Added

• GeoIP Location Support: Show country codes for remote IPs using GeoLite2 databases with auto-discovery (#151)
• PCAP Export with Process Attribution: Export captured packets to PCAP files with a process attribution JSONL sidecar for Wireshark enrichment (#137)
• eBPF-based ICMP PID Tracking: Track process IDs for ICMP connections using eBPF on Linux (#136)
• Process Detection Degradation Warnings: Show warnings in the UI when process detection falls back to a less accurate method (#128)
• ARM64 Musl Static Builds: CI now produces arm64 musl static Linux builds with eBPF support

Fixed

• Service Name Precedence: Corrected ordering when multiple service name sources conflict (#150)
• Pointer Dereference Safety: Use as_ref() for safer pointer dereference in macOS/FreeBSD interface stats (#147)
• Clippy Warnings: Resolve unnecessary_unwrap errors flagged by clippy (#144)
• ICMP Dead Code: Remove dead code warning in ICMP handling (#138)
• GitHub Actions Permissions: Add explicit permissions to all GitHub Actions workflows (#131)
• Logging Initialization: Set up logging level before privileges check for earlier diagnostic output (#143)

Changed

• SSH Heuristic Tightened: Tighten SSH packet structure heuristic to reduce false positives (#135)
• CI Reusable Workflows: Share build logic via reusable workflow, remove redundant test-static-builds workflow
• Chocolatey Automation: Trigger Chocolatey package publish on release automatically
• Code Alignment: Refactoring and code alignment improvements (#149)
• Dependencies: Updated libbpf-rs to 0.26, bumped clap, time, zip, lru, and libc
• Documentation: Clarified RustNet vs Wireshark positioning, added PowerShell font troubleshooting, added JSON logging to feature comparison, added bandwhich to acknowledgments (#129, #130, #132, #133)

0.18.0 - 2026-01-07

Added

• Process Grouping: Expandable tree view to group connections by process (a to toggle grouping, Space to expand/collapse)
• Traffic Visualization Graph Tab: New Graph tab with real-time network traffic graphs and bandwidth visualization (press Tab to cycle through tabs)
• Network Health Visualization: Health indicators in Graph tab showing connection quality metrics
• Reverse DNS Hostnames: Display reverse DNS names in Details tab and filter PTR traffic (--resolve-dns to enable, d to toggle display)
• BPF Filter Support: New --bpf-filter option for custom packet capture filtering (e.g., --bpf-filter "port 443")
• Clear All Connections: New hotkey (x) to clear all tracked connections
• Enhanced JSON Logging: Added pid, process_name, service_name fields to JSON log output
• New DPI Protocols: NTP, mDNS, LLMNR, DHCP, SNMP, SSDP, NetBIOS protocol detection with enhanced ARP display
• Static Musl Builds: Linux static binary builds using musl for better portability
• Platform-Specific Help: CLI help now shows platform-specific options

Fixed

• macOS BPF Filter: Skip PKTAP when BPF filter is specified to avoid conflicts
• Linux Clipboard: Handle clipboard access blocked by Landlock sandbox gracefully
• Interface Stats: Use safer pointer dereference in interface statistics

Changed

• FreeBSD Builds: Moved to separate rustnet-bsd repository for native builds
• CI Improvements: Homebrew formula auto-update on release, AUR workflow on publish
• Dependencies: Updated ratatui to 0.30.0, various dependency updates
• Documentation: Added contribution guidelines, Chocolatey and Arch Linux installation instructions

0.17.0 - 2025-12-07

Added

• Landlock Sandbox for Linux: Filesystem and network sandboxing for enhanced security
  • Restricts filesystem access to /proc only after initialization
  • Network sandbox blocks TCP bind/connect on kernel 6.4+
  • Drops CAP_NET_RAW capability after pcap handle is opened
  • New CLI options: --no-sandbox and --sandbox-strict
  • Comprehensive security documentation in SECURITY.md
• eBPF Thread Name Resolution: Resolve eBPF thread names (e.g., 'Socket Thread') to main process names (e.g., 'firefox')
  • Uses periodic procfs PID cache for resolution
  • Falls back to eBPF name for short-lived processes
• AUR Package Automation: Automated Arch Linux AUR package publishing workflow

Changed

• Platform Code Reorganization: Restructured platform-specific code into cleaner module hierarchy
  • src/network/platform/linux/ - Linux-specific code with eBPF and sandbox subdirectories
  • src/network/platform/macos/ - macOS-specific code
  • src/network/platform/freebsd/ - FreeBSD-specific code
  • src/network/platform/windows/ - Windows-specific code
• QUIC DPI Simplification: Unified SNI extraction helpers and simplified QUIC protocol handling

Fixed

• Test Determinism: Made RateTracker tests deterministic with injectable timestamps

0.16.1 - 2025-11-22

Fixed

• Cross-Compilation: Fixed eBPF build issues when cross-compiling to non-Linux platforms
  • Made libbpf-cargo an optional build dependency
  • Fixed build.rs to check TARGET environment variable instead of host platform
  • Prevents Linux-specific dependencies from being built for FreeBSD, macOS, and Windows
• FreeBSD Build: Switched from cross-compilation to native FreeBSD VM builds
  • Uses vmactions/freebsd-vm for native FreeBSD compilation
  • Eliminates cross-compilation sysroot and library linking issues
  • Ensures FreeBSD builds work reliably with native package manager

[0.16.0] - 2025-11-22

Added

• Network Interface Statistics: Real-time monitoring of network interface statistics across all platforms
  • Cross-platform support for Linux, macOS, Windows, and FreeBSD
  • Display of interface-level metrics including packets sent/received, bytes transferred, and errors
  • Platform-specific implementations optimized for each operating system
  • New interface statistics module with dedicated platform handlers

Changed

• Link Layer Parsing: Refactored link layer parsing into modular components
  • Separated link layer types (Ethernet, Linux SLL, Raw IP, TUN/TAP, PKTAP)
  • Improved packet parsing architecture for better maintainability
  • Enhanced support for various network interface types

Fixed

• Windows Interface Stats: Fixed interface statistics collection on Windows platforms
  • Improved reliability of Windows network adapter statistics
  • Better handling of Windows-specific network interfaces
• macOS Interface Stats: Platform-specific improvements for macOS interface statistics
  • Enhanced accuracy of macOS network interface metrics
  • Better integration with macOS network stack

0.15.0 - 2025-10-25

Added

• Ubuntu PPA Packaging: Official Ubuntu PPA repository for easy installation on Ubuntu/Debian-based distributions
  • Automated GitHub Actions workflow for PPA releases
  • Support for multiple Ubuntu versions

Changed

• Bandwidth Sorting: Changed bandwidth sorting to use combined up+down total instead of separate up/down sorting
  • Simpler sorting behavior: press s once to sort by total bandwidth
  • Display still shows "Down/Up" with individual values
  • Arrow indicator shows when sorting by combined bandwidth total
• Packet Capture Permissions: Removed CAP_NET_ADMIN and CAP_SYS_ADMIN requirements
  • Uses read-only packet capture (non-promiscuous mode)
  • Reduced security footprint with minimal required capabilities

Fixed

• Bandwidth Rate Tracking: Improved accuracy and stability of bandwidth rate calculations
  • More consistent rate measurements
  • Better handling of network traffic bursts

0.14.0 - 2025-10-12

Added

• eBPF Enabled by Default on Linux: eBPF support is now enabled by default on Linux builds for enhanced performance
  • Provides faster socket tracking with reduced overhead
  • Includes CO-RE (Compile Once - Run Everywhere) support
  • Graceful fallback to procfs when eBPF is unavailable
• JSON Logging for SIEM Integration: New JSON-structured logging output for security information and event management systems
  • Enables integration with enterprise monitoring and security platforms
  • Structured log format for easier parsing and analysis
• TUN/TAP Interface Support: Added support for TUN/TAP virtual network interfaces
  • Enables monitoring of VPN connections and virtual network devices
  • Expands interface compatibility for complex network setups
• Fedora COPR RPM Packaging: Official Fedora COPR repository for easy installation on Fedora/RHEL-based distributions

Fixed

• High CPU Usage on Linux: Eliminated excessive procfs scanning causing high CPU utilization
  • Optimized process lookup frequency and caching strategy
  • Significantly reduced system resource consumption during monitoring

Changed

• Build Dependencies: Bundled vmlinux.h files to eliminate network dependency during builds
  • Improves build reliability and offline build capability
  • Reduces external dependencies for compilation
• Documentation: Restructured documentation into focused files with improved musl static build documentation

0.13.0 - 2025-10-04

Added

• Windows Process Identification: Implemented full process lookup using Windows IP Helper API
  • Uses GetExtendedTcpTable and GetExtendedUdpTable for connection-to-process mapping
  • Resolves process names via OpenProcess and QueryFullProcessImageNameW
  • Supports both TCP/UDP and IPv4/IPv6 connections
  • Implements time-based caching with 2-second TTL for performance
  • Migrated from winapi to windows crate (v0.59) for better maintainability
• Privilege Detection: Pre-flight privilege checking before network interface access
  • Detects insufficient privileges on Linux, macOS, and Windows
  • Provides platform-specific instructions (sudo, setcap, Docker flags)
  • Shows errors before TUI initialization for better visibility
  • Detects container environments with Docker-specific guidance

Fixed

• Packet Length Calculation: Use actual packet length from IP headers instead of captured length
  • Extracts Total Length field from IP headers for accurate byte counting
  • Fixes severe undercounting for large packets (NFS, jumbo frames)
  • Resolves issues with snaplen-limited capture buffers

Changed

• Documentation: Updated ROADMAP.md and README.md with Windows process identification status and Arch Linux installation instructions

0.12.1 - 2025-10-02

Changed

• Build Configuration: Improved crate metadata for crates.io publishing
  • No functional changes to the binary or runtime behavior
  • Enhanced package configuration for better crate ecosystem integration

0.12.0 - 2025-10-01

Added

• Vim-style Navigation: Jump to beginning of connection list with g and end with G (Shift+g)
• Table Sorting: Comprehensive sorting functionality for all connection table columns
  • Press s to cycle through sortable columns (Protocol, Local Address, Remote Address, State, Service, Application, Bandwidth ↓, Bandwidth ↑, Process)
  • Press S (Shift+s) to toggle sort direction (ascending/descending)
  • Visual indicators with arrows and cyan highlighting on active sort column
  • Sort by download/upload bandwidth to find bandwidth hogs
  • Alphabetical sorting for text columns
• Port Display Toggle: Press p to switch between service names and port numbers display
• Connection Navigation Improvements: Enhanced navigation with better visual cleanup indication
• Localhost Filtering Control: New --show-localhost command-line flag to override default localhost filtering

Fixed

• Windows Double Key Issue: Fixed duplicate key event handling on Windows platforms
• Windows MSI Runtime Dependencies: Added startup check for missing Npcap/WinPcap DLLs
  • Displays helpful error message with installation instructions when DLLs are missing
  • Added winapi dependency for Windows DLL detection
  • Updated README with runtime dependency information
• Linux Interface Selection: Fixed "any" interface selection on Linux
  • Improved interface detection and validation
  • Better error handling for interface configuration
• Package Dependencies: Removed unnecessary runtime dependencies (clang, llvm) from RPM and DEB packages
  • Reduces installation footprint and dependency conflicts
• Docker Build: Removed armv7 architecture from Docker builds for improved stability

Changed

• Documentation: Updated roadmap and README with new features and keyboard shortcuts

0.11.0 - 2025-09-30

Added

• Docker Support with eBPF: Docker images now include eBPF support for enhanced performance
  • Multi-architecture Docker builds (amd64, arm64)
  • eBPF-enabled images for advanced socket tracking on Linux
  • Optimized container builds with proper dependency management
• Cross-Platform Packaging and Release Automation: Comprehensive automated release workflow
  • Automated DEB, RPM, DMG, and MSI package generation
  • Cross-platform CI/CD improvements

Fixed

• RPM Package Dependencies: Corrected libelf dependency specification in RPM packages
• Windows MSI Packaging: Fixed MSI installer generation issues
• Release Workflow: Resolved various release automation issues

0.10.0 - 2025-09-28

Added

• Rust Version Requirements: Added minimum Rust version requirement (1.88.0+) for let-chains support

Changed

• Build Requirements: Now requires Rust 1.88.0 or later for advanced language features

0.9.0 - 2025-09-18

Added

• Experimental eBPF Support for Linux: Enhanced socket tracking with optional eBPF backend
  • eBPF-based socket tracker with CO-RE (Compile Once - Run Everywhere) support
  • Minimal vmlinux header (5.5KB instead of full 3.4MB file)
  • Graceful fallback mechanism to procfs when eBPF unavailable
  • Support for both IPv4 and IPv6 socket tracking
  • Optional feature disabled by default (enable with --features=ebpf)
  • Comprehensive capability checking for required permissions
• Windows Platform Support: Network monitoring capability on Windows (without process identification)

0.8.0 - 2025-09-11

Added

• SSH Deep Packet Inspection (DPI): Comprehensive SSH protocol analysis including:
  • SSH version detection (SSH-1.x, SSH-2.0)
  • Client and server software identification (OpenSSH, PuTTY, libssh, etc.)
  • Connection state tracking: Banner, KeyExchange, Authentication, Established
  • Algorithm detection and negotiation monitoring
  • SSH-specific filtering with ssh: prefix in connection filters
• Enhanced Filtering: SSH connections now support detailed filtering by software name and connection state

Improved

• CI/CD: Enhanced GitHub Actions with path-based triggers for more efficient workflows
• Documentation: Updated README with SSH DPI examples and state descriptions

0.7.0 - 2025-09-11

Fixed

• SecureCRT backspace handling issue

0.6.0 - 2025-09-10

Added

• Connection state filtering (ESTABLISHED, TIME_WAIT, etc.)

0.5.0 - 2025-01-09

Added

• Connection Filtering System: New comprehensive filtering capability allowing users to filter connections by:
  • Protocol type (TCP, UDP, ICMP)
  • Local and remote IP addresses
  • Local and remote ports
  • Process names
  • Service names
  • Customizable filter expressions with intuitive UI
• Enhanced Documentation: Added asciinema demo recording for better user onboarding
• Visual Demonstrations: Added animated GIF showcasing RustNet functionality

Fixed

• README Improvements: Fixed image syntax and formatting issues for better GitHub display

Changed

• User Interface: Enhanced TUI to support dynamic filtering with keyboard shortcuts
• Documentation: Improved project presentation with visual aids and demonstrations

0.4.0 - 2025-01-29

Improved

• Enhanced traffic monitoring with better rate tracking and byte counters
• Fixed Linux platform build warnings for improved compilation stability
• Corrected version display to use dynamic version from Cargo.toml instead of hardcoded value

0.3.0 - 2024-12-28

Added

• Created RELEASE.md and ROADMAP.md for better project organization
• Enhanced memory efficiency through enum variant boxing

Fixed

• Major clippy warning cleanup (97% reduction from 38 to 1 warnings)
• Refactored functions using TransportParams struct to reduce complexity
• Fixed collapsible if patterns and improved code readability
• Eliminated needless borrows and manual implementations

Changed

• Moved release documentation to dedicated files
• Streamlined README to focus on user information
• Improved code organization and Rust best practices

0.2.0 - 2024-12-19

Added

• Enhanced PKTAP Support on macOS: Comprehensive process identification using macOS PKTAP (Packet Tap) headers
  • Direct extraction of process names and PIDs from kernel packet metadata
  • Robust handling of 20-byte PKTAP process name fields with proper normalization
  • Support for both pth_comm and pth_e_comm (effective command name) fields
  • Fallback to lsof system commands when PKTAP data is unavailable
• Process Data Immutability System: Once process information is set from any source, it becomes immutable to prevent display inconsistencies
• Advanced Process Name Normalization: Handles all types of whitespace, control characters, and padding in process names
• Comprehensive Debug Logging: Extensive logging for PKTAP header processing, process name extraction, and data flow tracking

Fixed

• Process Display Stability on macOS: Fixed issue where process names would change format during UI scrolling (e.g., "firefox (123)" → "firefox (123)")
• PKTAP Header Processing: Improved parsing of raw PKTAP packet headers with better error handling and validation
• Process Name Consistency: Eliminated race conditions and data inconsistencies in process name display
• Whitespace Normalization: Fixed handling of tabs, multiple spaces, unicode whitespace, and control characters in process names

Changed

• Process Enrichment Logic: Modified to respect existing PKTAP data and only fill in missing information from lsof
• UI Rendering Optimization: Simplified process name rendering to use pre-normalized data from sources
• Error Handling: Enhanced error reporting for PKTAP processing and process lookup failures

Technical Details

• Implemented extract_process_name_from_bytes() function for robust PKTAP process name extraction
• Added immutability enforcement in connection merge logic with violation detection
• Enhanced macOS process lookup with normalize_process_name_robust() function
• Improved byte-level debugging and logging for process identification troubleshooting

Platform-Specific Improvements

• macOS: PKTAP now provides primary process identification with significant performance and accuracy improvements over lsof-only approach
• Linux: Process enrichment logic updated to work consistently with new immutability system

0.1.0 - 2024-XX-XX

Added

• Initial release of RustNet
• Real-time network connection monitoring
• Deep packet inspection (DPI) for HTTP, HTTPS, DNS, SSH, and QUIC
• Cross-platform support (Linux, macOS, Windows)
• Terminal user interface with ratatui
• Multi-threaded packet processing
• Process identification using platform-specific APIs
• Service name resolution
• Configurable refresh intervals and filtering options
• Optional logging with multiple log levels