psnet

KO | EN

gitlite — search

#python #hacktoberfest #ai #android #machine-learning #linux #docker #macos #awesome #cli #awesome-list #vue #pytorch #mcp

(★ 136)

A beautiful real-time TUI network monitor for Windows PowerShell — built in Rust

psnet Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

<h1 align="center">
 ◈ PSNET
</h1>

A beautiful real-time network monitor for your terminal.
 
 9 tabs. GeoIP maps. Device discovery. Firewall. Topology. All in one 12 MB binary.

<a href="#features">Features</a> •
 <a href="#installation">Install</a> •
 <a href="#tabs">Tabs</a> •
 <a href="#keybindings">Keys</a> •
 <a href="#screenshots">Screenshots</a> •
 <a href="#architecture">Architecture</a> •
 <a href="#contributing">Contributing</a>

---

## What is PSNET?

**PSNET** is a zero-dependency (no Npcap/WinPcap needed) TUI network monitor built in Rust for Windows. A single `psnet.exe` binary gives you 9 interactive tabs covering everything from live speed graphs and active connections to a world map, LAN device discovery, firewall management, topology visualization, and security alerts — all in a beautiful dark terminal UI.

Think **GlassWire + Wireshark + htop**, but for your terminal.

## Screenshots

---

## Features

### 📊 Dashboard (GlassWire-style)
- **Traffic graph** with selectable time ranges (5m / 15m / 1h / 24h)
- **World map** showing live connection dots colored by TCP state
- **Top countries** by connection count with proportional bars
- **Network health** gauge (score based on active connections, threats, alerts, firewall status)
- **Top apps** by bandwidth bar chart

### 🔗 Connections
- **DNS-resolved hostnames** — see `github.com` instead of `140.82.121.4`
- **Service labels** — `HTTPS/TCP`, `DNS/UDP`, `SSH/TCP` instead of raw port numbers
- **Color-coded by state** — ESTABLISHED green, SYN_SENT cyan, TIME_WAIT purple, CLOSE_WAIT orange
- **PID column** — owning process ID for every socket, sortable at a glance
- **Service name resolution** — svchost.exe connections show the real owning service (WpnService, DoSvc, Dnscache, ...) via `GetOwnerModuleFromTcpEntry`, highlighted in purple
- **Sortable columns** — Process, PID, Remote Host, Service, State, Local Port
- **Localhost filter** — hide `127.0.0.1` noise (toggle with `x`)
- **Live filtering** — type to search by process, service module, PID, hostname, port, or service
- **Detail popup** — press Enter for full connection details with GeoIP, bandwidth, and timing

### 🖥️ Servers (Listening Ports)
- **Service fingerprinting** — identifies 200+ server types (nginx, PostgreSQL, Redis, Docker, VS Code, etc.)
- **Wappalyzer technology detection** — HTTP banner analysis with 6,500+ technology signatures
- **TCP exposure panel** — at-a-glance view of how many ports are network-facing (`*`) vs localhost-only
- **Bind address badges** — each server card shows a colored badge: red `*` for all-interfaces, blue `127.0.0.1` for localhost, gold for specific IPs
- **Responsive status** — UP/silent indicators, TLS detection, active connection counts
- **Version detection** — extracted from banners and HTTP headers

### 📦 Packets (Wireshark-style)
- **Expert-level packet inspector** with severity indicators (Chat / Note / Warn / Error)
- **Protocol layer dissection** — Ethernet → IP → TCP/UDP → Application
- **DNS enrichment** — resolved hostnames shown alongside IPs
- **GeoIP enrichment** — country flags and codes on remote IPs
- **Hex + ASCII payload view** in detail popup
- **Filterable** by protocol, IP, port, or process

### 🗺️ Topology
- **Hub-and-spoke network diagram** — your machine at center, connected to gateway, DNS, LAN devices, and remote hosts
- **Live connection lines** colored by state
- **Scrollable** with device details

### 🚨 Alerts
- **Categorized security alerts** — suspicious hosts, unusual ports, threat intelligence matches
- **Split-pane layout** with independent scrolling per category
- **Detail popup** with full alert context and recommended actions

### 🛡️ Firewall
- **App-centric firewall management** — see which apps are making connections
- **Block/Allow per app** — toggle firewall rules directly from the TUI
- **Bandwidth columns** — download/upload per app
- **Rule status indicators** — blocked (red), allowed (green), no rule (dim)

### 📡 Devices (LAN Scanner)
- **ARP-based device discovery** on your local network
- **OUI vendor lookup** — 35,000+ MAC prefix database identifies device manufacturers (Apple, Dell, Intel, etc.)
- **Sortable table** — IP, hostname, MAC, vendor, open ports, online status
- **Sent/received byte counters** per device

### 🌐 Networks
- **Multi-adapter view** — VPNs, Docker bridges, WSL, Hyper-V virtual switches, secondary adapters
- **Bluetooth section** (collapsible)
- **Tunnel detection** — identifies VPN tunnels, mesh networks, and container overlays
- **Adapter status** — IP addresses, gateway, DNS, link speed

### ⚡ Always Visible
- **Speed section** (top) — download/upload sparkline waveforms, gauge bars, peak/total counters
- **Wire preview** (bottom) — live packet payload snippets with direction indicators (requires Administrator)
- **Title bar** — interface name, active/total connections, session timer, activity indicator

### 🌍 Embedded Databases
All data files compile into the binary — nothing to download or configure:
- **GeoIP** — DB-IP country-level database (~7 MB) for world map and country enrichment
- **Fingerprints** — 200+ server identification signatures
- **Wappalyzer** — 6,500+ web technology detection rules
- **OUI** — 35,000+ MAC vendor prefix database

---

## Installation

### Via Cargo (crates.io)

```powershell
cargo install psnet
psnet
```

### Via Chocolatey

```powershell
choco install psnet
psnet
```

### Via WinGet

```powershell
winget install psmux.psnet
psnet
```

### Download Binary

Grab the latest `psnet.exe` from [GitHub Releases](https://github.com/psmux/psnet/releases/latest) — no installation needed. Place it in your PATH and run.

### From Source

```powershell
git clone https://github.com/psmux/psnet.git
cd psnet
cargo build --release
.\target\release\psnet.exe
```

### Requirements

- **Windows 10/11** (uses Win32 APIs — `iphlpapi.dll`, `dnsapi.dll`, `ws2_32.dll`, `kernel32.dll`)
- **Rust 1.70+** for building from source
- **Administrator privileges** — optional, enables Wire packet preview and raw socket capture

---

## Tabs

| # | Tab | Description |
|---|-----|-------------|
| 1 | **Dashboard** | GlassWire-style overview — traffic graph, world map, health gauge, top apps/countries |
| 2 | **Connections** | Live connection table with DNS hostnames, service labels, process names, state |
| 3 | **Servers** | Listening ports with fingerprinted service names, bind address badges, exposure panel |
| 4 | **Packets** | Wireshark-style packet inspector with protocol dissection and hex view |
| 5 | **Topology** | Hub-and-spoke network diagram of your machine's connections |
| 6 | **Alerts** | Categorized security alerts with severity and recommendations |
| 7 | **Firewall** | Per-app firewall management — block/allow apps, see bandwidth per app |
| 8 | **Devices** | LAN device scanner with MAC vendor lookup, hostname resolution |
| 9 | **Networks** | Multi-adapter view — VPNs, Docker, WSL, Hyper-V, Bluetooth |

Press `Tab` / `Shift+Tab` to cycle through them.

---

## Keybindings

### Global

| Key | Action |
|-----|--------|
| `q` / `Ctrl+C` | Quit |
| `Tab` / `Shift+Tab` | Next / Previous tab |
| `↑` `↓` | Scroll |
| `PgUp` `PgDn` | Scroll fast |
| `Home` `End` | Jump to top / bottom |
| `Enter` | Open detail popup for selected item |
| `Esc` | Close popup / Clear filter |

### Dashboard

| Key | Action |
|-----|--------|
| `1`-`4` | Select time range (5m / 15m / 1h / 24h) |
| `m` | Toggle full-screen world map |

### Connections

| Key | Action |
|-----|--------|
| `1`-`5` | Sort by column |
| `l` | Toggle LISTEN connections |
| `x` | Toggle localhost filter |
| `f` + typing | Live filter (any key works while typing; `Enter` done, `Esc` clear) |

### Servers

| Key | Action |
|-----|--------|
| `s` | Trigger full scan (enumerate + probe + classify) |
| `o` | Open server's folder in Explorer |
| `y` | Copy exe path to clipboard |
| `f` + typing | Live filter (any key works while typing; `Enter` done, `Esc` clear) |

### Firewall

| Key | Action |
|-----|--------|
| `b` | Block selected app |
| `a` | Allow selected app |
| `d` | Delete firewall rule |

---

## How It Works

### Connection Tracking
`GetExtendedTcpTable` and `GetExtendedUdpTable` from `iphlpapi.dll` enumerate all TCP/UDP connections with owning process IDs.

### DNS Resolution
Dual-source: `DnsGetCacheDataTable` API (every tick) + `ipconfig /displaydns` parsing (periodic) for full coverage without generating network traffic.

### GeoIP
The [DB-IP](https://db-ip.com/) country-level MaxMind-format database is embedded in the binary. Lookups are instantaneous — no network calls.

### Service Fingerprinting
A custom fingerprint database matches process names, ports, and banner patterns to identify 200+ server types. Additionally, HTTP responses are analyzed against the Wappalyzer technology database (6,500+ signatures).

### Device Discovery
ARP table enumeration plus active probing discovers devices on the local network. MAC addresses are matched against a 35,000-entry OUI database to identify manufacturers.

### Packet Capture
Raw sockets with `SIO_RCVALL` (promiscuous mode) capture IP packets. Headers are parsed for protocol/port information; payloads are extracted for the Wire preview. Requires Administrator.

---

## Architecture

```
psnet/
├── Cargo.toml
├── data/
│   ├── dbip-country-lite.mmdb    # GeoIP country database (7 MB, embedded)
│   ├── fingerprints.json         # Server fingerprint signatures (embedded)
│   ├── oui.txt                   # MAC vendor prefixes (embedded)
│   └── wappalyzer.json           # Web technology signatures (embedded)
└── src/
    ├── main.rs                   # Entry point, event loop, terminal setup
    ├── app.rs                    # Application state, input handling, tick logic
    ├── types.rs                  # Shared types (Connection, TcpState, BottomTab, etc.)
    ├── utils.rs                  # Formatting helpers (speed, bytes, etc.)
    ├── network/
    │   ├── alerts.rs             # Alert engine — threat detection
    │   ├── bandwidth.rs          # Per-app bandwidth tracking
    │   ├── capture.rs            # Traffic event tracker (diff-based)
    │   ├── connections.rs        # Win32 FFI for TCP/UDP table enumeration
    │   ├── dns.rs                # Windows DNS cache reader + service port map
    │   ├── firewall.rs           # Windows Firewall rule management
    │   ├── geoip.rs              # MaxMind GeoIP lookups
    │   ├── hostnames.rs          # Hostname resolution
    │   ├── oui.rs                # MAC vendor OUI database
    │   ├── protocols.rs          # Protocol identification
    │   ├── scanner.rs            # LAN device scanner (ARP)
    │   ├── sniffer.rs            # Raw socket packet sniffer
    │   ├── speed.rs              # Network speed via sysinfo
    │   ├── system_monitor.rs     # System resource monitoring
    │   ├── threats.rs            # Threat intelligence
    │   ├── usage.rs              # Network usage accounting
    │   ├── networks/             # Multi-adapter discovery (VPN, Docker, WSL, etc.)
    │   └── servers/              # Listening port scanner + fingerprinting
    │       ├── classify.rs       # Server classification logic
    │       ├── fingerprint.rs    # Banner fingerprinting
    │       ├── fingerprints.rs   # Fingerprint database loader
    │       ├── listeners.rs      # Port enumeration
    │       ├── types.rs          # Server types + 200 known server definitions
    │       └── wappalyzer_db.rs  # Wappalyzer technology database
    └── ui/
        ├── mod.rs                # Master layout (title + speed + tabs + wire + status)
        ├── dashboard.rs          # Dashboard tab (traffic graph, world map, health)
        ├── connections.rs        # Connections tab (sortable table)
        ├── servers.rs            # Servers tab (card list + exposure panel)
        ├── packets_tab.rs        # Packets tab (Wireshark-style inspector)
        ├── topology.rs           # Topology tab (network diagram)
        ├── alerts.rs             # Alerts tab (categorized alerts)
        ├── firewall.rs           # Firewall tab (app block/allow)
        ├── devices.rs            # Devices tab (LAN scanner results)
        ├── networks.rs           # Networks tab (adapters, VPN, Docker, etc.)
        ├── detail_popup.rs       # Modal detail overlay
        ├── title.rs              # Title bar
        ├── speed.rs              # Speed sparklines + gauges
        ├── packets.rs            # Wire preview (always visible)
        ├── status.rs             # Tab menu + key hints
        └── widgets/              # Reusable chart widgets
            ├── bar_chart.rs
            ├── traffic_chart.rs
            ├── world_map.rs
            ├── health_gauge.rs
            └── ...
```

### Dependencies

| Crate | Purpose |
|-------|---------|
| [ratatui](https://github.com/ratatui/ratatui) | Terminal UI framework |
| [crossterm](https://github.com/crossterm-rs/crossterm) | Cross-platform terminal I/O |
| [sysinfo](https://github.com/GuillaumeGomez/sysinfo) | Network interface byte counters |
| [chrono](https://github.com/chronotope/chrono) | Timestamp formatting |
| [serde](https://github.com/serde-rs/serde) + serde_json | Fingerprint/Wappalyzer JSON parsing |
| [maxminddb](https://github.com/oschwald/maxminddb-rust) | GeoIP database reader |
| [dns-lookup](https://github.com/keeperofdakeys/dns-lookup) | Hostname resolution |
| [dirs](https://github.com/dirs-dev/dirs-rs) | Platform directory paths |

**No Npcap. No WinPcap. Zero external runtime dependencies.**

---

## FAQ

**Q: Why Windows only?**
A: PSNET uses Windows-specific APIs (`iphlpapi.dll`, `dnsapi.dll`, `ws2_32.dll`, `kernel32.dll`, Windows Firewall COM) for deep system integration that cross-platform abstractions can't match.

**Q: Do I need Npcap/WinPcap?**
A: No. All features use built-in Windows APIs and raw sockets.

**Q: Why do some connections show IPs instead of hostnames?**
A: PSNET reads the Windows DNS cache. Connections established before PSNET launched may not have cached DNS entries yet. Over time, more hostnames will resolve.

**Q: Why is the Wire preview empty?**
A: It requires Administrator privileges. Right-click your terminal → "Run as Administrator" → run `psnet`. Encrypted (TLS) traffic won't produce readable ASCII.

**Q: How big is the binary?**
A: ~12 MB. This includes 4 embedded databases (GeoIP 7 MB, OUI 1 MB, fingerprints, Wappalyzer). No additional files to download.

---

## Contributing

Contributions are welcome! Areas where help would be great:

- 🐧 **Linux/macOS support** — replacing Win32 FFI with platform-specific equivalents
- 💾 **Export** — save connection logs / packet captures to CSV/JSON/PCAP
- 🎨 **Themes** — configurable color schemes
- 🧪 **Testing** — unit and integration tests

## License

MIT License — see [LICENSE](LICENSE) for details.

---

◈ PSNET — See your network. Understand your network.
 
 Built with Rust 🦀 and love for the terminal.

psnet

psnet Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

psnet

psnet Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README