HN Explorer

Show HN: Network Monitor – a GUI to spot anomalous connections on your Linux

156 points by grigio ↗ HN
A real-time network connection monitoring tool built with Rust and GTK4, displaying active connections with live I/O statistics in a modern graphical interface. https://github.com/grigio/network-monitor

23 comments

[ 3.1 ms ] story [ 44.2 ms ] thread
SlavikCA
That screenshot / video on README page is mostly unreadable. Can't get anything out of it.
mordechai9000
Nice work!

I do want to say, I don't like having to rely on scraping ss output. But that's not a comment on this project - I have done the exact same thing. It just proved to be the most expedient way given the constraints I was under. I suspect there is a lot of devops and CI/CD code out there that relies on the output format of ss. My concern is that parsing text intended for human readability and not machine processing is brittle and prone to failure due to unforeseen circumstances, or a package upgrade that changes the behavior.

mbana
I was going to say the same thing.

I really like the eBPF approach as pointed out to by the other comments. I feel like this is the ideal approach, please correct me if I'm wrong.

A callback based approach as opposed to (constantly) polling the output of some command is ideal.

WD-42
Nice work. I’ve been writing an app using the same stack. The gtk-rs bindings are actually pretty productive once you get used to it! And it’s so fast.
mroche
Cool project! As a more advanced form, I think it should be possible to get all this information via eBPF rather than ss output and scraping /proc.

Food for thought!

oneshtein
eBPF doesn't work on locked down kernels (stock kernels in Secure Boot mode).
pm2222
eBPF/XDP is nice and hard to use. Packet capture is so common that I wish that there were a simpler way like pcap.
jrm4
Fantastic, more of this. I don't know if I'm just missing it or what, but I'd love a GUI thing that showed all the devices on my network maybe even with a graph view.

I'm using an Eero router out of laziness and even it has some features here that I'd like to see more of in polished "home-user" style network tools; especially since it seems as if more are getting into the "homelab"/"selfhosted" thing.

bongodongobob
That's impossible to do reliably without using agents, SNMP, or some other kind of communication protocol that you'll have to set up on each device. If you're ok with that, use SNMP. If you want topology, you'll have to have an agent that logs into all your networking gear and parses the configs.
XiS
So nethogs, but with a gui?
lone-cloud
The code is partly refined AI generated slop and the UX is lacking. The functionality is very basic and needs to be more thoroughly tested. This type of project is half a work day tops for a senior+ dev to create with agentic coding.
neilv
Thanks especially for using GTK with Rust to do this. We need to keep desktop Linux GUI libraries alive and viable (as an alterative to Web site GUI frameworks, Electron apps with Web frameworks, and proprietary mobile app platforms).
BoppreH
Cool project, I wish we had more GUIs for these OS functions. How was your experience with GTK4 and Rust?

And it's a bit sad that in the year of our lord 2025, the best way to get such fundamental information is by using regexes to parse a table[1], generated by a 6000-line C program[2], which is verified by (I hope I'm wrong!) a tiny test suite[3]. OSQuery[4] is also pretty cool, but it builds upon this fragile stack.

That's something I miss from Windows, at least PowerShell has built-in commands that give you structured output.

[1] https://github.com/grigio/network-monitor/blob/9dc470553bfdd...

[2] https://github.com/iproute2/iproute2/blob/main/misc/ss.c

[3] https://github.com/iproute2/iproute2/blob/main/testsuite/tes...

[4] https://osquery.io/

heybrendan
I see that you're parsing `ss` output in 'src/services/network.rs' (L22-L31) [1]. I find this to be a rather shaky foundation as any future drift or deviation in the `ss` utility's output could potentially yield unforeseen consequences.

I'm vaguely aware that there are crates available in the Rust ecosystem for interrogating and manipulating sockets much more directly as well as high level abstractions for all things netlink (read: AF_NETLINK). Is wielding Rust's socket/netlink libraries unsuitable in some way, or was it merely deemed out of the design scope?

Very cool project, please keep going!

[1] https://github.com/grigio/network-monitor/blob/master/src/se...

grigio
Thanks, I use native rust libs now
Beijinger
On a first look: The same as the shell tool nethogs, just with a GUI
kazishariar
Submitted a pull request for MacOS Support - please approve. Tnx!
cookiengineer
This shows only the contents of /proc fs, right?

If you want realtime connection details, eBPF and XDP allow much more insights for that, as you can also parse network protocol payloads and implement adapters for each network protocol.

butz
First, a praise: Thank you for using native desktop UI, not some web framework and shipping additional browser along. And a bit of critique: Main screenshot should be bigger, and present the main view of the application. Ability to switch light/dark mode comes by default and target audience is more likely to see what data application displays and how.