socktop

Interactive network connection monitor with real-time traffic visualization.

Like ss or netstat, but shows which process generates how much traffic, who it talks to, and live sparklines.

Features

• TUI with one row per socket (process → IP:PORT)
• Sparkline traffic history for the last 10 seconds (60 buckets × 166ms)
• Process resolution via /proc/<pid>/fd inode mapping
• AF_PACKET raw capture in C++ (zero-copy ring buffers)
• Keyboard navigation: ↑↓ select, Enter detail, q quit

Architecture

socktop/
├── native/
│   ├── pkt_capture.hpp      # C++ AF_PACKET capture + ring buffers
│   ├── pkt_capture.cpp      # Zero-copy raw packet reader
│   └── CMakeLists.txt       # Static lib build
├── src/
│   ├── main.rs              # TUI event loop (ratatui + crossterm)
│   ├── ffi.rs               # FFI bindings to C++ lib
│   ├── proc_parser.rs       # /proc/net/tcp,udp parser + inode→pid
│   └── traffic.rs           # Sparkline history + traffic tracker
├── Cargo.toml
├── build.rs                 # CMake integration
├── build_and_run.sh
└── README.md

Build

# Requires: cmake, g++, rust toolchain
cargo build --release

Or use the helper script:

sudo ./build_and_run.sh -i eth0

Usage

# Monitor eth0 (default)
sudo ./target/release/socktop

# Monitor specific interface
sudo ./target/release/socktop -i wlan0

# Monitor all traffic on lo
sudo ./target/release/socktop -i lo

Controls

Key	Action
↑/k	Select previous socket
↓/j	Select next socket
Enter	Show socket detail view
Esc	Close detail view
q	Quit
r	Force refresh
PageUp	Scroll detail up
PageDown	Scroll detail down

How it works

1. C++ layer opens AF_PACKET socket, captures raw Ethernet frames
2. Parses IP/TCP/UDP headers, extracts 4-tuple + byte count
3. Stores per-socket stats in a lock-free ring buffer (256 packets)
4. Rust layer reads /proc/net/tcp and /proc/net/udp for socket list
5. Maps socket inodes to PIDs via /proc/<pid>/fd symlinks
6. Feeds captured bytes into per-socket sparkline history (60 × 166ms buckets)
7. Renders TUI with ratatui, refreshes at 5 FPS

Requirements

• Linux (AF_PACKET + /proc/net)
• Root or CAP_NET_RAW capability
• cmake, g++ (for C++ native library)
• Rust toolchain