Open-source system monitor in Rust, a Task Manager alternative with a focus on the network: which process talks to which address. Windows first, then Linux and macOS.
| Stage | Scope | State |
|---|---|---|
| 1 | Processes, Performance, Network on Windows, no admin rights | Done |
| 2 | ASN, country, cloud labels, blocklists, grouping, SQLite history | Done |
| 3 | ETW traffic per process, DNS and SNI names, PTR fallback | Done, needs administrator rights |
| 4 | NVIDIA GPU, services, startup entries, process tree | Done |
| 5 | Linux and macOS providers | Planned |
Values the OS does not provide are shown as —, never as zero. The Memory
column is the working set; see docs/decisions.md for why
values differ from Task Manager.
crates/nazorat-core: platform-independent types, history buffer and portscrates/nazorat-provider: default provider,sysinfoandnetstat2crates/nazorat-intel: local IP reference data and its downloadscrates/nazorat-history: SQLite history of connectionscrates/nazorat-etw: traffic, DNS and TLS name capture through ETW on Windowscrates/nazorat-app: egui UI, binarynazorat
Everything works without them except traffic per process and remote names, which
show —. For those, start nazorat.exe as administrator. Names show their source:
- DNS: the answer to a query made through the Windows DNS client
- SNI: the server name in a TLS handshake, read from outgoing packets
- PTR: reverse DNS, a guess, only if you turn on Reverse DNS
Apps with their own resolver produce no DNS events. Encrypted ClientHello and QUIC, which many browsers use, hide the server name from SNI capture. Names are learned by watching, so connections opened before nazorat started have none until the app connects again.
Addresses seen on this machine are looked up locally and not sent anywhere. The
one exception is Reverse DNS: it is off by default, and each lookup tells your
DNS server the address. Packets are read only to find the server name in a TLS
handshake and are not stored.
On first start and when files get old, nazorat downloads published reference
files into %LOCALAPPDATA%\nazorat\data; run with --offline to prevent that.
Connection history stays in history.db in the same folder and is deleted after
90 days. History is sampled once per poll, so very short connections can be
missing from it.
Nothing below is stored in this repository.
| Data | Source | Terms |
|---|---|---|
| ASN, organization, country | DB-IP Lite | CC BY 4.0, attribution shown in the app |
| Cloud ranges | Published lists of AWS, Google Cloud, Azure, Cloudflare | Provider terms |
| Blocklists | abuse.ch Feodo Tracker, FireHOL Level 1 | List terms |
A blocklist entry means an address is listed, not that a connection is malicious. Country data is approximate, especially for anycast addresses.
Requires stable Rust; on Windows, the MSVC build tools.
cargo run -p nazorat-app
Use -- --tab <overview|processes|performance|network|services|startup> to choose
the startup tab. A second start brings the running window forward; --new-instance
opens another one, which does not write history.
Licensed under either of Apache License 2.0 or MIT license at your option.
The bundled Manrope font is licensed under the SIL Open Font License 1.1.