Feature/interface stats (#79)

* feat: adding interface stats

* macOS specific improvements

* fix windows interface stats

Author: domcyrus

Cargo.toml

@@ -49,10 +49,14 @@ libbpf-rs = { version = "0.25", optional = true }
 bytes = { version = "1.11", optional = true }
 libc = { version = "0.2", optional = true }
 
+[target.'cfg(any(target_os = "macos", target_os = "freebsd"))'.dependencies]
+libc = "0.2"
+
 [target.'cfg(windows)'.dependencies]
 windows = { version = "0.62", features = [
     "Win32_Foundation",
     "Win32_NetworkManagement_IpHelper",
+    "Win32_NetworkManagement_Ndis",
     "Win32_Networking_WinSock",
     "Win32_System_LibraryLoader",
     "Win32_System_Threading",
@@ -74,6 +78,7 @@ zip = "6.0"
 windows = { version = "0.62", features = [
     "Win32_Foundation",
     "Win32_NetworkManagement_IpHelper",
+    "Win32_NetworkManagement_Ndis",
     "Win32_Networking_WinSock",
     "Win32_System_LibraryLoader",
     "Win32_System_Threading",

README.md

@@ -15,6 +15,7 @@ A cross-platform network monitoring tool built with Rust. RustNet provides real-
 
 - **Real-time Network Monitoring**: Monitor active TCP, UDP, ICMP, and ARP connections with detailed state information
 - **Connection States**: Track TCP states (`ESTABLISHED`, `SYN_SENT`, `TIME_WAIT`), QUIC states (`QUIC_INITIAL`, `QUIC_HANDSHAKE`, `QUIC_CONNECTED`), DNS states, SSH states, and activity-based UDP states
+- **Interface Statistics**: Real-time monitoring of network interface metrics including bytes/packets transferred, errors, drops, and collisions
 - **Deep Packet Inspection (DPI)**: Detect application protocols including HTTP, HTTPS/TLS with SNI, DNS, SSH with version detection, and QUIC with CONNECTION_CLOSE frame detection
 - **TCP Network Analytics**: Real-time detection of TCP retransmissions, out-of-order packets, and fast retransmits with per-connection and aggregate statistics
 - **Smart Connection Lifecycle**: Protocol-aware timeouts with visual staleness indicators (white → yellow → red) before cleanup
@@ -56,6 +57,28 @@ See [EBPF_BUILD.md](EBPF_BUILD.md) for more details and [ARCHITECTURE.md](ARCHIT
 
 </details>
 
+<details>
+<summary><b>Interface Statistics Monitoring</b></summary>
+
+RustNet provides real-time network interface statistics across all supported platforms:
+
+- **Overview Tab**: Shows active interfaces with current rates, errors, and drops
+- **Interfaces Tab** (press `i`): Detailed table with comprehensive metrics for all interfaces
+- **Cross-Platform**: Linux (sysfs), macOS/FreeBSD (getifaddrs), Windows (GetIfTable2 API)
+- **Smart Filtering**: Windows automatically excludes virtual/filter adapters
+
+See [USAGE.md](USAGE.md#interface-statistics) for detailed documentation on interpreting interface statistics and platform-specific behavior.
+
+**Metrics Available:**
+- Total bytes and packets (RX/TX)
+- Error counters (receive and transmit)
+- Packet drops (queue overflows)
+- Collisions (legacy, rarely used on modern networks)
+
+Stats are collected every 2 seconds in a background thread with minimal performance impact.
+
+</details>
+
 ## Quick Start
 
 ### Installation
@@ -121,6 +144,7 @@ See [INSTALL.md](INSTALL.md) for detailed permission setup and [USAGE.md](USAGE.
 | `q` | Quit (press twice to confirm) |
 | `Ctrl+C` | Quit immediately |
 | `Tab` | Switch between tabs |
+| `i` | Toggle interface statistics view |
 | `↑/k` `↓/j` | Navigate up/down |
 | `g` `G` | Jump to first/last connection |
 | `Enter` | View connection details |

USAGE.md

@@ -10,6 +10,7 @@ This guide covers detailed usage of RustNet, including command-line options, key
 - [Filtering](#filtering)
 - [Sorting](#sorting)
 - [Network Statistics Panel](#network-statistics-panel)
+- [Interface Statistics](#interface-statistics)
 - [Connection Lifecycle & Visual Indicators](#connection-lifecycle--visual-indicators)
 - [Logging](#logging)
 
@@ -192,6 +193,7 @@ Log files are created in the `logs/` directory with timestamp: `rustnet_YYYY-MM-
 ### Views and Tabs
 
 - `Tab` - Switch between tabs (Overview, Details, Help)
+- `i` - Toggle Interface Statistics view
 - `Enter` - View detailed information about selected connection
 - `Esc` - Go back to previous view or clear active filter
 - `h` - Toggle help screen
@@ -463,6 +465,126 @@ Fast retransmit frequency indicates how well TCP is recovering from packet loss
 - SYN and FIN flags are properly accounted for in sequence number tracking (each consumes 1 sequence number)
 - Only TCP connections show analytics; UDP, ICMP, and other protocols do not have these metrics
 
+## Interface Statistics
+
+RustNet provides real-time network interface statistics across all supported platforms (Linux, macOS, FreeBSD, Windows). Interface stats are displayed in two locations:
+
+### Accessing Interface Statistics
+
+**Overview Tab (Main Screen):**
+- Interface stats appear in the right panel below Network Stats
+- Shows up to 3 active interfaces with current rates
+- Displays: `InterfaceName: X KB/s ↓ / Y KB/s ↑`
+- Shows cumulative totals: `Errors (Total): N  Drops (Total): M`
+
+**Interfaces Tab (Detailed View):**
+- Press `i` to toggle the Interface Statistics view
+- Shows a detailed table of all network interfaces
+- Displays comprehensive metrics for each interface
+
+### Statistics Displayed
+
+| Metric | Description | Notes |
+|--------|-------------|-------|
+| **RX Rate** | Current receive rate (bytes/sec) | Calculated from recent activity |
+| **TX Rate** | Current transmit rate (bytes/sec) | Calculated from recent activity |
+| **RX Packets** | Total packets received | Cumulative since boot/interface up |
+| **TX Packets** | Total packets transmitted | Cumulative since boot/interface up |
+| **RX Err** | Receive errors | Cumulative total (not recent) |
+| **TX Err** | Transmit errors | Cumulative total (not recent) |
+| **RX Drop** | Dropped incoming packets | Cumulative total (not recent) |
+| **TX Drop** | Dropped outgoing packets | Cumulative total (not recent) |
+| **Collisions** | Network collisions | Platform-dependent availability |
+
+**Important**: Error and drop counters are **cumulative totals** since the system booted or the interface came up, not recent activity. These help identify long-term interface reliability but won't show immediate issues.
+
+### Platform-Specific Behavior
+
+**All Platforms:**
+- All counters (bytes, packets, errors, drops) are cumulative from boot/interface up
+- Rates (bytes/sec) are calculated from snapshots taken every 2 seconds
+- Loopback interface is included for monitoring local traffic
+
+**Windows:**
+- Filters out virtual/filter adapters to show only physical interfaces:
+  - Excludes: `-Npcap`, `-WFP`, `-QoS`, `-Native`, `-Virtual`, `-Packet` variants
+  - Excludes: `Lightweight Filter`, `MAC Layer` interfaces
+  - Excludes: Disconnected "Local Area Connection" adapters
+- Uses LUID-based deduplication to prevent duplicate interface entries
+- Collisions: Always 0 (not available on modern Windows interfaces)
+
+**macOS:**
+- Includes data validation to detect corrupt counters on virtual interfaces
+- TX Drops: Always 0 (limited availability on macOS)
+- Sanitizes error/drop counters if values appear corrupted (>2^31 or errors>packets)
+
+**FreeBSD:**
+- TX Drops: Always 0 (not typically available on FreeBSD)
+- Uses BSD getifaddrs API with AF_LINK filtering
+
+**Linux:**
+- Reads statistics from `/sys/class/net/{interface}/statistics`
+- All counters typically available and reliable
+
+### Interpreting the Statistics
+
+**Healthy Interface:**
+```
+Ethernet: 2.40 KB/s ↓ / 1.96 KB/s ↑
+  Errors (Total): 0  Drops (Total): 0
+```
+Zero or very low error/drop counts indicate a reliable network connection.
+
+**Problematic Interface:**
+```
+WiFi: 150 KB/s ↓ / 45 KB/s ↑
+  Errors (Total): 1089  Drops (Total): 2178
+```
+High error/drop counts may indicate:
+- Signal interference (WiFi)
+- Cable issues (Ethernet)
+- Network congestion
+- Driver or hardware problems
+
+**Note**: Since error/drop counters are cumulative, evaluate them relative to total packets. A few errors out of millions of packets is normal; thousands of errors with low packet counts indicates problems.
+
+### Interface Filtering
+
+**Which Interfaces Are Shown:**
+- Interfaces must be operationally "up" OR have traffic statistics
+- Loopback interface is included (useful for monitoring local connections)
+- Virtual/filter adapters are excluded on Windows (they mirror physical interfaces)
+
+**Overview Tab Filtering:**
+- Windows: Shows all active interfaces (NPF device path detected automatically)
+- macOS/Linux: Shows interfaces with recent traffic (`rx_bytes > 0 || tx_bytes > 0 || rx_packets > 0 || tx_packets > 0`)
+- Special interfaces (`any`, `pktap`): Shows all interfaces with any activity
+
+**Interfaces Tab:**
+- Shows all detected interfaces that pass the platform-specific filters
+- Sorts to show the currently captured interface first (highlighted)
+- Other interfaces appear in alphabetical order
+
+### Use Cases
+
+**Bandwidth Monitoring:**
+Monitor real-time bandwidth usage across all network interfaces to identify:
+- Which interface is carrying the most traffic
+- Bandwidth distribution across WiFi vs Ethernet
+- Local traffic volume (loopback interface)
+
+**Reliability Analysis:**
+Check cumulative error and drop counters to:
+- Identify unreliable network interfaces
+- Detect hardware or driver issues
+- Compare interface quality over time
+
+**Multi-Interface Systems:**
+On systems with multiple network interfaces:
+- Compare performance across interfaces
+- Monitor VPN tunnel statistics
+- Track interface failover behavior
+
 ## Connection Lifecycle & Visual Indicators
 
 RustNet uses intelligent timeout management to automatically clean up inactive connections while providing visual warnings before removal.

src/app.rs

@@ -15,13 +15,24 @@ use crate::filter::ConnectionFilter;
 
 use crate::network::{
     capture::{CaptureConfig, PacketReader, setup_packet_capture},
+    interface_stats::{InterfaceStats, InterfaceStatsProvider, InterfaceRates},
     merge::{create_connection_from_packet, merge_packet_into_connection},
     parser::{PacketParser, ParsedPacket, ParserConfig},
     platform::create_process_lookup,
     services::ServiceLookup,
     types::{ApplicationProtocol, Connection, Protocol},
 };
 
+// Platform-specific interface stats provider
+#[cfg(target_os = "linux")]
+use crate::network::platform::LinuxStatsProvider as PlatformStatsProvider;
+#[cfg(target_os = "freebsd")]
+use crate::network::platform::FreeBSDStatsProvider as PlatformStatsProvider;
+#[cfg(target_os = "macos")]
+use crate::network::platform::MacOSStatsProvider as PlatformStatsProvider;
+#[cfg(target_os = "windows")]
+use crate::network::platform::WindowsStatsProvider as PlatformStatsProvider;
+
 use std::collections::HashMap;
 use std::sync::{LazyLock, Mutex};
 
@@ -190,6 +201,12 @@ pub struct App {
 
     /// Current process detection method (e.g., "eBPF + procfs", "pktap", "lsof", "N/A")
     process_detection_method: Arc<RwLock<String>>,
+
+    /// Interface statistics (cumulative totals)
+    interface_stats: Arc<DashMap<String, InterfaceStats>>,
+
+    /// Interface rates (per-second rates)
+    interface_rates: Arc<DashMap<String, InterfaceRates>>,
 }
 
 impl App {
@@ -212,6 +229,8 @@ impl App {
             linktype: Arc::new(RwLock::new(None)),
             pktap_active: Arc::new(AtomicBool::new(false)),
             process_detection_method: Arc::new(RwLock::new(String::from("initializing..."))),
+            interface_stats: Arc::new(DashMap::new()),
+            interface_rates: Arc::new(DashMap::new()),
         })
     }
 
@@ -237,6 +256,9 @@ impl App {
         // Start rate refresh thread
         self.start_rate_refresh_thread(connections)?;
 
+        // Start interface stats collection thread
+        self.start_interface_stats_thread()?;
+
         // Mark loading as complete after a short delay
         let is_loading = Arc::clone(&self.is_loading);
         thread::spawn(move || {
@@ -769,6 +791,56 @@ impl App {
         Ok(())
     }
 
+    /// Start interface statistics collection thread
+    fn start_interface_stats_thread(&self) -> Result<()> {
+        let should_stop = Arc::clone(&self.should_stop);
+        let interface_stats = Arc::clone(&self.interface_stats);
+        let interface_rates = Arc::clone(&self.interface_rates);
+
+        thread::spawn(move || {
+            info!("Interface stats collection thread started");
+
+            let provider = PlatformStatsProvider;
+            let mut previous_stats: HashMap<String, InterfaceStats> = HashMap::new();
+
+            loop {
+                if should_stop.load(Ordering::Relaxed) {
+                    info!("Interface stats thread stopping");
+                    break;
+                }
+
+                // Collect stats from all interfaces
+                match provider.get_all_stats() {
+                    Ok(stats_vec) => {
+                        // Clear old entries
+                        interface_stats.clear();
+                        interface_rates.clear();
+
+                        for stat in stats_vec {
+                            // Calculate rates if we have previous data
+                            if let Some(prev) = previous_stats.get(&stat.interface_name) {
+                                let rates = stat.calculate_rates(prev);
+                                interface_rates.insert(stat.interface_name.clone(), rates);
+                            }
+
+                            // Store current stats
+                            interface_stats.insert(stat.interface_name.clone(), stat.clone());
+                            previous_stats.insert(stat.interface_name.clone(), stat);
+                        }
+                    }
+                    Err(e) => {
+                        debug!("Failed to collect interface stats: {}", e);
+                    }
+                }
+
+                // Refresh every 2 seconds
+                thread::sleep(Duration::from_secs(2));
+            }
+        });
+
+        Ok(())
+    }
+
     /// Start cleanup thread to remove old connections
     fn start_cleanup_thread(&self, connections: Arc<DashMap<String, Connection>>) -> Result<()> {
         let should_stop = Arc::clone(&self.should_stop);
@@ -870,6 +942,22 @@ impl App {
             .collect()
     }
 
+    /// Get interface statistics
+    pub fn get_interface_stats(&self) -> Vec<InterfaceStats> {
+        self.interface_stats
+            .iter()
+            .map(|entry| entry.value().clone())
+            .collect()
+    }
+
+    /// Get interface rates (bytes/sec)
+    pub fn get_interface_rates(&self) -> HashMap<String, InterfaceRates> {
+        self.interface_rates
+            .iter()
+            .map(|entry| (entry.key().clone(), entry.value().clone()))
+            .collect()
+    }
+
     /// Get application statistics
     pub fn get_stats(&self) -> AppStats {
         AppStats {

src/main.rs

@@ -364,20 +364,30 @@ fn run_ui_loop<B: ratatui::prelude::Backend>(
                     // Tab navigation
                     (KeyCode::Tab, _) => {
                         ui_state.quit_confirmation = false;
-                        ui_state.selected_tab = (ui_state.selected_tab + 1) % 3;
+                        ui_state.selected_tab = (ui_state.selected_tab + 1) % 4;
                     }
 
                     // Help toggle
                     (KeyCode::Char('h'), _) => {
                         ui_state.quit_confirmation = false;
                         ui_state.show_help = !ui_state.show_help;
                         if ui_state.show_help {
-                            ui_state.selected_tab = 2; // Switch to help tab
+                            ui_state.selected_tab = 3; // Switch to help tab
                         } else {
                             ui_state.selected_tab = 0; // Back to overview
                         }
                     }
 
+                    // Interface stats toggle (shortcut to Interface tab)
+                    (KeyCode::Char('i'), _) | (KeyCode::Char('I'), _) => {
+                        ui_state.quit_confirmation = false;
+                        if ui_state.selected_tab == 2 {
+                            ui_state.selected_tab = 0; // Back to overview
+                        } else {
+                            ui_state.selected_tab = 2; // Switch to interfaces tab
+                        }
+                    }
+
                     // Navigation in connection list
                     (KeyCode::Up, _) | (KeyCode::Char('k'), _) => {
                         ui_state.quit_confirmation = false;