A Rust desktop application for learning packet capture, protocol parsing, ARP monitoring, and traffic visualization.
ARP Sage started as a simple experiment to understand how packet capture tools actually work under the hood. At first it was only reading packets from a selected network device, but over time I kept expanding it by adding basic protocol parsing, ARP monitoring, traffic visualization, packet inspection, and a desktop interface.
The goal of the project was not to build a replacement for tools like Wireshark. The goal was to better understand how packet capture and network monitoring applications are built by implementing the core pieces myself.
The application is written in Rust using pcap for packet capture and egui for the desktop interface.
ARP Sage can capture packets from a selected network interface and display them live inside the application. It parses IPv4, TCP, UDP, and ARP packets, tracks source and destination IPs, maps common ports to services, and updates traffic graphs in realtime.
The project also contains a simple ARP monitoring system that keeps track of MAC/IP mappings and generates alerts when changes in ARP mappings is detected.
There is also a centralized alerts view where different security-related events are collected and displayed live while traffic is being captured.
The analytics section currently shows protocol distribution, basic packet statistics, packet counts, and some basic traffic information gathered from the captured packets.
This project isn't finished
| Section | Description | Link |
|---|---|---|
| Source Code | Main Rust application source | Open Source |
| Installer Script | Inno Setup installer configuration | View Installer |
| Assets | Fonts, icons, and UI resources | Open Assets |
| Releases | Download compiled installer builds | Open Releases |
flowchart LR
A[Selected Network Device]
--> B[Npcap Driver]
--> C[pcap Capture Layer]
--> D[Realtime Packet Engine]
--> E[IPv4 / TCP / UDP Parsers]
--> F[ARP Monitoring]
--> G[Alerts Engine]
--> H[Traffic Analytics]
--> I[egui Dashboard]
Note
The application requires packet capture driver support on Windows.
The installer already includes the required Npcap setup automatically.
You can download the latest installer directly from the Releases section:
The downloaded file will look something like:
ARP-Sage-Setup.exe
After downloading the setup file, run the installer normally like any other Windows desktop application.
During installation, the setup will also launch the Npcap installer automatically because packet capture on Windows depends on it. Without Npcap, the application would not be able to access network traffic from your system interfaces.
While installing Npcap, it is recommended to keep the default settings enabled.
Once the setup finishes, the installer creates:
- Desktop shortcut
- Start menu shortcut
- Installed application files
just like a normal desktop application.
After installation, open ARP Sage from either:
- Desktop shortcut
- Start menu
When the application starts, it will scan and display the available network interfaces detected on the system.
To begin monitoring:
- Select the network interface you want to monitor.
- Start capturing traffic.
- The dashboard, analytics, alerts, and packet views will begin updating live as packets are received.
Depending on the selected interface and the amount of network activity on your system, traffic updates may appear immediately or after a few seconds.
| ARP SAGE | DEVICES |
|---|---|
 |
 |
Right now the project mainly focuses on realtime packet monitoring and visualization. There are still many things I want to improve later including:
- flow/session tracking
- deeper protocol parsing
- packet export support
- PCAP recording
- Linux support
- better analytics
- better filtering
- protocol statistics
- performance optimization
I built this project to better understand how packet capture and network monitoring tools work by implementing the core functionality myself instead of only using existing tools.
Built by Sastha Ruban U
GitHub: https://github.com/Gappyjosuke