Rsut (Rust Monitor)

What it is

Rsut (a.k.a. Rust Monitor / AirMon-NG Pro) is a professional Wi-Fi monitoring and security-research suite. A Rust backend talks to the wireless card in monitor mode through raw sockets, parses 802.11 frames in real time, and streams everything over WebSocket to a Svelte 5 dashboard.

The README calls it “like airodump-ng, but 10× more optimized” — the important difference is the design rule behind it: real data only. If the backend is offline the UI says Backend OFFLINE and waits; no mock networks are ever rendered. Everything shown on screen is a parsed real frame.

Use only on networks you own or are authorized to test — the repository carries the same educational-use disclaimer.

Feature highlights

• Monitor mode control via ioctl (SIOCSIWMODE) + NetworkManager handling, channel hopping 1–13 (450 ms) or locking a channel.
• Raw 802.11 parsing — Radiotap headers, beacons, probe requests/responses, data frames; dBm signal extraction with zero-copy.
• Multiple capture engines (beyond the classic PMKID trick):
  • pmkid.rs — passive PMKID capture from EAPOL Message 1 (no deauth needed); writes hashcat -m 22000 compatible output.
  • handshake.rs — classic 4-way handshake capture for WPA2-PSK networks, counting EAPOL messages per BSSID|STA.
  • sae.rs — WPA3 SAE (Dragonfly) commit/confirm frame capture (auth frames 0xB0, groups like 19/20).
  • wps.rs — WPS PIN/checksum tooling (Reaver-style) with Pixie Dust notes for research.
• Real-time WebSocket protocol — update pushes (220 ms) with networks, stats and PMKID live events.
• Toolbox for authorized tests — client targeting, packet injection, beacon/jam/evil-twin/spoof panels with intensity controls (modules: inject.rs, jam.rs, eviltwin.rs, spoof.rs).
• Svelte 5 dashboard — runes ($state, $derived), RAF-throttled WebSocket store, virtualized table, canvas sparklines and packet graph, signal bars, encryption donut, live PMKID panel, CSV export.
• Persistence & extras — SQLite history (rusqlite), PCAP capture (pcap.rs), BPF filtering, GPS coordinates, caller-ID spoofing for VoIP research (spoof.rs).

Architecture (from the source)

The backend is split into focused modules rather than a monolith:

Module	Job
monitor.rs	monitor mode + channel via ioctl
sniffer.rs / bpf.rs	raw socket loop, radiotap + 802.11 parsing, BPF
network.rs / models.rs	network list, snapshots, serializable models
pmkid.rs / handshake.rs / sae.rs / wps.rs	capture engines
server.rs	WebSocket server + broadcast loop
inject.rs / jam.rs / eviltwin.rs / spoof.rs	attack/toolbox modules for authorized testing
pcap.rs / history.rs / gps.rs	PCAP writing, SQLite history, coordinates
client.rs / targets.rs	STA tracking & targeting
ui.rs / auth.rs	terminal UI helpers & auth

Frontend (frontend/, SvelteKit + Vite): +page.svelte dashboard, dedicated pages per module (beacon, clients, eviltwin, handshake, jam, pcap, …), with shared components SignalBar.svelte, Sparkline.svelte and a real-data WebSocket store.

Dependencies

• Backend (Rust): libc, tokio, tokio-tungstenite, futures-util, serde, serde_json, arc-swap, parking_lot, rusqlite (bundled SQLite), hmac, sha1, rand
• Frontend: Svelte 5, SvelteKit, @sveltejs/adapter-auto, Vite

Getting started

cargo build --release

# backend — Linux + a card that supports monitor mode, run as root
sudo ./target/release/rust_monitor on wlp0s20f3
sudo ./target/release/rust_monitor serve wlp0s20f3   # ws://127.0.0.1:8080 — real frames only

# frontend
cd frontend && npm install && npm run dev   # http://localhost:5173

Why it stands out

Reading raw 802.11 requires an unusual comfort with bytes: Radiotap present bitfields, frame control endianness, variable-length headers for QoS/ToDS/FromDS, EAPOL LLC 0x888E walks and RSN IE parsing — all hand-rolled in Rust. On top of that sits a real-time product-grade front end with genuinely live data. Rsut is security engineering where the hard part — correctness on the wire — is done properly, and the UI never lies.