lsoff-rs

A blazingly fast, multi-core, zero-overhead Rust port of lsoff. Inspect, search, filter, and kill listening network ports with a beautiful interactive TUI or scriptable CLI.

---

Origin

lsoff-rs is a high-performance Rust rewrite of the popular Go CLI tool lsoff created by yutat23.

---

⚡ What's Improved Over the Original

1. Multi-Core Work-Stealing Parallelism (rayon):
   • Replaces sequential 600+ process enumeration with a lock-free parallel work-stealing pipeline (par_iter().flat_map_iter()), inspecting kernel socket file descriptors concurrently across all CPU cores.
2. Single-Syscall Fast-Path Kernel Discovery:
   • Eliminates the double-syscall pattern (proc_pidinfo for size probing + second call with buffer).
   • Employs stack-allocated [ProcFdInfo; 64] and [i32; 1024] buffers, allowing >95% of processes to be inspected in a single syscall, cutting kernel syscall volume by over 50%.
3. Apple Silicon Performance Core QoS Pinning:
   • Rayon worker threads on macOS are assigned QOS_CLASS_USER_INTERACTIVE, preventing macOS from scheduling socket scanning on low-power E-cores.
4. Linux Netlink sock_diag Engine:
   • Bypasses slow /proc/net/tcp ASCII parsing with high-speed binary Netlink messages (NETLINK_INET_DIAG), with pidfd_getfd fast paths and /proc fallback for containers.
5. Windows Native IP Helper Engine:
   • Direct binary GetExtendedTcpTable / GetExtendedUdpTable queries with TCP_TABLE_OWNER_PID_LISTENER.
6. FreeBSD Native sysctl Kernel Engine:
   • Direct binary kernel inspection using kern.proc.filedesc (kinfo_file), kern.proc.pathname, and kern.proc.args for full BSD support.
7. Advanced IPv6 & CIDR Subnet Filtering:
   • Native support for CIDR IP ranges (lsoff 127.0.0.0/8, lsoff 192.168.1.0/24, lsoff ::1/128, lsoff fe80::/10), IPv6 interface scope IDs (%en0, %eth0), and dual-stack IPv4-mapped normalization (::ffff:127.0.0.1).
8. Zero-Allocation Stack Execution & Buffered I/O:
   • Zero heap allocations in hot sysctl loops (kern.procargs2), zero-copy ANSI stripping, and 64 KB BufWriter on standard streams.
9. Ultra-Lean Binary Size:
   • Stripped, LTO-optimized release binary is 671 KB (nearly 8x smaller than Go's 4.91 MB).

---

Benchmark Comparisons: Go (lsoff) vs Rust (lsoff-rs)

Benchmarked on Apple Silicon (darwin/arm64) over 50–100 iterations with warmups:

1. In-Process Kernel Socket Enumeration (100 Runs)

Measures raw time spent discovering, inspecting, filtering, and sorting all active listening sockets across the OS:

Implementation	Mean Latency	Min Latency	Max Latency	Speedup
Go (listen.List())	2,228.37 µs (2.23 ms)	1,906.00 µs (1.91 ms)	4,264.00 µs (4.26 ms)	Baseline
Rust (sys::list_listeners())	778.47 µs (0.78 ms)	616.00 µs (0.62 ms)	1,142.00 µs (1.14 ms)	~3x faster (Sub-millisecond)

---

2. End-to-End CLI Scenarios (50 Runs)

Scenario	Go (lsoff)	Rust (lsoff-rs)	Comparison
Full Table Scan	9.82 ± 0.22 ms	6.40 ± 0.54 ms	1.53x faster (53% faster)
TCP-Only (-t)	9.21 ± 0.18 ms	6.14 ± 0.20 ms	1.50x faster (50% faster)
JSON Output (--json)	8.72 ± 4.12 ms	6.01 ± 0.21 ms	1.45x faster (45% faster)
UDP-Only (-u)	7.87 ± 0.18 ms	6.03 ± 0.24 ms	1.31x faster (31% faster)
Search Query (ControlCenter)	7.73 ± 0.21 ms	6.00 ± 0.20 ms	1.29x faster (29% faster)
Search Query (vuio)	7.73 ± 0.19 ms	6.06 ± 0.22 ms	1.27x faster (27% faster)

Note: On macOS, ~5.2–5.5 ms is the fixed OS kernel baseline for fork() + execve() + dyld (linker startup). Rust's internal socket enumeration, formatting, and rendering takes < 0.8 ms.

---

Rust vs Go

1. Zero-Overhead Direct FFI (No CGo Context Switching):
   • In Go, calling C functions (cgo) requires the runtime to switch goroutine stacks, switch from the green-thread scheduler to an OS thread, and save register contexts, costing ~50–100 ns per call. Across 1,500+ kernel syscalls, Go wastes significant CPU time purely on CGo switching.
   • In Rust, extern "C" compiles to a single direct CPU assembly instruction (bl/call) with zero nanoseconds overhead.
2. Deterministic Stack Allocations & Zero GC:
   • Go's escape analysis often forces slices across function boundaries onto the heap, generating heap garbage and triggering GC barriers.
   • Rust guarantees stack allocation ([ProcFdInfo; 64], [i32; 1024]) and zero-copy byte slice references (&str, &[u8]).
3. Pure In-Kernel eBPF (aya):
   • Rust can compile kernel-side eBPF bytecode directly (aya-bpf), sharing the exact same #[repr(C)] memory layouts between userspace and kernel without requiring C headers or clang wrappers.
4. Instant Cold-Start Execution:
   • Rust binaries jump directly to _main in userspace with zero runtime initialization, making command-line pipes (lsoff | grep ...) execute instantly.

---

Installation

Build from Source

cargo install lsoff-rs

Downloading

Take latest release from GitHub Releases.

---

Usage & Examples

Interactive TUI Mode

Simply run lsoff-rs in any interactive terminal:

lsoff-rs

TUI Keyboard Shortcuts

Key	Action
/	Live fuzzy filter / search as you type
↑ / ↓ or j / k	Move cursor selection
enter / space	Expand or collapse grouped processes (▸ / ▾)
h / l	Collapse / expand process
s / S	Cycle sort column / reverse order
y	Copy selected address:port to system clipboard
a	Toggle auto-refresh mode
r	Manually refresh listeners
x	Kill selected process (prompts confirmation modal)
esc / ctrl+c	Clear search query
q	Quit

---

Command-Line Interface (CLI)

# Show listeners on a specific port
lsoff-rs 8080

# Search by process name, project, path, PID, or CIDR subnet
lsoff-rs nginx
lsoff-rs 127.0.0.0/8
lsoff-rs fe80::/10
lsoff-rs "node 3000"

# Filter by protocol
lsoff-rs -t 8080      # TCP only
lsoff-rs -u 53        # UDP only

# Output as pretty JSON
lsoff-rs --json
lsoff-rs --json -t 8080

# Kill process listening on a port (with confirmation)
lsoff-rs -k 8080

# Kill without asking (for scripts and CI)
lsoff-rs -k -y 8080

---

License

Dual-licensed under either:

• MIT License (LICENSE-MIT)
• Apache License, Version 2.0 (LICENSE-APACHE)

Original Go project by yutat23 licensed under MIT.