A lightweight OSINT tool for monitoring RustDesk peer online/offline status changes.

• Monitor multiple RustDesk peers for online/offline status changes
• Print timestamped state changes in real-time
• Optional IP address tracking via --with-ip flag
• Support for single ID or file with multiple IDs
• Configurable polling interval
• Works with public RustDesk servers or self-hosted instances

Requires V and libsodium-dev to compile:

# Install dependencies (Ubuntu/Debian) sudo apt install libsodium-dev # Compile v rdmon.v

rdmon [OPTIONS] <peer_id> [peer_id...] Options: -h, --help Show help message -s, --server HOST RustDesk server (default: rs-ny.rustdesk.com) -f, --file FILE Load peer IDs from file (one per line) -i, --interval SEC Poll interval in seconds (default: 60) -v, --verbose Enable verbose/debug output --with-ip Enable IP address tracking 

Monitor a single peer:

./rdmon 111111111

Monitor multiple peers:

./rdmon 111111111 222222222 333333333

Monitor peers from a file:

./rdmon -f peers.txt

Use a custom server with IP tracking:

./rdmon -s myserver.com --with-ip 111111111

RustDesk Monitor (rdmon) ======================== Server: rs-ny.rustdesk.com:21115 Monitoring 2 peer(s): 111111111, 222222222 IP tracking: disabled Poll interval: 60s ------------------------ Checking initial status... [2025-12-26 10:42:28] 111111111: ONLINE [2025-12-26 10:42:28] 222222222: OFFLINE [2025-12-26 10:43:15] 111111111: OFFLINE [2025-12-26 10:45:30] 111111111: ONLINE (IP: 1.1.1.1:12345) 

Create a text file with one peer ID per line:

# peers.txt 111111111 222222222 333333333 # Comments are supported 

• Implements RustDesk's protobuf-based rendezvous protocol
• Connects to rendezvous server port 21115 for online status queries
• IP retrieval uses port 21116 via encrypted PunchHoleRequest (when --with-ip enabled)
• Uses RustDesk's variable-length frame encoding
• Encryption uses libsodium: crypto_box for key exchange, crypto_secretbox for messages

• The --with-ip flag retrieves the peer's IP address when they come online
• IP tracking uses encrypted communication via port 21116 (NaCl crypto_box)
• IP tracking may be detectable by the monitored peer as it triggers a connection request
• Without --with-ip, monitoring is passive and undetectable
• Requires libsodium-dev to be installed for encryption support

MIT License - see LICENSE file for details.