rdmon

A lightweight OSINT tool for monitoring RustDesk peer online/offline status changes.

Features

• Monitor multiple RustDesk peers for online/offline status changes
• Print timestamped state changes in real-time
• Optional IP address tracking via --with-ip flag
• Support for single ID or file with multiple IDs
• Configurable polling interval
• Works with public RustDesk servers or self-hosted instances

Installation

Requires V and libsodium-dev to compile:

# Install dependencies (Ubuntu/Debian)
sudo apt install libsodium-dev

# Compile
v rdmon.v

Usage

rdmon [OPTIONS] <peer_id> [peer_id...]

Options:
  -h, --help          Show help message
  -s, --server HOST   RustDesk server (default: rs-ny.rustdesk.com)
  -f, --file FILE     Load peer IDs from file (one per line)
  -i, --interval SEC  Poll interval in seconds (default: 60)
  -v, --verbose       Enable verbose/debug output
  --with-ip           Enable IP address tracking

Examples

Monitor a single peer:

./rdmon 111111111

Monitor multiple peers:

./rdmon 111111111 222222222 333333333

Monitor peers from a file:

./rdmon -f peers.txt

Use a custom server with IP tracking:

./rdmon -s myserver.com --with-ip 111111111

Example Output

RustDesk Monitor (rdmon)
========================
Server: rs-ny.rustdesk.com:21115
Monitoring 2 peer(s): 111111111, 222222222
IP tracking: disabled
Poll interval: 60s
------------------------

Checking initial status...
[2025-12-26 10:42:28] 111111111: ONLINE
[2025-12-26 10:42:28] 222222222: OFFLINE
[2025-12-26 10:43:15] 111111111: OFFLINE
[2025-12-26 10:45:30] 111111111: ONLINE (IP: 1.1.1.1:12345)

Peers File Format

Create a text file with one peer ID per line:

# peers.txt
111111111
222222222
333333333
# Comments are supported

Technical Details

• Implements RustDesk's protobuf-based rendezvous protocol
• Connects to rendezvous server port 21115 for online status queries
• IP retrieval uses port 21116 via encrypted PunchHoleRequest (when --with-ip enabled)
• Uses RustDesk's variable-length frame encoding
• Encryption uses libsodium: crypto_box for key exchange, crypto_secretbox for messages

Notes

• The --with-ip flag retrieves the peer's IP address when they come online
• IP tracking uses encrypted communication via port 21116 (NaCl crypto_box)
• IP tracking may be detectable by the monitored peer as it triggers a connection request
• Without --with-ip, monitoring is passive and undetectable
• Requires libsodium-dev to be installed for encryption support

License

MIT License - see LICENSE file for details.