Ron
Proyek

Singularity Monitor

Singularity Monitor is an ultra-low overhead, highly accurate Windows 11 network usage monitor built in Rust and C# (WinUI 3). It monitors bandwidth limits, generates usage forecasts, constructs hourly/weekly heatmaps, and triggers alerts on user-defined data caps—all while keeping system resources at a bare minimum.

12 Mar 2026LiveSource
RustWinUI 3C#SQLiteWindows 11

Overview

Singularity Monitor 📡

Singularity Monitor is a native Windows 11 system utility built for users who want:

  • Ultra-low Resource Consumption: Steady-state footprint of ≤5MB RAM and ≤0.2% CPU.
  • Extreme Accuracy: Absolute deviation of ≤0.1% compared to native OS network counters.
  • Application Attribution: Traces network bytes to specific desktop applications/process names.
  • Cap Alerts & Thresholds: Monthly/daily quotas with native Toast notifications.
  • Analytics & Forecasting: Month-end cost projections, 7x24 heatmaps, and anomaly warnings.
  • Privacy First: Fully offline architecture with local SQLite storage.

Key Features

  • GetIfTable2 Polling: Computes byte-level deltas periodically without kernel drivers or packet sniffing.
  • WinRT Attribution Probe: Background user-session helper mapping active sockets to app processes.
  • Deduplication Engine: Merges overlapping streams (poll, ingest, backfill) and maintains historical precision.
  • Toast Notifications: Surfaced via system tray when data limits cross 50%, 80%, 95%, or daily averages.
  • Analytics & Visualizations: Renders hourly/weekly traffic heatmaps and maps 14-day linear regression forecasts.
  • SQLite Optimization: Implements automatic daily retention pruning and manual VACUUM/checkpoint compression.

Tech Stack

  • Collector Daemon: Rust with SQLite and Windows Win32 API.
  • Attribution Helper: Rust with WinRT APIs (GetNetworkUsageList) and WTS session management.
  • Frontend Dashboard: C# + WinUI 3 (Windows App SDK / .NET 8).
  • Communication Layer: Local Named Pipes IPC using newline-delimited JSON.

Architecture

Singularity Monitor operates as three decoupled components running in separate security contexts, coordinating via a local Named Pipe (\\.\pipe\SingularityMonitor).

┌────────────────────────────────────────────────────────┐
│                      WINDOWS 11                        │
├─────────────────┬──────────────────────┬───────────────┤
│  User Session   │  Local System        │  System APIs  │
│                 │                      │               │
│ ┌────────────┐  │  ┌────────────────┐  │ ┌───────────┐ │
│ │ Viewer UI  │  │  │   Daemon.exe   │◄─┼─┤GetIfTable2│ │
│ │ (C#/WinUI) │  │  │ (Rust Service) │  │ └───────────┘ │
│ └─────┬──────┘  │  └───────┬─────┬──┘  │               │
│       │         │          │     │     │               │
│       │ (IPC)   │    (SQL) │     │(IPC)│ ┌───────────┐ │
│       ▼         │          ▼     └─────┼─┤WinRT APIs │ │
│  ┌──────────┐   │  ┌───────────┐       │ └─────▲─────┘ │
│  │Named Pipe├───┼─►│ SQLite DB │       │       │       │
│  │   IPC    │   │  │ (data.db) │       │ ┌─────┴─────┐ │
│  └──────────┘   │  └───────────┘       │ │ Helper.exe│ │
│                 │                      │ │(Rust Probe│ │
│                 │                      │ └───────────┘ │
└─────────────────┴──────────────────────┴───────────────┘

The system uses a newline-delimited JSON envelope for Named Pipe communication. This allows C# and Rust to exchange payloads type-safely:

// From crates/shared-contracts/src/lib.rs
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct IpcMessage {
    pub id: Option<Uuid>,
    #[serde(rename = "type")]
    pub message_type: MessageType,
    pub method: String,
    pub payload: Value,
    pub error: Option<IpcError>,
}