flowlogs-pipeline VS Bandwhich

I played with Elastiflow extensively some years ago - it was excellent, if a little hungry on memory, but I suspect most of that was the logstash & elasticsearch overhead.

Rob did a big rewrite about 4 years ago, I think, licensing the new codebase in a way that led us to look elsewhere.

There's some alternatives that aren't elastic under the hood, of course. The hard-to-type Akvorado looks very promising, especially given its heritage:

https://github.com/akvorado/akvorado

Because we're moving to opentel / prometheus, this project (seems quite active) is especially interesting, with the promise of integrating OS & app metrics, tracing, and netflow insights:

https://github.com/netobserv/flowlogs-pipeline

For the CLI, I recently found bandwich: https://github.com/imsnif/bandwhich

The cargo install is currently borked but the prebuilt bin works fine.

found a new one: bandwhich (https://github.com/imsnif/bandwhich)

bandwhich: A terminal bandwidth utilization tool. This CLI utility displays current network utilization by process, connection and remote IP/hostname.

You can use a tool like https://github.com/imsnif/bandwhich while playing to see if something is running in the background like apt, fwupd, etc. See if something on your system is eating network resources while playing. If you see nothing you're welcome to message me and I can give you a couple of other things to try.

Bandwhich?