goflow VS picosnitch

I would greatly appreciate insights and recommendations from those who have experience in this area. Additionally, I'm interested in hearing your opinions on the best tool for this task: nProbe or goflow? Your rationale behind your recommendation would be invaluable.

All in one platform would be preferred, but Docker could sway me to something else. Meaning, I don't want to install a bunch of puzzle pieces to get up and running. GoFlow would be an example here.

Cloudflare goflow / flow-pipeline

For example, for a lot of IDS work, you want to capture netflows if you can. This is something you could do with goflow. Then you can use whatever SIEM/flow analysis tools to figure out what is touching each network location.

Yep, and from my experience too (made a tool that monitors network traffic with eBPF [1]) in addition to those issues there is also a sizable latency hit.

[1] https://github.com/elesiuta/picosnitch

Similar to bandwhich, I recently created a snap of my own bandwidth monitor, picosnitch [1]. However I was only able to get it working with classic confinement (so it can't be published on the store) due to there being no snap interfaces for fanotify or BPF kfuncs.

I already packaged it for nearly every distro, but unfortunately most don't have dash [2] in their repos so the user needs to install it separately, and I was hoping that snap would be an easier solution for that.

[1] https://github.com/elesiuta/picosnitch/blob/master/snap/snap...

[2] https://repology.org/project/python:dash/versions

I created picosnitch which can do this

If you're still having this issue, you can try picosnitch (I recently made it available in copr).

You can use picosnitch for this, I'm the developer and this is exactly the use case I had in mind when designing it (24/7 monitoring of traffic on a per executable basis, primarily in containerized environments).

I wrote picosnitch [1] which has the same notification and bandwidth monitoring features, however it doesn't block traffic for a couple reasons: avoiding scope creep so I can focus on more reliable detection and do things like hash every executable, which makes it harder to block traffic in a timely fashion.

https://github.com/elesiuta/picosnitch

I also wrote a program (picosnitch) which is newer than that list and has a bunch of features none of those other tools have, in case you're interested in checking it out!

which basically says launchpad builds the package directly from that repository, which states: This repository is an import of the Git repository at https://github.com/elesiuta/picosnitch.git.

picosnitch - monitors and hashes programs that connect to the internet, and can check them with VirusTotal.

For Linux, I created picosnitch which does exactly what you're looking for.