goflow2 VS picosnitch

I use goflow2 to do something like this. I don't specifically use syslog itself for this, but mtail to generate the metrics.

I've been using this one: https://github.com/netsampler/goflow2

Take a look at goflow2 which is based on Cloudflare's flow analysis pipeline.

I'm not particularly familiar with netflow formats, but this collector emits Prometheus metrics.

GoFlow2 is a high-performance sFlow/IPFIX/NetFlow collector that gathers network information and serializes it in a common format. This fork of CloudFlare's GoFlow provides horizontal scalability, consistent format and the ability to work with raw samples and build aggregation and custom enrichment. Our thanks for this suggestion goes to SuperQue.

You want something like goflow2.

There's goflow2, which is a fork of CloudFlare's goflow netflow collector.

I'd suggest looking at goflow2 before you write something new.

I personally use goflow2, but my needs are pretty simple.

Yep, and from my experience too (made a tool that monitors network traffic with eBPF [1]) in addition to those issues there is also a sizable latency hit.

[1] https://github.com/elesiuta/picosnitch

Similar to bandwhich, I recently created a snap of my own bandwidth monitor, picosnitch [1]. However I was only able to get it working with classic confinement (so it can't be published on the store) due to there being no snap interfaces for fanotify or BPF kfuncs.

I already packaged it for nearly every distro, but unfortunately most don't have dash [2] in their repos so the user needs to install it separately, and I was hoping that snap would be an easier solution for that.

[1] https://github.com/elesiuta/picosnitch/blob/master/snap/snap...

[2] https://repology.org/project/python:dash/versions

I created picosnitch which can do this

If you're still having this issue, you can try picosnitch (I recently made it available in copr).

You can use picosnitch for this, I'm the developer and this is exactly the use case I had in mind when designing it (24/7 monitoring of traffic on a per executable basis, primarily in containerized environments).

I wrote picosnitch [1] which has the same notification and bandwidth monitoring features, however it doesn't block traffic for a couple reasons: avoiding scope creep so I can focus on more reliable detection and do things like hash every executable, which makes it harder to block traffic in a timely fashion.

https://github.com/elesiuta/picosnitch

I also wrote a program (picosnitch) which is newer than that list and has a bunch of features none of those other tools have, in case you're interested in checking it out!

which basically says launchpad builds the package directly from that repository, which states: This repository is an import of the Git repository at https://github.com/elesiuta/picosnitch.git.

picosnitch - monitors and hashes programs that connect to the internet, and can check them with VirusTotal.

For Linux, I created picosnitch which does exactly what you're looking for.