sniffnet VS flowlogs-pipeline

Sniffnet is an open source, Rust-based network monitoring tool I’ve been working on for almost two years now.

As described in this issue the GUI library used by Sniffnet doesn't support yet text selection, but they are working on it and hopefully soon it will.

I’ll be personally talking about Sniffnet, the Rust-based network monitoring tool I’m working on: I’m so excited to share it with the world!

I'm the creator and maintainer of Sniffnet, an open-source network monitoring tool developed in Rust.

Sniffnet is a Rust-based network monitoring tool to help everyone inspect their Internet traffic.

Sniffnet, a cross-platform app to comfortably monitor your Internet traffic written in Rust, has now a website. See the related discussion on Github.

Another option is https://github.com/GyulyVGC/sniffnet if you are just trying to see what packets are flowing and who's talking. It's nowhere near as powerful as Wireshark (nor is it designed to be) but it might not be as confusing for someone who is new to network packet sniffing. I think the biggest downside is the Windows install file doesn't come with the NPCAP driver, I think they really need to bundle that with the installer the way Wireshark does, otherwise people may not get it to work.

I played with Elastiflow extensively some years ago - it was excellent, if a little hungry on memory, but I suspect most of that was the logstash & elasticsearch overhead.

Rob did a big rewrite about 4 years ago, I think, licensing the new codebase in a way that led us to look elsewhere.

There's some alternatives that aren't elastic under the hood, of course. The hard-to-type Akvorado looks very promising, especially given its heritage:

https://github.com/akvorado/akvorado

Because we're moving to opentel / prometheus, this project (seems quite active) is especially interesting, with the promise of integrating OS & app metrics, tracing, and netflow insights:

https://github.com/netobserv/flowlogs-pipeline