Traffic analysis and detection for Linux

From traffic,
to actionable events.

Understand HTTP, database and messaging traffic. Detect what matters with your own rules, then send traceable events to a file or Dataway.

Get started Explore the TUI

Go service · Wasm plugins · Passive network and endpoint capture
Download Linux/arm64 builds →

Actual TUI event investigation: application attribution, rule version, and independent file and Dataway receipts — **Understand why an event happened**Actual OrbStack capture, not live dataView the full screen ↗

Connect capture, analysis and delivery.

Scope collection, parse protocols, apply detection rules, then keep the evidence needed to investigate and verify delivery.

Attribute traffic to an application: Collect from interfaces, PCAP or supported endpoint plaintext. Endpoint collection discovers processes, reattaches after application restarts, and associates services and connections.
Detect business behavior: Match URLs, methods, statuses and latency, or calculate error rates over windows. Preview with replay, apply cooldowns and trace rule versions.
Extend protocols with Go or Rust: Build Wasm plugins with the SDK and TCP / UDP templates. Validate and replay before installing, with bounded resources and plugin reloads.
Redact events and retain evidence: Events are redacted by default. Explicitly enable local PCAP / endpoint plaintext retention by protocol, service or detection event.
Verify each destination separately: At-least-once delivery starts after an event commits to the local WAL. NDJSON files and Dataway acknowledge independently, with backoff retries.
Manage the pipeline in a terminal: The bilingual TUI connects apps, policies and events, with configuration diffs, rule dry runs, plugin management and diagnostics.

Application protocolsHTTP/1.x · HTTP/2 · gRPC · WebSocket

Databases and messagingMySQL · PostgreSQL · Redis · MongoDB · Kafka · MQTT · NATS

Read the full protocol matrix and limits →

TLS plaintext requires a compatible endpoint probe. HTTP/3 covers supported quic-go applications only. Check requirements and support limits →

Choose your starting point.

Already have the CLI? Verify events with a sample. Deploying for the first time? Start with installation and the configuration wizard.

Try an offline sample

For users with the Linux CLI installed. No root, capture permissions or running application required.

Download three synthetic sample files into a separate nfs-demo workspace.
Validate the configuration, replay, and inspect local redacted events.

netflowscout check --config examples/netflowscout.json
netflowscout replay --config examples/netflowscout.json \
  --input examples/observations.ndjson

Expected resultOn the first run in a fresh directory, 3 observations produce 2 http.server_error events. Response content is [REDACTED].

Get the samples and run the full demo →

Deploy on Linux for the first time

Choose a version on the download page, get the Linux/arm64 full package, then verify and install it. The latest build is a development preview; historical builds remain available.

Download and verify the full package, including the CLI and protocol plugins.
Run the installation wizard to select an application or interface and configure capture and outputs.

Run after installation:

sudo netflowscout init --lang en

NextPreview and confirm the configuration, follow the setup flow to start services, then verify real requests and each destination's receipt.

Download NetFlowScout packages →Already configured? Verify your setup →

Choose an app. Write a rule. Understand the event.

You define the behavior to detect. Dry-run before activation, then inspect the trigger and delivery status.

Example: emit only for complete /checkout error transactions

lua

rule "checkout_failed" do
  on "http.transaction"
  where not incomplete and not truncated
  when http.path == "/checkout" and http.status == "500"
  emit "checkout.failure" do
    severity = "warning"
    message = "Checkout request failed"
  end
end

Need an event when a URL is accessed? Use a request-stage rule. Need an error rate? Add grouping and windows.

Start with a URL detection policy →

Continue with your task.

Check the wiring, extend a protocol, or keep the original evidence behind an event.

Choose the capture scopeSeparate network traffic from endpoint plaintext and select targets.Keep the original evidenceSelect protocols and services. Save to a local folder.Manage apps and policiesSee configuration, rule, plugin and event screenshots.Verify the pipelineSeparate process readiness, business observations and receipts.

From traffic,to actionable events. ​

Connect capture, analysis and delivery. ​

Choose your starting point. ​

Try an offline sample ​

Deploy on Linux for the first time ​

Choose an app. Write a rule. Understand the event. ​