Capture scope

Decide which applications you need to observe and whether traffic is plaintext or encrypted at the interface. Capture scope controls visibility and cost; detection rules decide which observations produce events.

Choose an input

Goal	Recommended input	Visibility
Plaintext HTTP, databases, DNS, or mirrored traffic	network	Connections, protocols, and visible application data
OpenSSL / Go TLS applications	endpoint	Application plaintext with process and service attribution
Supported quic-go HTTP/3	goquic endpoint	Application plaintext separated by QUIC stream
Test rules or parsers	NDJSON / PCAP / stream replay	Fixed samples; no proof of live capture

Set capture.application_source to network or endpoint. Only the selected source contributes application transactions to rules, avoiding duplicate accounting between visible network plaintext and endpoint streams. Endpoint mode can still collect network metadata. This is not cross-sensor deduplication.

Restrict network traffic

Generate a configuration in a fresh directory and use your actual interface name:

netflowscout configure --mode network --service network-app --interface eth0 \
  --filter 'tcp port 80 or udp port 53' --out ./network.json
netflowscout check --config ./network.json

Filters support tcp, udp, ip, ip6, port N, host IP, not/and/or, and parentheses. Unknown expressions fail startup.

Filter placement

Filtering currently happens in userspace. It does not reduce packets entering the kernel ring. Restrict the mirror source, interface, or upstream traffic first in high-volume deployments, then inspect drop counters.

Restrict application capture

Use an endpoint match.executable selector, optionally scoped by real UID and cgroup path. For several applications, use policies with exclusions and priorities. See endpoints and TLS.

connections supplies port/protocol/role routing hints, not a strict traffic allowlist: plugin signatures can identify other ports. Use process selectors and mutually exclusive policies to restrict targets.

From capture to events

Enable local raw recording when protocol evidence is needed: PCAP for network input and replayable streams for endpoint plaintext, continuously or triggered by detection events.

To report only requests to /admin/export, inspect HTTP fields in a detection rule. Packet filters do not inspect URLs. Encrypted network traffic requires endpoint plaintext for URL-based detection.

Start with one service, verify complete transactions and delivery, then expand protocols, targets, and rules. Monitor kernel loss, bridge drops, analyzer input rejection, late rule input, and WAL backlog alongside CPU.