FlowWatch

See what traffic every VPS on your hypervisor is sending. Run it on a hypervisor and it shows, per VPS, how much traffic is leaving, how many new connections it opens and where that traffic goes. Live, or as a report.

View on GitHub Install

v0.2.0 · Apache-2.0 · Linux

FlowWatch dashboard: six VPS's on a Proxmox VE node ranked by outbound traffic
The live dashboard: every VPS ranked by outbound traffic.

What it does

Why hosting providers use FlowWatch

Live

Every VPS, ranked by what it sends

The dashboard ranks VPS's by outbound traffic. Select one to see its totals and its top destinations.

  • Sort, search by ID, name or IP
  • Pause to read a moment
  • Works over any SSH session

Reports

Measure, then keep the numbers

Reports measure for as long as you choose and write a summary, JSON or CSV, ready to merge across hypervisors.

  • Per-VPS totals, rates and destinations
  • Node, platform and ID on every row
  • Fits cron and scripts

Safe

Reads, never changes

Totals come from each interface's kernel counters. Destinations come from packet headers only; payloads are never read.

  • No firewall rules or kernel modules
  • Nothing inside any VPS
  • Header sampling for busy hosts

Screenshots

FlowWatch at work

FlowWatch detail view: traffic totals and top destinations for one VPS
One VPS: its totals and where its traffic goes.

Install

Install FlowWatch

With Go

go install github.com/frabsnet/flowwatch/cmd/flowwatch@latest

From source

git clone https://github.com/frabsnet/flowwatch
cd flowwatch
CGO_ENABLED=0 go build -trimpath -o flowwatch ./cmd/flowwatch
sudo install flowwatch /usr/local/bin/

Details

Platforms
Proxmox VE (KVM and LXC), libvirt/KVM, Virtualizor, VirtFusion, SolusVM 1 and 2, Xen
Runs on
Linux, amd64 and arm64
Needs
Root or CAP_NET_RAW for destinations; totals work without
Output
Dashboard, text summary, JSON, CSV

Usage

Commands

flowwatchLive dashboard
flowwatch reportMeasure for 30 seconds, then print a summary
flowwatch report -format json -o report.jsonEvery window as JSON
flowwatch report -format csv -duration 5m -o report.csvOne row per VPS per window
flowwatch vmsList the VPS's and interfaces it found

FlowWatch questions

Does FlowWatch change anything on the hypervisor?
No. It reads hypervisor configuration and kernel counters, and packet headers for destinations. It adds no firewall rules, kernel modules or services.
Which hypervisors does FlowWatch support?
Proxmox VE (KVM and LXC), libvirt/KVM, Virtualizor, VirtFusion, SolusVM 1 and 2, and Xen. On anything else it shows any tap, vnet, veth, vif or kvm interface by name.
Does it need root?
Traffic totals work without root. Destinations and connection activity need root or the CAP_NET_RAW capability.
Does FlowWatch read packet contents?
No. It reads the first 128 bytes of packets a VPS sends, which are the Ethernet, IP and TCP or UDP headers. Payloads are never read.
How is FlowWatch different from Frabs?
FlowWatch shows the traffic on one server, right now, and leaves the judging to you. Frabs detects abuse around the clock on every node, names the customer and acts with your rules.

FlowWatch shows you. Frabs acts.

Frabs watches every VPS around the clock, names the customer behind abuse and stops it with your rules.

Start Free TrialTry the Demo