Show HN: Network Monitor – a GUI to spot anomalous connections on your Linux

Re:Show HN: Network Monitor – a GUI to spot anomalous connec... by mroche on Saturday November 29, 2025 @02:15PM (#46089989)

Cool project! As a more advanced form, I think it should be possible to get all this information via eBPF rather than ss output and scraping /proc.

Food for thought!

[ Parent | on HN ]

Re:Show HN: Network Monitor – a GUI to spot anomalous connec... by rlmp_89 on Saturday November 29, 2025 @03:42PM (#46090601)

https://github.com/pythops/oryx

-> voila!

[ Parent | on HN ]

Re:Show HN: Network Monitor – a GUI to spot anomalous connec... by mentalgear on Saturday November 29, 2025 @04:09PM (#46090785)

BTW: This is also a TUI - much preferred !

[ Parent | on HN ]

Re:Show HN: Network Monitor – a GUI to spot anomalous connec... by arcanemachiner on Saturday November 29, 2025 @05:11PM (#46091267)

The OP's project shows process names, which I do not see in this program.

[ Parent | on HN ]

Re:Show HN: Network Monitor – a GUI to spot anomalous connec... by curcbit on Sunday November 30, 2025 @05:27AM (#46095497)

Nice but it feels too much AI slop

[ Parent | on HN ]

Re:Show HN: Network Monitor – a GUI to spot anomalous connec... by oneshtein on Saturday November 29, 2025 @04:23PM (#46090910)

eBPF doesn't work on locked down kernels (stock kernels in Secure Boot mode).

[ Parent | on HN ]

Re:Show HN: Network Monitor – a GUI to spot anomalous connec... by mroche on Sunday November 30, 2025 @12:00AM (#46093913)

eBPF is restricted when booted in a SB environment, but it's not nonfunctional. The default config puts the kernel into "integrity" mode of Kernel Lockdown, which reduces scope of access and enforces read-only usage.

Whether or not the specific functions needed to replicate this tool are impacted is beyond my knowledge.

[ Parent | on HN ]

Re:Show HN: Network Monitor – a GUI to spot anomalous connec... by grigio on Sunday November 30, 2025 @12:18PM (#46098498)

I think this is a great point, eBPF is cool but probably less popular than ss

[ Parent | on HN ]