sniffnet-agent

Lightweight network flows exporter compatible with Sniffnet.

Overview

sniffnet-agent captures traffic on a network interface, aggregates packets into flows, and exports them as IPFIX (RFC 7011) records over UDP to a collector.

It lets you observe devices where running Sniffnet itself isn't practical (headless servers, routers, embedded boxes, firewalls), forwarding their traffic to a single Sniffnet instance that aggregates and visualizes activity across your whole network from one place.

Any IPFIX exporter can feed Sniffnet, but sniffnet-agent is built for maximum compatibility: it emits exactly the Information Elements (IEs) Sniffnet needs, exporting only the required data at the expected rate, without having to configure a more complex exporter to do so.

Installation

Note

A working libpcap (or Npcap on Windows) installation is required.

	x86_64
	Apple silicon | Intel
	x86_64 | ARM64

The links above download the latest prebuilt binaries directly from GitHub releases.

Alternatively, install sniffnet-agent from crates.io:

cargo install sniffnet-agent

Or pull the Docker image from GitHub Container Registry (only works on Linux):

docker pull ghcr.io/gyulyvgc/sniffnet-agent:latest

Usage

sniffnet-agent --interface <IFACE> --collector <HOST:PORT>

Run with no arguments to be prompted interactively for the interface and collector.

If running via Docker, the container needs access to the host network namespace and packet-capture capabilities in order to inspect host interfaces:

docker run --network host \
  --cap-add NET_RAW --cap-add NET_ADMIN \
  ghcr.io/gyulyvgc/sniffnet-agent:latest \
  --interface <IFACE> --collector <HOST:PORT>

Options

Flag	Description
-i, --interface	Network interface to capture on (e.g. eth0)
-c, --collector	Collector address as HOST:PORT
-f, --filter	BPF filter expression applied to the capture
-o, --odid	IPFIX Observation Domain ID [default: 0]
-v, --verbose	Enable debug logging