- Monitors traffic on all interfaces
- Monitors traffic based on source ip and destination ip pairs, generates a network flow chart
- Alerts on per-ip bandwidth exceeded
- Detects port/network scanning activity (Via the number of different IPs contacted and the number of ports contacted)
- Does not require root access. Only required capability: CAP_NET_RAW
- Minimal configuration
- Download the latest release from the releases page and move the binary to the
/usr/local/bin/directory under the filenameTrafficAlerted. - Allow executing the file by running
chmod +x /usr/local/bin/TrafficAlerted - For systemd users: Install the service unit file
wget https://raw.githubusercontent.com/Kioubit/TrafficAlerted/master/TrafficAlerted.service -P /etc/systemd/system/ systemctl enable TrafficAlerted.service - Download and install the config file
mkdir -p /etc/TrafficAlerted wget https://raw.githubusercontent.com/Kioubit/TrafficAlerted/master/TrafficAlerted.conf -P /etc/TrafficAlerted/ - Edit the config at
/etc/TrafficAlerted/TrafficAlerted.confand then start the service usingservice TrafficAlerted start
You will need to have GO installed on your system. Then run make release and find the binary in the bin/ directory.
Provides the following http API endpoints on port 8698:
/active/capabilities
It also provides the following user interface:
/dashboard
# Configuration file for TrafficAlerted
# General configuration
# --------------------------------------------------
# The amount of time in seconds for which "ByteLimit" applies
TrafficInterval: 170
# The amount of bytes to trigger an alert for. Either specify bytes or add the suffixes "K","M" or "G"
ByteLimit: 1G
# If set to 'true', the program does not keep destination IP information.
# If set to 'true', Port scanning detection based on the number of contacted IPs is then disabled as well.
# If set to 'true', Detailed information about the traffic to the destination IPs is also unavailable.
NoDestinations: false
# Minimum amount of bytes for an IP to appear on the network chart
ChartMinBytes: 5M
# Exclude interfaces from monitoring or leave empty to monitor all
ExcludedInterfaces: "lo","dummy0"
# Network and Port scanning detection
# --------------------------------------------------
# Enable analyzing the amount of IPs a given host contacts
ContactedIPsAnalyze: true
# If a source IP contacts more than this amount of different IPs within "TrafficInterval" scanning activity is detected.
NumberContactedIPs: 15
# Whether to analyze destination ports for scanning activity (Requires more system resources). (true/false)
AnalyzePorts: false
# Only applicable if AnalyzePorts is true.
# If a source IP contacts more than this amount of different ports within "PortInterval", then scanning activity is detected.
NumContactedPorts: 100
# Only applicable if "AnalyzePorts" is true. The amount of time in seconds for which "NumContactedPorts" applies
PortInterval: 600