{"id":16517615,"url":"https://github.com/rfyiamcool/go-netflow","last_synced_at":"2025-04-06T22:09:17.247Z","repository":{"id":39165705,"uuid":"416652342","full_name":"rfyiamcool/go-netflow","owner":"rfyiamcool","description":"go netflow, capture process in/out traffic, similar to c Nethogs.","archived":false,"fork":false,"pushed_at":"2022-09-27T06:28:36.000Z","size":27,"stargazers_count":341,"open_issues_count":2,"forks_count":59,"subscribers_count":8,"default_branch":"master","last_synced_at":"2025-03-30T21:06:37.716Z","etag":null,"topics":["nethogs","pcap"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rfyiamcool.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-10-13T08:30:30.000Z","updated_at":"2025-03-24T02:41:17.000Z","dependencies_parsed_at":"2023-01-17T16:01:30.184Z","dependency_job_id":null,"html_url":"https://github.com/rfyiamcool/go-netflow","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rfyiamcool%2Fgo-netflow","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rfyiamcool%2Fgo-netflow/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rfyiamcool%2Fgo-netflow/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rfyiamcool%2Fgo-netflow/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rfyiamcool","download_url":"https://codeload.github.com/rfyiamcool/go-netflow/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247557767,"owners_count":20958047,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["nethogs","pcap"],"created_at":"2024-10-11T16:32:57.710Z","updated_at":"2025-04-06T22:09:17.228Z","avatar_url":"https://github.com/rfyiamcool.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"## go-netflow\n\ngo-netflow, capture process in/out traffic, similar to c Nethogs.\n\n[使用 golang 实现进程级流量监控](https://github.com/rfyiamcool/notes/blob/main/netflow.md)\n\n### refer\n\nrefer logic design link\n\n- [https://zhuanlan.zhihu.com/p/49981590](https://zhuanlan.zhihu.com/p/49981590)\n\nrefer nethogs source link\n\n- [https://github.com/raboof/nethogs](https://github.com/raboof/nethogs)\n\n### dep\n\n```\nyum install libpcap\nyum install libpcap-devel\n```\n\n### cli usage\n\nnetflow cli run:\n\n```\ngo run cmd/main.go\n```\n\nstdout:\n\n```text\n+---------+-------+------------------------------------------------+--------+--------+---------+---------+----------+\n|   PID   | NAME  |                      EXE                       | INODES | SUM IN | SUM OUT | IN RATE | OUT RATE |\n+---------+-------+------------------------------------------------+--------+--------+---------+---------+----------+\n| 2256431 | Wget  | /usr/bin/wget                                  |      1 | 1.0 MB | 0 B     | 339 kB  | 0 B      |\n+---------+-------+------------------------------------------------+--------+--------+---------+---------+----------+\n| 2257200 | Wrk   | /usr/bin/wrk                                   |      5 | 2.0 MB | 16 kB   | 653 kB  | 5.2 kB   |\n+---------+-------+------------------------------------------------+--------+--------+---------+---------+----------+\n| 3707954 | Java  | /usr/lib/jvm/java-7-openjdk-amd64/jre/bin/java |     10 | 457 B  | 648 B   | 152 B   | 216 B    |\n+---------+-------+------------------------------------------------+--------+--------+---------+---------+----------+\n| 2245136 | Wget  | /usr/bin/wget                                  |      1 | 444 kB | 0 B     | 148 kB  | 0 B      |\n+---------+-------+------------------------------------------------+--------+--------+---------+---------+----------+\n| 2034103 | Nginx | /usr/sbin/nginx                                |     41 | 0 B    | 0 B     | 0 B     | 0 B      |\n+---------+-------+------------------------------------------------+--------+--------+---------+---------+----------+\n```\n\n### sdk simple usage:\n\n```go\npackage main\n\nimport (\n\t\"encoding/json\"\n\t\"fmt\"\n\t\"time\"\n\n\t\"github.com/rfyiamcool/go-netflow\"\n)\n\nfunc main() {\n\tnf, err := netflow.New(\n\t\tnetflow.WithCaptureTimeout(5 * time.Second),\n\t)\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\n\terr = nf.Start()\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\tdefer nf.Stop()\n\n\t\u003c-nf.Done()\n\n\tvar (\n\t\tlimit     = 5\n\t\trecentSec = 5\n\t)\n\n\trank, err := nf.GetProcessRank(limit, recentSec)\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\n\tbs, err := json.MarshalIndent(rank, \"\", \"    \")\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\n\tfmt.Println(string(bs))\n}\n```\n\n### how to use sdk of go-netflow:\n\n#### set pcap filename\n\nDon't save pcap file by default. \n\n`WithStorePcap` option is used to save pcap file, use `tcpdump -nnr {filename}` command to read pcap file.\n\n```\nWithStorePcap(fpath string)\n```\n\n#### set custom pcap bpf filter.\n\n```\nWithPcapFilter(filter string)\n```\n\n#### set custom pcap bpf filter.\n\nexample:\n\n- host xiaorui.cc and port 80\n- src host 123.56.223.52 and (dst port 3389 or 22)\n\n```\nWithPcapFilter(filter string)\n```\n\n#### limit netflow cpu/mem resource.\n\n```\nWithLimitCgroup(cpu float64, mem int)\n```\n\n#### set time to capturing packet.\n\n```\nWithCaptureTimeout(dur time.Duration)\n```\n\n#### set time to rescan process and inode data.\n\n```\nWithSyncInterval(dur time.Duration)\n```\n\n#### set the number of worker to consume pcap queue.\n\n```\nWithWorkerNum(num int)\n```\n\n#### set custom context.\n\n```\nWithCtx(ctx context.Context)\n```\n\n#### set custom devices to capture.\n\n```\nWithBindDevices(devs []string)\n```\n\n#### set pcap queue size. if the queue is full, new packet is thrown away.\n\n```\nWithQueueSize(size int)\n```\n\n### types\n\nnetflow.Interface\n\n```go\ntype Interface interface {\n\tStart() error\n\tStop()\n\tDone() \u003c-chan struct{}\n\tLoadCounter() int64\n\tGetProcessRank(int, int) ([]*Process, error)\n}\n```\n\nnetflow.Process\n\n```go\ntype Process struct {\n\tName         string\n\tPid          string\n\tExe          string\n\tState        string\n\tInodes       []string\n\tTrafficStats *trafficStatsEntry\n\tRing         []*trafficEntry\n}\n```\n\nnetflow.trafficStatsEntry\n\n```go\ntype trafficStatsEntry struct {\n\tIn         int64 `json:\"in\"`\n\tOut        int64 `json:\"out\"`\n\tInRate     int64 `json:\"in_rate\"`\n\tOutRate    int64 `json:\"out_rate\"`\n\tInputEWMA  int64 `json:\"input_ewma\" valid:\"-\"`\n\tOutputEWMA int64 `json:\"output_ewma\" valid:\"-\"`\n}\n```\n\nnetflow.trafficEntry\n\n```go\ntype trafficEntry struct {\n\tTimestamp int64 `json:\"timestamp\"`\n\tIn        int64 `json:\"in\"`\n\tOut       int64 `json:\"out\"`\n}\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frfyiamcool%2Fgo-netflow","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frfyiamcool%2Fgo-netflow","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frfyiamcool%2Fgo-netflow/lists"}