For the past few months, I've been working on a small project of mine called FlowRay. It's a C++ terminal utility for monitoring the network activity of individual Linux applications.
The idea originally came from a pretty simple problem. Every now and then, I needed to find out which IP addresses a particular application was connecting to. Most of the time, this was related to VPN split tunneling: I wanted to quickly get a list of IP addresses that I could later use in routing rules.
Of course, there are already tools for this, like ss, Wireshark, or tcpdump. But I wanted something simpler and more focused on individual applications, without having to manually analyze packet captures.
I had also been wanting to dive deeper into C++, systems programming, and Linux networking for a while, so I decided to try building something myself.
And that's how FlowRay came about.
The tool lets you select a process by PID or name and monitor its network activity. You can see remote IP addresses, ports, protocols, incoming and outgoing traffic volumes, live transfer rates, as well as connection and DNS query logs. It also supports tracking child processes and exporting the collected data to JSON.
Under the hood, FlowRay uses two different Linux mechanisms: socket diagnostics (sock_diag) and eBPF with libbpf. The former retrieves socket information through kernel interfaces, while the latter monitors network events and collects traffic statistics.
Figuring out how these mechanisms work was probably the most interesting part of the development process. Before FlowRay, I hadn't really worked that deeply with the Linux networking subsystem, so I ended up learning and experimenting quite a lot along the way.
FlowRay runs entirely in the terminal, with both an interactive TUI and a simpler standard output mode
I never intended to build a Wireshark replacement or some kind of universal network traffic analyzer. I just wanted to solve my own problem and, at the same time, get some hands-on experience with systems programming.
Now, after several months of development, I've reached a point where I'm happy with the core functionality. The source code, build instructions, and usage examples are available on GitHub:
https://github.com/Stelour/flowray
I'd appreciate any feedback, especially if someone actually gives the tool a try.
Thanks for reading <3
Top comments (0)