You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
**pktvisor** (pronounced "packet visor") is a **network observability agent** for analyzing high volume, information dense
21
-
data streams and producing actionable insights directly from the edge. Its goal is to extract
22
-
the signal from the noise; to separate the needles from the haystacks as close to the source as possible.
19
+
**pktvisor** (pronounced "packet visor") is an **observability agent** for analyzing high volume, information dense
20
+
network data streams and extracting actionable insights directly from the edge while integrating tightly with modern observability stacks.
23
21
24
-
It is a resource efficient agent built from the ground up to be modular and dynamically controlled in
25
-
real time via API. Input and processor modules may be dynamically loaded at runtime. Metric output can be used and visualized
22
+
It is resource efficient and built from the ground up to be modular and dynamically controlled in
23
+
real time via API and YAML policies. Input and processor modules may be dynamically loaded at runtime. Metric output can be used and visualized
26
24
both on-node via command line UI (for localized, hyper real-time actions)
27
25
as well as centrally collected into industry standard observability stacks like Prometheus and Grafana.
28
26
29
-
The [input stream system](src/inputs) is designed to _tap into_ data streams. It currently supports [packet capture](https://en.wikipedia.org/wiki/Packet_analyzer), [dnstap](https://dnstap.info/)
30
-
and [sFlow](https://en.wikipedia.org/wiki/SFlow) and will soon support additional taps such as [Netflow](https://en.wikipedia.org/wiki/NetFlow)
The [input stream system](src/inputs) is designed to _tap into_ data streams. It currently supports [packet capture](https://en.wikipedia.org/wiki/Packet_analyzer),
28
+
[dnstap](https://dnstap.info/) and [sFlow](https://en.wikipedia.org/wiki/SFlow) and will soon support additional taps such as [Netflow](https://en.wikipedia.org/wiki/NetFlow),
29
+
[envoy taps](https://www.envoyproxy.io/docs/envoy/latest/operations/traffic_tapping), and [eBPF](https://ebpf.io/).
33
30
34
-
The [stream processor system](src/handlers) includes full application layer analysis,
35
-
and [efficiently](https://en.wikipedia.org/wiki/Streaming_algorithm) summarizes to:
31
+
The [stream processor system](src/handlers) includes full application layer analysis, and [efficiently](https://en.wikipedia.org/wiki/Streaming_algorithm) summarizes to:
36
32
37
33
* Counters
38
34
* Histograms and Quantiles
39
35
* Timers and Rates
40
36
* Heavy Hitters/Frequent Items/Top N
41
37
* Set Cardinality
42
-
* GeoIP
38
+
* GeoIP/ASN
43
39
44
40
pktvisor has its origins in observability of critical internet infrastructure in support of DDoS protection, traffic
45
41
engineering, and operations.
46
42
47
43
These screenshots display both the [command line](golang/) and [centralized views](centralized_collection/) of
48
-
the [Network](src/handlers/net)
49
-
and [DNS](src/handlers/dns) stream processors, and the types of summary information provided:
44
+
the [Network](src/handlers/net) and [DNS](src/handlers/dns) stream processors, and the types of summary information provided:
50
45
51
46
52
47
@@ -67,6 +62,8 @@ the container, you specify which tool to run.
67
62
docker pull ns1labs/pktvisor
68
63
```
69
64
65
+
or use `ns1labs/pktvisor:develop` to get the latest development version.
66
+
70
67
2.*Start the collector agent*
71
68
72
69
This will start in the background and stay running. Note that the final two arguments select `pktvisord` agent and
@@ -84,15 +81,15 @@ If the container does not stay running, check the `docker logs` output.
84
81
85
82
After the agent is running, you can observe results locally with the included command line UI. This command will run the
86
83
UI (`pktvisor-cli`) in the foreground, and exit when Ctrl-C is pressed. It connects to the running agent locally using
87
-
the built in [REST API](https://app.swaggerhub.com/apis/ns1labs/pktvisor/3.0.0-oas3).
84
+
the built in REST API.
88
85
89
86
```
90
87
docker run -it --rm --net=host ns1labs/pktvisor pktvisor-cli
91
88
```
92
89
93
-
### Linux Static Binary
90
+
### Linux Static Binary (AppImage, x86_64)
94
91
95
-
You may also use the Linux static binary, built with [AppImage](https://appimage.org/), which is available for
92
+
You may also use the Linux all-in-one binary, built with [AppImage](https://appimage.org/), which is available for
96
93
download [on the Releases page](https://github.com/ns1labs/pktvisor/releases). It is designed to work on all modern
97
94
Linux distributions and does not require installation or any other dependencies.
98
95
@@ -122,27 +119,25 @@ background), and either the `--log-file` or `--syslog` argument to record logs.
122
119
123
120
Also see [Advanced Agent Example](#advanced-agent-example).
124
121
125
-
### StandAlone Static Binaries
122
+
### Linux Static Binaries (Stand Alone, x86_64)
126
123
127
-
Pktvisor also provides standalone linux static binaries. It is also designed to work on Linux distributions and does not
128
-
require installation or any other dependencies.
124
+
pktvisor provides statically linked, dependency free linux binaries for each individual pktvisor tool. These are the smallest, most compact versions of the binaries.
129
125
130
-
You can run pktvisord by typing the following commands in your linux machine.
If you are unable to use the Docker container or the Linux binary, then you will have to build your own executable,
155
-
please see the [Build](#build) section below.
149
+
We are working on support for additional operating systems, CPU architectures and packaging systems. If you do not see your binary available, please see the [Build](#build) section below to build your own.
156
150
157
151
If you have a preferred installation method that you would like to see support
158
152
for, [please create an issue](https://github.com/ns1/pktvisor/issues/new).
@@ -161,8 +155,6 @@ for, [please create an issue](https://github.com/ns1/pktvisor/issues/new).
161
155
162
156
### Agent Usage
163
157
164
-
A collector agent should be installed on each node to be monitored.
165
-
166
158
Current command line options are described with:
167
159
168
160
```
@@ -220,9 +212,8 @@ or
220
212
--config FILE Use specified YAML configuration to configure options, Taps, and Collection Policies
221
213
Please see https://pktvisor.dev for more information
222
214
Modules:
223
-
--module-list List all modules which have been loaded (builtin and dynamic)
224
-
--module-load FILE Load the specified dynamic module
225
-
--module-dir DIR Set module search path
215
+
--module-list List all modules which have been loaded (builtin and dynamic).
216
+
--module-dir DIR Set module load path. All modules in this directory will be loaded.
226
217
Logging Options:
227
218
--log-file FILE Log to the given output file name
228
219
--syslog Log to syslog
@@ -327,25 +318,26 @@ Usage:
327
318
pktvisor-cli -h
328
319
pktvisor-cli --version
329
320
330
-
-H string
331
-
Query pktvisord metrics webserver on the given host (default "localhost")
332
-
-h Show help
333
-
-p int
334
-
Query pktvisord metrics webserver on the given port (default 10853)
335
-
-version
336
-
Show client version
321
+
Options:
322
+
-p PORT Query pktvisord metrics webserver on the given port [default: 10853]
323
+
-H HOST Query pktvisord metrics webserver on the given host [default: localhost]
324
+
-P POLICY pktvisor policy to query [default: default]
325
+
--tls Use TLS to communicate with pktvisord metrics webserver
326
+
--tls-noverify Do not verify TLS certificate
327
+
-h Show this screen
328
+
--version Show client version
337
329
338
330
```
339
331
340
-
### pcap and dnstap File Analysis
332
+
### File Analysis (pcap and dnstap)
341
333
342
334
`pktvisor-reader` is a tool that can statically analyze prerecorded packet capture and dnstap files.
343
335
344
336
pcap files can come from many sources, the most famous of which is [tcpdump](https://www.tcpdump.org/). Dnstap files
345
337
can be generated from most DNS server software that support dnstap logging, either directly or
346
338
using a tool such as [golang-dnstap](https://github.com/dnstap/golang-dnstap).
347
339
348
-
Both take many of the same options, and do all of the same analysis, as `pktvisord` for live capture.
340
+
Both take many of the same options, and do all of the same analysis, as `pktvisord` for live capture. pcap files may include sFlow capture data.
349
341
350
342
```
351
343
docker run --rm ns1labs/pktvisor pktvisor-reader --help
@@ -482,20 +474,20 @@ interval = "60"
482
474
483
475
#### Prometheus Metrics
484
476
485
-
`pktvisord`also has native Prometheus support, which you can enable by passing `--prometheus`. The metrics are
486
-
available for collection at the standard `/metrics` endpoint.
477
+
`pktvisord` has native Prometheus support. The `default` policy metrics are
478
+
available for collection at the standard `/metrics` endpoint, or use `/api/v1/policies/__all/metrics/prometheus` to collect metrics from all policies.
0 commit comments