Network monitoring tool & TLS/SSL sniffer using eBPF. Powered by Aya-rs 🐝
Kernel and user space code written entirely in Rust ❤
Nflux is an eBPF-based tool that currently serves two purposes:
-
netrace: monitors
incoming/outgoingtraffic on a Linux system by attaching a TC (Traffic Control) program using eBPF technology. It can be attached to both physical and virtual interfaces (wireguard), allowing us to obtain networking data at a very low level. Supports only Ipv4 packet sniffing (Ipv6 is being implemented). -
tlstrace: sniffs
read/writetraffic before it is encrypted by libraries such as OpenSSL. In other words, it allows reading data from the buffer of libraries like OpenSSL. (A simple curl command, for example, uses this library to encrypt its data before sending it to the destination). Supports only HTTP1.1 (HTTPS2 HPACK decompression is being implemented).
Read the installation doc.
Read the usage doc.
nflux is distributed under the terms of the AGPL3 license.